diff --git a/.agents/skills/dsh-find-simplifications/SKILL.md b/.agents/skills/dsh-find-simplifications/SKILL.md
index 8fad167a60..59dde3df0d 100644
--- a/.agents/skills/dsh-find-simplifications/SKILL.md
+++ b/.agents/skills/dsh-find-simplifications/SKILL.md
@@ -41,6 +41,14 @@ Use parallel subagents when the user asks for breadth or many candidates. Give e
 
 If subagents are unavailable, simulate the same breadth yourself. Do not let the first good candidate stop the survey.
 
+Start with the largest production-code deltas. A broad simplification audit that stops after obvious unused symbols can miss the files where duplicated lifecycle or defensive machinery carries most of the cost.
+
+## Audit Trust And Lifecycle Boundaries
+
+Classify every defensive copy, freeze, validator, and callback capture by the boundary it crosses. Same-process typed service/plugin calls ordinarily borrow readonly values; parser/config, queue, model/tool JSON, durable/file, worker, process, and wire boundaries own or validate data. Tests built around hostile getters, fake typed objects, callback replacement, or mutation after a same-process handoff are evidence of a potentially speculative contract, not automatic justification for keeping it.
+
+For complex asynchronous code, draw the ownership graph and map each sentinel, readiness promise, cancellation path, disposer, and state flag to a distinct owner or transition. When several mechanisms mirror the same liveness or settlement fact, propose one transaction or lifecycle controller instead. Preserve separate machinery where it protects a real boundary: synchronous publication and rollback, callback containment, first-terminal-outcome arbitration, worker/process ownership, or dispose-to-quiescence.
+
 ## Prove Or Reject Each Candidate
 
 For every symbol or behavior, classify consumers before writing:
@@ -60,7 +68,7 @@ Reject or downgrade a candidate when:
 
 ## Write The RFC
 
-Create one file per durable proposal under `docs/rfc/proposed/yyyy-mm-dd-topic.md` and add it to the Proposed table in `docs/rfc/README.md`. Keep prose paragraphs on one physical line and use relative Markdown links.
+Create one file per durable proposal under `docs/rfc/<lifecycle>/<class>/yyyy-mm-dd-topic.md`, following the lifecycle/classification contract in `docs/rfc/README.md`. Regenerate `docs/rfc/INDEX.md`; never add a manual RFC table to the README. Keep prose paragraphs on one physical line and use relative Markdown links.
 
 Prefer this shape, adjusting when the idea needs it:
 
diff --git a/docs/architecture.md b/docs/architecture.md
index 249765eb45..0976277aaf 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -93,7 +93,7 @@ forever:
     checkpoint persistence and notify idle/running status
 ```
 
-Prompt assembly is single-path: `renderPrompt(assemble({ agent }))` IS the system prompt sent to the model. Plugins contribute ordered sections (static or computed from the per-call `AssembleContext`), tool schemas, and named variables interpolated as `{{name}}` at render — strictly, so an unknown or valueless reference fails the turn instead of shipping a hole. `dsh-system-prompt` owns the openers — the static `harness:identity` section (order −100) and the deployment's persona (order 0, its `persona` config, shared context-wide) — while the shipped loop registers the `model`/`cwd` variables; prompt-fact ownership is pinned by the [prompt-variables RFC](rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md).
+Prompt assembly is single-path: the loop sends `renderPrompt(await assemble(assembleContextFor(agent)))`; the helper couples the explicit agent and scope. Plugins contribute ordered sections, tool schemas, and named variables interpolated as `{{name}}` at render — strictly, so an unknown or valueless reference fails the turn instead of shipping a hole. `dsh-system-prompt` owns the openers — the static `harness:identity` section (order −100) and the deployment's persona (order 0, its `persona` config, shared context-wide) — while the loop registers the `model`/`cwd` variables; prompt-fact ownership is pinned by the [prompt-variables RFC](rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md).
 
 Post-tool context lands after all tool results so tool-call/result adjacency stays stable. Steering drains between steps; ordinary leftover steering after a turn is re-queued as input. A terminal `agent/turn-stop` is the explicit exception: it runs after ordinary continuation and steering folding, then remains authoritative through turn close and flush so steering from those later listeners is discarded rather than becoming another step or turn; ordinary queued prompts are preserved.
 
@@ -105,11 +105,11 @@ Every session event is turn-enclosed. Reloading a crashed session preserves the
 
 ### Agent Handles
 
-`ctx.agents` owns live agents and returns an `AgentHandle { agent, dispose() }`. `Agent` is the API other plugins drive: `send()` queues work, `steer()` injects mid-turn content, `inject()` appends context and opens a one-shot injection turn when idle, `cancel()` is the public stop primitive, and `whenIdle()` observes quiescence. Lifecycle owners tear down with `await dispose()`.
+`ctx.agents` owns live agents and returns an `AgentHandle { agent, dispose() }`. `Agent` is the API other plugins drive: `send()` queues work, `steer()` injects mid-turn content, `inject()` appends context and opens a one-shot injection turn when idle, `cancel()` is the public stop primitive, and `whenIdle()` observes quiescence. The caller fiber and concrete factory provider structurally co-own programmatic lifecycles; a consumer handle is the only non-structural teardown capability, and every owner reaches the same awaited disposer.
 
 ### Agent Scope
 
-Every live agent owns a scope context, `agent.ctx` ([`dsh-scope`](../packages/core/scope/README.md), key = the agent). Registrations through it — tools, prompt sections/variables, listeners, `tools.restrict()` masks — are visible to that agent alone, SHADOW same-named global contributions for it (per-agent personas and tool variants), and unwind with the agent; an `agent.ctx` listener hears only that agent's dispatches, while events about one agent dispatch with its scope carrier. `CreateAgentOptions.setup(agentCtx)` composes a child's scoped world at creation (the subagent seam's `persona`/`toolFilter`) — setup registers, never drives. Dev invariants enforce carrier/subject identity; `verify-scoped-dispatch` pins enforced ⇔ documented. Rationale: [agent-scope RFC](rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md).
+Every live agent owns `agent.ctx` ([`dsh-scope`](../packages/core/scope/README.md), keyed by the agent). Its registrations are visible only to that agent, shadow same-named globals, and unwind with it. Its listeners hear only that agent's dispatches; an opaque carrier routes while the real subject stays explicit. `CreateAgentOptions.setup(agentCtx)` composes this world before publication and does not drive. Dev invariants and `verify-scoped-dispatch` keep carrier/subject identity aligned with event declarations. Rationale: [agent-scope RFC](rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md); subagent `persona`, `toolFilter`, and `maxDepth` are the separate [composition-controls feature](rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md).
 
 ## State
 
@@ -160,6 +160,7 @@ New behavior should attach to a documented extension point; changing the shipped
 The [extension cookbook](cookbook/extension-cookbook.md) carries plugin skeletons and the feature-to-seam map; step-by-step guides cover [packages](cookbook/adding-a-package.md), [tools](cookbook/adding-a-tool.md), [LLM adapters](cookbook/adding-an-llm-adapter.md), and [vendored packages](cookbook/adding-a-vendored-package.md).
 
 ## Quick Reference
+- Domain terms in the [glossary](glossary.md)
 - Type definitions in [core-data-structures/](core-data-structures/core.md)
 - Exact event and service signatures in [events](cordis-catalog/events.md)
 - [services](cordis-catalog/services.md) catalogs
diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index 18ef659ee0..63d1303fc6 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -113,30 +113,15 @@ Source: [`packages/core/agent-core/src/index.ts:87`](../packages/core/agent-core
 Requires: `agents` · `sessions` · `llm` · `tools` · `systemPrompt`
 
 ```ts config-catalog
-/**
- * Plugin config: the agents to create — or resume, via `resumeSessionId` —
- * declaratively at startup, so a cordis.yml deployment needs no code.
- */
+/** Plugin configuration for declarative startup agents. */
 export interface Config {
-  /** Agents created from configuration at startup. */
+  /** Agents created or resumed at plugin startup. */
   agents: (AgentOptions & {
-    /** Agent id to register under; also seeds the fresh per-run session id (`${id}-session-<uuid>`). */
+    /** Registry identity for the live agent. */
     id: AgentId
-    /** Optional workspace cwd for the config-created fresh session. */
+    /** Optional workspace for a fresh session. */
     cwd?: string
-    /**
-     * If set, the config agent RESUMES this persisted session id instead of
-     * starting a fresh `${id}-session-<uuid>`. Sourced from an env var in
-     * cordis.yml (`resumeSessionId: !!js process.env.RESUME_SESSION_ID`), so a
-     * demo can continue a prior conversation without code changes. Requires a
-     * `dsh-session-persistence` backend; the resume is deferred until that
-     * service is available (via `ctx.inject`) and the loaded session's events
-     * seed the live session so history continues.
-     *
-     * The schema accepts a plain string at runtime (cordis.yml values are
-     * untyped); the brand is compile-time only — the config format is the
-     * boundary where an id enters, so the TYPE declares the brand here.
-     */
+    /** Persisted session to resume instead of creating a fresh session. */
     resumeSessionId?: SessionId
   })[]
 }
@@ -144,7 +129,7 @@ export interface Config {
 
 Depends on: [`AgentId`](../packages/core/agent/src/index.ts) · [`AgentOptions`](../packages/core/agent/src/index.ts) · [`SessionId`](../packages/core/session/src/index.ts)
 
-Source: [`packages/core/agent-loop/src/index.ts:37`](../packages/core/agent-loop/src/index.ts)
+Source: [`packages/core/agent-loop/src/index.ts:325`](../packages/core/agent-loop/src/index.ts)
 
 ## `@deepseek-ai/dsh-bash-local`
 
@@ -343,24 +328,6 @@ export interface Config {
 
 Source: [`packages/hooks/hooks-codex/src/index.ts:43`](../packages/hooks/hooks-codex/src/index.ts)
 
-## `@deepseek-ai/dsh-invariants`
-
-Requires: `sessions`
-
-```ts config-catalog
-/** Plugin config. */
-export interface Config {
-  /**
-   * Deep-freeze logged session-event data so mutating a logged event throws.
-   * Default true — this plugin only runs in dev/test, where freezing is the
-   * point. Set false to assert the event contract without freezing.
-   */
-  freeze?: boolean
-}
-```
-
-Source: [`packages/support/invariants/src/index.ts:48`](../packages/support/invariants/src/index.ts)
-
 ## `@deepseek-ai/dsh-llm-deepseek`
 
 Requires: `llm`
@@ -578,12 +545,12 @@ Source: [`packages/session-persistence/session-persistence-sqlite/src/index.ts:5
 ```ts config-catalog
 /** Skill registry configuration. */
 export interface Config {
-  /** Maximum number of completed cwd/provider catalog snapshots kept in memory. */
-  collectCacheMaxEntries?: number
+  /** Maximum number of completed cwd/provider catalogs kept in memory. */
+  readonly collectCacheMaxEntries?: number
 }
 ```
 
-Source: [`packages/skill/skill/src/index.ts:112`](../packages/skill/skill/src/index.ts)
+Source: [`packages/skill/skill/src/index.ts:113`](../packages/skill/skill/src/index.ts)
 
 ## `@deepseek-ai/dsh-skill-local`
 
@@ -730,9 +697,11 @@ export interface Config {
   /** Which start-time capabilities to advertise (default: all `true`). */
   capabilities?: Partial<SubagentCapabilities>
   /**
-   * The context contract to declare ({@link SubagentProvider.inheritsParentContext});
-   * default `false` (spawn-like). Set `true` to exercise the fork-shaped tool
-   * wording in consumer tests.
+   * The conversation-history descriptor to declare
+   * ({@link SubagentProvider.inheritsParentContext}); default `false` (fresh
+   * conversation). Set `true` to exercise seeded/fork wording in consumer
+   * tests. This flag says nothing about tool, service, scope, or authority
+   * inheritance.
    */
   inheritsParentContext?: boolean
   /**
@@ -745,7 +714,7 @@ export interface Config {
 
 Depends on: [`SubagentCapabilities`](../packages/subagent/subagent/src/index.ts) · [`SubagentStopReason`](../packages/subagent/subagent/src/index.ts)
 
-Source: [`packages/support/subagent-mock/src/index.ts:87`](../packages/support/subagent-mock/src/index.ts)
+Source: [`packages/support/subagent-mock/src/index.ts:97`](../packages/support/subagent-mock/src/index.ts)
 
 ## `@deepseek-ai/dsh-subagent-spawn`
 
@@ -808,7 +777,7 @@ export interface Config {
 }
 ```
 
-Source: [`packages/core/system-prompt/src/index.ts:264`](../packages/core/system-prompt/src/index.ts)
+Source: [`packages/core/system-prompt/src/index.ts:257`](../packages/core/system-prompt/src/index.ts)
 
 ## `@deepseek-ai/dsh-tool-cordis`
 
@@ -911,8 +880,9 @@ export interface Config {
    * Recursion cap applied to every child this tool spawns (see
    * `SubagentStartRequest.maxDepth`): a spawn whose child would sit deeper
    * than this in the delegation tree is rejected. Requires the provider's
-   * `depthLimit` capability. Omitted ⇒ unbounded (bound it in deployments
-   * that expose this tool to children).
+   * `depthLimit` capability. Must be a non-negative safe integer and is
+   * validated when the plugin loads. Omitted ⇒ unbounded (bound it in
+   * deployments that expose this tool to children).
    */
   maxDepth?: number
 }
@@ -920,7 +890,7 @@ export interface Config {
 
 Depends on: [`AgentOptions`](../packages/core/agent/src/index.ts)
 
-Source: [`packages/subagent/tool-subagent/src/index.ts:44`](../packages/subagent/tool-subagent/src/index.ts)
+Source: [`packages/subagent/tool-subagent/src/index.ts:47`](../packages/subagent/tool-subagent/src/index.ts)
 
 ## `@deepseek-ai/dsh-tool-web`
 
@@ -988,7 +958,7 @@ export interface Config {
 export type ToolPresentationMode = 'native' | 'code' | 'both'
 ```
 
-Source: [`packages/core/tools/src/index.ts:409`](../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:407`](../packages/core/tools/src/index.ts)
 
 ## `@deepseek-ai/dsh-user-approval`
 
@@ -1001,7 +971,7 @@ export interface Config {
    * (fail-closed with none); `'never'` auto-rejects every ask without
    * prompting (the deterministic CI/unattended stance).
    */
-  policy?: ApprovalPolicy
+  readonly policy?: ApprovalPolicy
 }
 
 /**
@@ -1019,7 +989,7 @@ export interface Config {
 export type ApprovalPolicy = 'ask' | 'never'
 ```
 
-Source: [`packages/ui/user-approval/src/index.ts:268`](../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:270`](../packages/ui/user-approval/src/index.ts)
 
 ## `@deepseek-ai/dsh-web`
 
@@ -1168,6 +1138,7 @@ These load from a `cordis.yml` entry with no `config:` block; they declare no co
 
 - `@deepseek-ai/dsh-agent` ([`packages/core/agent/src/index.ts`](../packages/core/agent/src/index.ts))
 - `@deepseek-ai/dsh-fs-policy` ([`packages/fs/fs-policy/src/index.ts`](../packages/fs/fs-policy/src/index.ts))
+- `@deepseek-ai/dsh-invariants` — requires `sessions` ([`packages/support/invariants/src/index.ts`](../packages/support/invariants/src/index.ts))
 - `@deepseek-ai/dsh-llm` ([`packages/llm/llm/src/index.ts`](../packages/llm/llm/src/index.ts))
 - `@deepseek-ai/dsh-session` ([`packages/core/session/src/index.ts`](../packages/core/session/src/index.ts))
 - `@deepseek-ai/dsh-subagent` ([`packages/subagent/subagent/src/index.ts`](../packages/subagent/subagent/src/index.ts))
diff --git a/docs/cookbook/adding-a-tool.md b/docs/cookbook/adding-a-tool.md
index 5eede7ff5d..2912fde6e4 100644
--- a/docs/cookbook/adding-a-tool.md
+++ b/docs/cookbook/adding-a-tool.md
@@ -34,9 +34,9 @@ Registration is effect-based: disposing the plugin fiber unregisters the tool (w
 ## Rules of the execute() contract
 
 - **Args are validated for you.** `defineTool` validates the model-generated `arguments` against the `SchemaSpec` before `execute` runs (type, required keys, enum membership, nested objects/arrays — [runtime arg validation](../rfc/implemented/architecture/2026-06-11-runtime-arg-validation.md)), so inside `execute` the args already match `InferArgs`. You still hand-check value constraints the DSL can't express (non-empty strings, positive numbers, cross-field rules); throw a descriptive Error for those. Raw JSON-Schema tools registered directly (MCP) are NOT validated by the harness — they validate their own input.
-- **Registration snapshots your definition.** Parameters must be losslessly JSON-serializable; the registry validates and clones them, copies the scalar fields, binds each callback once to your definition as its method receiver, and freezes the stored record. Reassigning `definition.execute` after registration does not hot-swap the tool—dispose and register a new definition through the owning effect instead. Deliberate mutable state inside the callback's closure or receiver remains ordinary plugin state.
-- **Execution identity is protected.** The registry requires `arguments` to survive lossless-JSON validation before and after cloning, freezes the detached value before policy starts, and assigns an opaque `exec.token`; `callId`, `name`, `arguments`, `agent`, `token`, and an optional enclosing-transport `parent` token stay immutable through dispatch. `parent` is identity-only and exposes no live outer execution. Treat `args` as readonly input. An around-dispatch wrapper may add, replace, or remove only `exec.signal` to impose cancellation or a deadline.
-- **Throwing or returning non-JSON data means isError.** The registry catches anything `execute()` throws and validates the complete post-policy result as losslessly JSON-serializable before final observers run. A throw, malformed result, or non-JSON content/context/meta becomes `{isError: true}` so the live outcome cannot succeed and then fail at the durable log. Use errors for infrastructure failures (bad input, spawn errors, aborts), but report domain failures in the result text instead (for example, tool-bash returns `[exit code: 9]` with `isError: false` because the model decides what a failing command means).
+- **Registration borrows your readonly definition.** A typed same-process contribution is not a serialization boundary; do not mutate its schema or replace callbacks after registration. `schemas()` materializes only the explicit model-facing projection. To hot-swap a tool, dispose its owning effect and register the replacement; mutable state inside the callback's closure remains ordinary plugin state.
+- **Execution identity is protected.** The registry materializes `arguments` as detached lossless JSON in one recursive pass, freezes that value before policy starts, and assigns an opaque `exec.token`; `callId`, `name`, `arguments`, `agent`, `token`, and an optional enclosing-transport `parent` token stay immutable through dispatch. `parent` is identity-only and exposes no live outer execution. Treat `args` as readonly input. An around-dispatch wrapper may add, replace, or remove only `exec.signal` to impose cancellation or a deadline.
+- **Throwing or returning non-JSON data means isError.** The registry catches anything `execute()` throws and materializes the complete post-policy result as lossless JSON before final observers run. A throw, malformed result, or non-JSON content/context/meta becomes `{isError: true}` so the live outcome cannot succeed and then fail at the durable log. Use errors for infrastructure failures (bad input, spawn errors, aborts), but report domain failures in the result text instead (for example, tool-bash returns `[exit code: 9]` with `isError: false` because the model decides what a failing command means).
 - **Honor `exec.signal`.** Cancel in-flight work when it fires.
 - **Attach durable card data with `meta` (optional).** `execute` may return `{ content, meta }` instead of a bare `ContentBlock[]` — `meta` is a JSON-serializable payload the core treats as opaque, persisted on the `tool/result` event and handed back to your `presentResult` (so a card that needs more than `args`, like `write`/`edit`'s applied-hunk diff, survives a session replay). Keep UI-only data here, never in the model-facing `content`.
 - **Use `exec.agent` for async notifications.** `agent.inject(content, {source: {kind: 'plugin', plugin: '<name>'}})` appends durable context the NEXT model request sees — it is not a wake-up (an idle agent stays idle). Guard against disposed agents (try/catch).
diff --git a/docs/cookbook/extension-cookbook.md b/docs/cookbook/extension-cookbook.md
index f30d38e971..f15ef37e9d 100644
--- a/docs/cookbook/extension-cookbook.md
+++ b/docs/cookbook/extension-cookbook.md
@@ -56,7 +56,7 @@ export function apply(ctx: Context) {
 
 ## A client-driver plugin (external protocol bridge)
 
-A *client driver* is a UI plugin whose "user" is another program speaking a wire protocol rather than a human at a terminal. It owns the process's stdio (so it must run with **no stdout logger** — every non-protocol byte corrupts the stream), creates/resumes agents on demand through the `dsh-agent` factory seam, translates harness events (`session/event`, `agent/*`) into outbound protocol messages, and translates inbound requests back into `agent.send()` / `agent.cancel()`. Two harness-specific contracts make it correct: resolve each request exactly once off a settle signal (settle from the durable `turn/end` session event — the boundary is a session event, not an `agent/*` mirror — with `agent/status` as the fallback if a peer listener starved yours), and tear each agent down through its `AgentHandle.dispose()` (which stops the loop, `await`s its exit, and unregisters), not just `cancel()` — disposal must *reach* quiescence, not merely request it.
+A *client driver* is a UI plugin whose "user" is another program speaking a wire protocol rather than a human at a terminal. It owns the process's stdio (so it must run with **no stdout logger** — every non-protocol byte corrupts the stream), creates/resumes agents on demand through the `dsh-agent` factory seam, translates harness events (`session/event`, `agent/*`) into outbound protocol messages, and translates inbound requests back into `agent.send()` / `agent.cancel()`. Two harness-specific contracts make it correct: correlate and settle each request exactly once from the durable `turn/end` session event even if rendering fails, and tear each agent down through its `AgentHandle.dispose()` (which stops the loop, `await`s its exit, and unregisters), not just `cancel()` — disposal must *reach* quiescence, not merely request it.
 
 `packages/ui/acp` is the worked example: it bridges the agent to the Agent Client Protocol (JSON-RPC over stdio) so Zed and other ACP editors can drive it. See its README for the full method surface and the permission-prompt answerer it registers on the approval seam.
 
@@ -97,7 +97,7 @@ Every product feature maps to a listener on a documented extension seam — the
 | Dynamic workflow | `ctx.workflows` + the worker-thread engine + the `workflow` tool; structured in-process children enforce output with scoped prompt protection, a monotonic tool guard, final `tools/result` commit (including enclosing `run_code`), and terminal `agent/turn-stop` |
 | Queued + steering messages | core `Agent.send()` / `Agent.steer()` |
 | Context compaction (auto + manual) | the `ctx.compact` seam + a backend (`dsh-compact-basic`) on the serial `agent/pre-step` seam; auto = token-pressure check before each step; a manual trigger invokes the same `ctx.compact` routine ([compaction RFC](../rfc/implemented/feature/2026-06-18-compaction-capability-seam.md) — the model-facing `/compact` consumer tool is deferred) |
-| System prompt configurability | `ctx.systemPrompt.section()` with ordering; an owner uses `systemPrompt.protect()` only when its canonical section/tool presence is a correctness invariant |
+| System prompt configurability | `ctx.systemPrompt.section()` with ordering; a protocol owner sets `ownerFinal: true` on the section or tool only when canonical presence is a correctness invariant |
 | AGENTS.md (root) | a section provider reading the file |
 | AGENTS.md (subdir, on-touch) + file-change notices | `agent.inject()` from a watcher / tool-result listener |
 | Built-in tools | `ctx.tools.register()`; schemas flow into the assembly automatically — the `dsh-tool-*` families (bash, fs, web, subagent, todo) are the shipped examples |
diff --git a/docs/cordis-catalog/events.md b/docs/cordis-catalog/events.md
index 0c5399b41b..e0149c7c67 100644
--- a/docs/cordis-catalog/events.md
+++ b/docs/cordis-catalog/events.md
@@ -15,7 +15,7 @@ Dispatch modes: **emit** (fire-and-forget), **waterfall** (each listener gets `n
 
 ### `agent/created` — emit
 
-An agent's fully composed scoped world was published in the AgentRegistry. Its session is already live in the session store, but concrete factories may keep driving verbs locked until the subsequent `agent/session-start` boundary; that event is the first supported place to inject or queue work during startup.
+An agent's fully composed scoped world was published in the AgentRegistry. Its session is already live in the session store. Setup is composition-only by contract; the subsequent `agent/session-start` boundary is the first supported place to inject or queue startup work. A synchronous listener throw vetoes publication and rollback emits the matching disposal edges; returned-promise rejection is observed and logged but cannot retroactively veto this synchronous boundary. A synchronous listener that requests the advanced registry detach does not remove the entry immediately: removal and the paired `agent/disposed` edge wait until the creation dispatch unwinds, so no later creation listener observes a disposal that preceded its own creation callback.
 
 ```ts cordis-catalog
 'agent/created'(this: Scoped<Agent>, agent: Agent): void
@@ -23,11 +23,11 @@ An agent's fully composed scoped world was published in the AgentRegistry. Its s
 
 Types: [Agent](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:300`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:316`](../../packages/core/agent/src/types.ts)
 
 ### `agent/disposed` — emit
 
-An agent was removed from the registry after its driver and any in-flight turn reached quiescence. Ordered teardown may still be detaching the session and unwinding the agent's scoped registrations when this notification runs.
+An agent was removed from the registry. The concrete AgentLoop lifecycle emits this only after its driver and any in-flight turn reach quiescence; a custom agent registered through the public registry owns its own driver contract, which the registry cannot infer. Ordered teardown may still be detaching the session and unwinding scoped registrations when this runs.
 
 ```ts cordis-catalog
 'agent/disposed'(this: Scoped<Agent>, agent: Agent): void
@@ -35,7 +35,7 @@ An agent was removed from the registry after its driver and any in-flight turn r
 
 Types: [Agent](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:314`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:331`](../../packages/core/agent/src/types.ts)
 
 ### `agent/error` — emit
 
@@ -47,7 +47,7 @@ A step or turn errored. The loop reports a failure here (plus the logger) even w
 
 Types: [Agent](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:587`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:606`](../../packages/core/agent/src/types.ts)
 
 ### `agent/pre-step` — serial
 
@@ -61,7 +61,7 @@ Serial (awaited in registration order), not a waterfall: a listener mutates the
 
 Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:419`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:438`](../../packages/core/agent/src/types.ts)
 
 ### `agent/prompt-submit` — waterfall
 
@@ -73,11 +73,11 @@ Waterfall: decide what happens to ONE drained queued message before it becomes a
 
 Types: [Agent](../core-data-structures/core.md) · [ContentBlock](../core-data-structures/core.md) · [MessageSource](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:437`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:456`](../../packages/core/agent/src/types.ts)
 
 ### `agent/queued` — emit
 
-A message entered the agent's inbox (queued or steering). `source` is the resolved source (defaults applied), not the caller's raw options.
+A message entered the agent's inbox (queued or steering). Content and the resolved source are the detached, deeply-frozen values retained by the inbox. `source` has defaults applied and is not the caller's raw options.
 
 ```ts cordis-catalog
 'agent/queued'(this: Scoped<Agent>, agent: Agent, content: ContentBlock[], info: { source: MessageSource; steering: boolean }): void
@@ -85,7 +85,7 @@ A message entered the agent's inbox (queued or steering). `source` is the resolv
 
 Types: [Agent](../core-data-structures/core.md) · [ContentBlock](../core-data-structures/core.md) · [MessageSource](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:342`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:360`](../../packages/core/agent/src/types.ts)
 
 ### `agent/request` — waterfall
 
@@ -97,7 +97,7 @@ Waterfall: shape the step's call configuration — model switching, sampling ove
 
 Types: [Agent](../core-data-structures/core.md) · [LlmCallConfig](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:466`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:485`](../../packages/core/agent/src/types.ts)
 
 ### `agent/session-prefix` — waterfall
 
@@ -113,19 +113,19 @@ The seed is a frozen empty list; a contributing listener returns a NEW array —
 
 Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:518`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:537`](../../packages/core/agent/src/types.ts)
 
 ### `agent/session-start` — emit
 
-The agent's session lifecycle began, fired once before its first turn. `source` says why (SessionStartSource: fresh startup, a resumed persisted session, …). A pure NOTIFICATION (emit, not waterfall): it carries no veto — a session-start listener that wants to seed context does so via `agent.inject()` (a `context/message` the first request sees), not by returning a decision. Cannot block the session from starting; that gap is deliberate (a bridge logs/injects, it does not gate startup).
+The agent's session lifecycle began, fired once before its first turn. `source` says why (SessionStartSource: fresh startup, a resumed persisted session, …). A pure NOTIFICATION (emit, not waterfall): a listener cannot veto by returning a decision or throwing. A listener that wants to seed context does so via `agent.inject()` (a `context/message` the first request sees). A lifecycle owner can still dispose its structural ownership edge during this notification; publication rechecks liveness and then aborts before the driver starts.
 
 ```ts cordis-catalog
 'agent/session-start'(this: Scoped<Agent>, agent: Agent, source: SessionStartSource): void
 ```
 
-Types: [Agent](../core-data-structures/core.md)
+Types: [Agent](../core-data-structures/core.md) · [SessionStartSource](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:362`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:381`](../../packages/core/agent/src/types.ts)
 
 ### `agent/status` — emit
 
@@ -137,7 +137,7 @@ Agent status changed (`idle` ⇄ `running`, or → `disposed`). Drive lifecycle
 
 Types: [Agent](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:328`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:345`](../../packages/core/agent/src/types.ts)
 
 ### `agent/step-result` — waterfall
 
@@ -149,7 +149,7 @@ Waterfall: post-process the assembled assistant Message before tool dispatch (va
 
 Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:533`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:552`](../../packages/core/agent/src/types.ts)
 
 ### `agent/turn-continuation` — waterfall
 
@@ -161,7 +161,7 @@ Waterfall: override the turn-continuation decision via a typed ContinuationDecis
 
 Types: [Agent](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:551`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:570`](../../packages/core/agent/src/types.ts)
 
 ### `agent/turn-stop` — serial
 
@@ -173,13 +173,13 @@ Serial terminal-stop checkpoint after the ordinary `agent/turn-continuation` wat
 
 Types: [Agent](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/types.ts:570`](../../packages/core/agent/src/types.ts)
+Source: [`packages/core/agent/src/types.ts:589`](../../packages/core/agent/src/types.ts)
 
 ## `approval/*`
 
 ### `approval/request` — waterfall
 
-Waterfall asking the composed answerers to decide one approval request. Dispatched only from ApprovalService.request — callers go through the service (which owns cancellation and the audit events), never through `ctx.waterfall` directly. A listener that can answer for this request's agent returns an outcome WITHOUT calling `next()` (the decision slot is single-occupancy, first listener to answer wins); a listener that does not recognize the agent MUST call `next()` so another answerer — or the fail-closed default `'unavailable'` — gets the question. Throwing is contained by the service and yields `'unavailable'`. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`) keys the carrier by `req.agent`: a listener registered through `agent.ctx` receives only that agent's questions, while a plain-context listener receives every agent's. `req` is the service's shallow-frozen acceptance snapshot: later caller mutation cannot redirect the question, while the `agent` and `signal` identity capabilities remain exact.
+Waterfall asking the composed answerers to decide one approval request. Dispatched only from ApprovalService.request — callers go through the service (which owns cancellation and the audit events), never through `ctx.waterfall` directly. A listener that can answer for this request's agent returns an outcome WITHOUT calling `next()` (the decision slot is single-occupancy, first listener to answer wins); a listener that does not recognize the agent MUST call `next()` so another answerer — or the fail-closed default `'unavailable'` — gets the question. Throwing is contained by the service and yields `'unavailable'`. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`) keys the carrier by `req.agent`: a listener registered through `agent.ctx` receives only that agent's questions, while a plain-context listener receives every agent's. `req` is a readonly same-process value borrowed from the caller.
 
 ```ts cordis-catalog
 'approval/request'(this: Scoped<ApprovalService>, req: ApprovalRequest, next: () => Promise<ApprovalOutcome>): Promise<ApprovalOutcome>
@@ -187,7 +187,7 @@ Waterfall asking the composed answerers to decide one approval request. Dispatch
 
 Types: [ApprovalOutcome](../core-data-structures/approval.md) · [ApprovalRequest](../core-data-structures/approval.md)
 
-Source: [`packages/ui/user-approval/src/index.ts:72`](../../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:70`](../../packages/ui/user-approval/src/index.ts)
 
 ## `fs/*`
 
@@ -245,17 +245,27 @@ Source: [`packages/llm/llm/src/index.ts:39`](../../packages/llm/llm/src/index.ts
 
 ### `session/created` — emit
 
-A session was created in the store. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session.
+A session was created in the store. A synchronous listener throw vetoes publication and rollback emits the matching `session/disposed` edge; returned-promise rejection is observed and logged but cannot retroactively veto this synchronous boundary. A synchronous listener that requests the advanced detach does not remove the entry immediately: removal and the paired `session/disposed` edge wait until the creation dispatch unwinds. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session.
 
 ```ts cordis-catalog
 'session/created'(this: Scoped<Session>, session: Session): void
 ```
 
-Source: [`packages/core/session/src/index.ts:47`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:52`](../../packages/core/session/src/index.ts)
+
+### `session/disposed` — emit
+
+A previously announced session left the store. Emitted exactly once on normal detach or publication rollback, and never for a prepared/entered session whose `session/created` announcement did not begin. Listener failures (including returned-promise rejections) are logged and contained per listener so teardown always reaches quiescence. Scope-filtered dispatch uses the same owner carrier captured at entry; agent-scoped listeners hear only their own session's teardown.
+
+```ts cordis-catalog
+'session/disposed'(this: Scoped<Session>, session: Session): void
+```
+
+Source: [`packages/core/session/src/index.ts:64`](../../packages/core/session/src/index.ts)
 
 ### `session/event` — emit
 
-An event was appended to a session log (sync, fire-and-forget). This is the per-append feed a UI or invariant plugin tails. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session.
+An event was appended to a session log (sync, fire-and-forget). This is the per-append feed a UI or invariant plugin tails. The log push is the commit point; synchronous throws and returned-promise rejections from observers are logged and contained per listener, so they cannot make a committed append appear to fail or starve later listeners. The exact callback list and Cordis internal-dispatch checks resolve before the push; callbacks themselves run only after it. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session.
 
 ```ts cordis-catalog
 'session/event'(this: Scoped<Session>, session: Session, event: SessionEvent): void
@@ -263,7 +273,7 @@ An event was appended to a session log (sync, fire-and-forget). This is the per-
 
 Types: [SessionEvent](../core-data-structures/core.md)
 
-Source: [`packages/core/session/src/index.ts:61`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:83`](../../packages/core/session/src/index.ts)
 
 ### `session/flush` — parallel
 
@@ -273,7 +283,7 @@ Awaited durability checkpoint. The agent loop awaits `ctx.sessions.flush(session
 'session/flush'(this: Scoped<Session>, session: Session): Promise<void> | void
 ```
 
-Source: [`packages/core/session/src/index.ts:79`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:101`](../../packages/core/session/src/index.ts)
 
 ## `skill/*`
 
@@ -285,7 +295,7 @@ A skill provider became resolvable in the `ctx.skills` registry. Consumers can o
 'skill/provider-added'(provider: SkillProvider): void
 ```
 
-Source: [`packages/skill/skill/src/index.ts:130`](../../packages/skill/skill/src/index.ts)
+Source: [`packages/skill/skill/src/index.ts:131`](../../packages/skill/skill/src/index.ts)
 
 ### `skill/provider-removed` — emit
 
@@ -295,49 +305,49 @@ A skill provider left the registry because its plugin fiber was disposed.
 'skill/provider-removed'(name: string): void
 ```
 
-Source: [`packages/skill/skill/src/index.ts:136`](../../packages/skill/skill/src/index.ts)
+Source: [`packages/skill/skill/src/index.ts:137`](../../packages/skill/skill/src/index.ts)
 
 ## `subagent/*`
 
 ### `subagent/end` — emit
 
-A started subagent run settled — emitted when SubagentRun.result resolves (any stop reason) or rejects (reported as `error`). Paired with Events['subagent/start']; a run whose readiness rejected emits neither event. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed by the DELEGATING PARENT — a listener registered through the parent's `agent.ctx` observes only its own delegations; a plain plugin listener observes every run.
+A ready child settled. Scope-filtered dispatch uses the same delegating parent carrier as `subagent/start`, so the lifecycle pair reaches the same scoped audience.
 
 ```ts cordis-catalog
 'subagent/end'(this: Scoped<SubagentService>, info: SubagentRunEndInfo): void
 ```
 
-Source: [`packages/subagent/subagent/src/index.ts:114`](../../packages/subagent/subagent/src/index.ts)
+Source: [`packages/subagent/subagent/src/index.ts:90`](../../packages/subagent/subagent/src/index.ts)
 
 ### `subagent/provider-added` — emit
 
-A provider became resolvable in the SubagentService registry. Consumers that derive state from a named provider (e.g. the model-facing tool wording in `dsh-tool-subagent`) react HERE instead of assuming load order — the cordis Loader starts sibling plugins concurrently, so "listed earlier in cordis.yml" does not mean "registered earlier".
+A provider became resolvable in the registry.
 
 ```ts cordis-catalog
 'subagent/provider-added'(provider: SubagentProvider): void
 ```
 
-Source: [`packages/subagent/subagent/src/index.ts:75`](../../packages/subagent/subagent/src/index.ts)
+Source: [`packages/subagent/subagent/src/index.ts:66`](../../packages/subagent/subagent/src/index.ts)
 
 ### `subagent/provider-removed` — emit
 
-A provider left the registry (its plugin's fiber was disposed — an unload or an HMR reload). Consumers holding provider-derived state drop it here; a reload re-fires `subagent/provider-added` with the fresh provider. Delivered with per-listener containment: a throwing subscriber is logged, never starves later subscribers, and never disrupts the provider's teardown.
+A provider left the registry. Accepted runs remain holder-owned.
 
 ```ts cordis-catalog
 'subagent/provider-removed'(name: string): void
 ```
 
-Source: [`packages/subagent/subagent/src/index.ts:86`](../../packages/subagent/subagent/src/index.ts)
+Source: [`packages/subagent/subagent/src/index.ts:72`](../../packages/subagent/subagent/src/index.ts)
 
 ### `subagent/start` — emit
 
-A subagent run started — emitted only after SubagentRun.started fulfills, when the provider has established a live child. For an in-process provider, `ctx.agents.get(info.id)` is therefore guaranteed to resolve during this notification. A readiness rejection emits neither lifecycle event; every emitted start is paired with Events['subagent/end']. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed by the DELEGATING PARENT — a listener registered through the parent's `agent.ctx` observes only its own delegations; a plain plugin listener observes every run.
+A provider established a ready child. For in-process providers, `ctx.agents.get(info.id)` resolves during this notification. Scope-filtered dispatch keys the carrier by the delegating parent, so a parent-scoped listener observes only its own delegations. Paired with `subagent/end`.
 
 ```ts cordis-catalog
 'subagent/start'(this: Scoped<SubagentService>, info: SubagentRunInfo): void
 ```
 
-Source: [`packages/subagent/subagent/src/index.ts:101`](../../packages/subagent/subagent/src/index.ts)
+Source: [`packages/subagent/subagent/src/index.ts:82`](../../packages/subagent/subagent/src/index.ts)
 
 ## `system-prompt/*`
 
@@ -353,7 +363,7 @@ Source: [`packages/core/system-prompt/src/index.ts:45`](../../packages/core/syst
 
 ### `system-prompt/change` — emit
 
-A section, tool provider, variable provider, or protection was registered or unregistered (the assembly inputs changed — possibly for one scope only). An UNFILTERED registry-subject notification, deliberately not scope-filtered dispatch: a global change concerns every agent's next assembly, so a scoped listener subscribing here sees every change, not just its own scope's.
+A section, tool provider, or variable provider was registered or unregistered (the assembly inputs changed — possibly for one scope only). An UNFILTERED registry-subject notification, deliberately not scope-filtered dispatch: a global change concerns every agent's next assembly, so a scoped listener subscribing here sees every change, not just its own scope's.
 
 ```ts cordis-catalog
 'system-prompt/change'(): void
@@ -371,11 +381,11 @@ A tool was registered or unregistered, or a scoped restriction changed (the avai
 'tools/change'(): void
 ```
 
-Source: [`packages/core/tools/src/index.ts:176`](../../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:173`](../../packages/core/tools/src/index.ts)
 
 ### `tools/execute` — waterfall
 
-Around-dispatch waterfall wrapping the registry's core tool dispatch, between the `tools/pre-execute` gate and the `tools/post-execute` seam. A listener receives `(exec, next)`: call `next()` to delegate to dispatch (returning its ToolExecutionResult, optionally wrapped), or return a replacement result without calling `next()` to short-circuit dispatch. The base `next()` IS the dispatch-with-normalization thunk — a thrown tool (or unknown tool) is already normalized to an `isError` result by the time a listener's `await next()` returns, so a wrapper never sees a raw throw from the tool body. This is the seam a timeout/retry/metrics plugin wraps: it can set or replace the one mutable field, `exec.signal` (e.g. with a per-call deadline), BEFORE `next()`, restore/delete it afterward, and inspect the result AFTER. Call identity (`token`, `callId`, `name`, `arguments`, `agent`, and `parent`) is immutable throughout the pipeline so a wrapper cannot change which capability or scope was authorized. (Cordis `next()` ignores passed arguments and re-invokes downstream with the shared payload, so a wrapper changes `exec.signal` in place rather than passing a new object to `next()`.) Multiple listeners compose by registration order — an outer one wraps the inner ones plus dispatch. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed by `exec.agent` — a listener registered through `agent.ctx` wraps only that agent's calls; a plain plugin listener wraps every call (including agent-less ones, which dispatch subject-less).
+Around-dispatch waterfall wrapping the registry's core tool dispatch, between the `tools/pre-execute` gate and the `tools/post-execute` seam. A listener receives `(exec, next)`: call `next()` to delegate to dispatch (returning its ToolExecutionResult, optionally wrapped), or return a replacement result without calling `next()` to short-circuit dispatch. The base `next()` IS the dispatch-with-normalization thunk — a thrown tool (or unknown tool) is already normalized to an `isError` result by the time a listener's `await next()` returns, so a wrapper never sees a raw throw from the tool body. This is the seam a timeout/retry/metrics plugin wraps: it can set or replace the one mutable field, `exec.signal` (e.g. with a per-call deadline), BEFORE `next()`, restore/delete it afterward, and inspect the result AFTER. Call identity (`token`, `callId`, `name`, `arguments`, `agent`, and `parent`) is immutable throughout the pipeline so a wrapper cannot change which tool and scope the pipeline accepted. (Cordis `next()` ignores passed arguments and re-invokes downstream with the shared payload, so a wrapper changes `exec.signal` in place rather than passing a new object to `next()`.) Multiple listeners compose by registration order — an outer one wraps the inner ones plus dispatch. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed by `exec.agent` — a listener registered through `agent.ctx` wraps only that agent's calls; a plain plugin listener wraps every call (including agent-less ones, which dispatch subject-less).
 
 ```ts cordis-catalog
 'tools/execute'(this: Scoped<ToolRegistry>, exec: ToolExecution, next: () => Promise<ToolExecutionResult>): Promise<ToolExecutionResult>
@@ -383,23 +393,23 @@ Around-dispatch waterfall wrapping the registry's core tool dispatch, between th
 
 Types: [ToolExecution](../core-data-structures/tools.md) · [ToolExecutionResult](../core-data-structures/tools.md)
 
-Source: [`packages/core/tools/src/index.ts:131`](../../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:128`](../../packages/core/tools/src/index.ts)
 
 ### `tools/post-execute` — waterfall
 
 Waterfall AFTER a tool runs — where hook plugins inspect the result and accept it (optionally REPLACING the model-facing content, and/or attaching `additionalContext` for the next request) or block it with corrective `feedback` (Claude Code's `PostToolUse`). Listeners receive `(exec, result, next)`: call `next()` to delegate to the default (accept unchanged), or return a PostToolDecision to override. Core tool dispatch runs earlier as the base `next()` of the `tools/execute` waterfall, all inside `execute`'s outer try/catch (and the tool body keeps its own inner try/catch, so a thrown tool still reaches `post-execute` as an `isError` result). Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed by `exec.agent` — a listener registered through `agent.ctx` fires only for that agent's calls; a plain plugin listener fires for every call (including agent-less ones, which dispatch subject-less).
 
 ```ts cordis-catalog
-'tools/post-execute'(this: Scoped<ToolRegistry>, exec: ToolExecution, result: ToolExecutionResult, next: () => Promise<PostToolDecision>): Promise<PostToolDecision>
+'tools/post-execute'(this: Scoped<ToolRegistry>, exec: ToolExecution, result: Readonly<ToolExecutionResult>, next: () => Promise<PostToolDecision>): Promise<PostToolDecision>
 ```
 
 Types: [ToolExecution](../core-data-structures/tools.md) · [ToolExecutionResult](../core-data-structures/tools.md)
 
-Source: [`packages/core/tools/src/index.ts:151`](../../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:148`](../../packages/core/tools/src/index.ts)
 
 ### `tools/pre-execute` — waterfall
 
-Waterfall BEFORE a tool runs — the gate where sandbox, permission, and hook plugins allow or deny a call (Claude Code's `PreToolUse`). Listeners receive `(exec, next)`: call `next()` to delegate to the default (allow), or return a PreToolDecision without calling `next()` to short-circuit. A `deny` skips dispatch and yields an `isError` result; the tool body never runs. Input rewrite is deliberately NOT offered here (see PreToolDecision); `ask` is serviced by the `ctx.approval` seam when one is mounted, and degrades to deny otherwise. The returned union is validated as an exact runtime shape before approval or guards run; a malformed JavaScript/casted decision fails closed as an `isError` result and the tool body never runs. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`) keys the carrier by `exec.agent`: a listener registered through `agent.ctx` fires only for that agent's calls, while a plain plugin listener fires for every call (including agent-less ones, which dispatch subject-less).
+Waterfall BEFORE a tool runs — the gate where sandbox, permission, and hook plugins allow or deny a call (Claude Code's `PreToolUse`). Listeners receive `(exec, next)`: call `next()` to delegate to the default (allow), or return a PreToolDecision without calling `next()` to short-circuit. A `deny` skips dispatch and yields an `isError` result; the tool body never runs. Input rewrite is deliberately NOT offered here (see PreToolDecision); `ask` is serviced by the `ctx.approval` seam when one is mounted, and degrades to deny otherwise. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`) keys the carrier by `exec.agent`: a listener registered through `agent.ctx` fires only for that agent's calls, while a plain plugin listener fires for every call (including agent-less ones, which dispatch subject-less).
 
 ```ts cordis-catalog
 'tools/pre-execute'(this: Scoped<ToolRegistry>, exec: ToolExecution, next: () => Promise<PreToolDecision>): Promise<PreToolDecision>
@@ -407,7 +417,7 @@ Waterfall BEFORE a tool runs — the gate where sandbox, permission, and hook pl
 
 Types: [ToolExecution](../core-data-structures/tools.md)
 
-Source: [`packages/core/tools/src/index.ts:104`](../../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:101`](../../packages/core/tools/src/index.ts)
 
 ### `tools/result` — parallel
 
@@ -419,7 +429,7 @@ Awaited notification of the authoritative FINAL tool outcome, after the complete
 
 Types: [ToolExecution](../core-data-structures/tools.md) · [ToolExecutionResult](../core-data-structures/tools.md)
 
-Source: [`packages/core/tools/src/index.ts:166`](../../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:163`](../../packages/core/tools/src/index.ts)
 
 ## `workflow/*`
 
@@ -431,17 +441,17 @@ One `agent()` call settled (clean result, child failure, or run cancellation). P
 'workflow/agent-end'(info: WorkflowRunInfo, agent: WorkflowAgentEndInfo): void
 ```
 
-Source: [`packages/workflow/workflow/src/index.ts:98`](../../packages/workflow/workflow/src/index.ts)
+Source: [`packages/workflow/workflow/src/index.ts:96`](../../packages/workflow/workflow/src/index.ts)
 
 ### `workflow/agent-start` — emit
 
-One `agent()` call established a ready child run. Paired with Events['workflow/agent-end'] by `agent.seq`. A call that never crosses the provider's publication/readiness boundary emits neither event in this pair.
+One `agent()` call established a ready child run. Paired with Events['workflow/agent-end'] by `agent.seq`. A call that never receives a ready run from the provider emits neither event in this pair.
 
 ```ts cordis-catalog
 'workflow/agent-start'(info: WorkflowRunInfo, agent: WorkflowAgentInfo): void
 ```
 
-Source: [`packages/workflow/workflow/src/index.ts:87`](../../packages/workflow/workflow/src/index.ts)
+Source: [`packages/workflow/workflow/src/index.ts:85`](../../packages/workflow/workflow/src/index.ts)
 
 ### `workflow/end` — emit
 
@@ -451,7 +461,7 @@ A workflow run settled (any stop reason). Fired when WorkflowRun.result resolves
 'workflow/end'(info: WorkflowRunInfo, result: WorkflowResultInfo): void
 ```
 
-Source: [`packages/workflow/workflow/src/index.ts:108`](../../packages/workflow/workflow/src/index.ts)
+Source: [`packages/workflow/workflow/src/index.ts:106`](../../packages/workflow/workflow/src/index.ts)
 
 ### `workflow/log` — emit
 
@@ -461,7 +471,7 @@ The script emitted a narration line (a `log(message)` call).
 'workflow/log'(info: WorkflowRunInfo, message: string): void
 ```
 
-Source: [`packages/workflow/workflow/src/index.ts:77`](../../packages/workflow/workflow/src/index.ts)
+Source: [`packages/workflow/workflow/src/index.ts:75`](../../packages/workflow/workflow/src/index.ts)
 
 ### `workflow/phase` — emit
 
@@ -471,7 +481,7 @@ The script entered a phase (a `phase(title)` call) — progress grouping for obs
 'workflow/phase'(info: WorkflowRunInfo, title: string): void
 ```
 
-Source: [`packages/workflow/workflow/src/index.ts:70`](../../packages/workflow/workflow/src/index.ts)
+Source: [`packages/workflow/workflow/src/index.ts:68`](../../packages/workflow/workflow/src/index.ts)
 
 ### `workflow/start` — emit
 
@@ -481,7 +491,7 @@ A workflow run started — the script's meta block validated, the body about to
 'workflow/start'(info: WorkflowRunInfo): void
 ```
 
-Source: [`packages/workflow/workflow/src/index.ts:62`](../../packages/workflow/workflow/src/index.ts)
+Source: [`packages/workflow/workflow/src/index.ts:60`](../../packages/workflow/workflow/src/index.ts)
 
 ## Inherited events (cordis core + loader/hmr/timer)
 
diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md
index ddf2a860e4..2e508e0a35 100644
--- a/docs/cordis-catalog/services.md
+++ b/docs/cordis-catalog/services.md
@@ -11,17 +11,15 @@ The **harness tier** below (the `@deepseek-ai/dsh-*` packages) is the vocabulary
 
 ## `ctx.agentLoop` — `AgentLoop`
 
-The agent-loop plugin (`ctx.agentLoop`): creates ReactLoopAgents, runs their loops, and registers them in `ctx.agents`. Also implements the AgentFactory seam, so plugins create/resume agents through `ctx.agents` (the interface) without depending on this concrete package.
-
-The loop itself is deliberately thin — every behavior beyond "call the model, run the tools, repeat" belongs to plugins listening on the event taxonomy declared in @deepseek-ai/dsh-agent.
+Concrete ReactLoopAgent factory and driver service.
 
 ```ts cordis-catalog
 create(id: AgentId, options: AgentOptions = {}, meta: Pick<SessionHeader, 'cwd'> = {}): ReactLoopAgent
-async createAgent(options: CreateAgentOptions): Promise<AgentHandle>
-async resume(options: ResumeAgentOptions): Promise<AgentHandle>
+async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise<AgentHandle>
+async resume(ownerCtx: Context, options: ResumeAgentOptions): Promise<AgentHandle>
 ```
 
-Source: [`packages/core/agent-loop/src/index.ts:71`](../../packages/core/agent-loop/src/index.ts)
+Source: [`packages/core/agent-loop/src/index.ts:338`](../../packages/core/agent-loop/src/index.ts)
 
 ## `ctx.agents` — `AgentRegistry`
 
@@ -40,7 +38,7 @@ list(): Agent[]
 
 Types: [Agent](../core-data-structures/core.md)
 
-Source: [`packages/core/agent/src/index.ts:169`](../../packages/core/agent/src/index.ts)
+Source: [`packages/core/agent/src/index.ts:203`](../../packages/core/agent/src/index.ts)
 
 ## `ctx.approval` — `ApprovalService`
 
@@ -54,7 +52,7 @@ async request(req: ApprovalRequest): Promise<ApprovalOutcome>
 
 Types: [ApprovalOutcome](../core-data-structures/approval.md) · [ApprovalRequest](../core-data-structures/approval.md)
 
-Source: [`packages/ui/user-approval/src/index.ts:292`](../../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:294`](../../packages/ui/user-approval/src/index.ts)
 
 ## `ctx.bash` — `BashExecutor` (abstract seam)
 
@@ -189,7 +187,7 @@ Contracts every implementation MUST honor (a DB backend asserts them inside a tr
 
 - **Append-only; a crashed turn is closed, not truncated.** Committed events — those at or below a flushed `turn/end` — are never rewritten. A crash can leave an unclosed final turn whose events are real (and possibly large); load preserves them and closes the orphaned turn with synthetic boundary events (see load). Only a never-fully-written torn tail fragment is discarded.
 - **Contiguous seq.** A persisted log is contiguous: `events[i].seq === i`. load rejects a parse error or a `seq` gap in the COMMITTED region (unloadable); append's first event `seq` MUST equal the backend's stored next-seq (after `load` has balanced any interrupted turn).
-- **JSON-serializable data.** `SessionEventMap` is merge-extensible and `event.data` is typed only as `SessionEventMap[K]`, so append REJECTS non-JSON-serializable data with an error naming the offending event type. A backend snapshots (serializes/clones) each event when it buffers, since `session.events` hands out the live mutable object.
+- **JSON-serializable events.** `SessionEventMap` is merge-extensible, so append materializes each complete batch through the shared lossless-JSON boundary before buffering it. The public `session.events` view is immutable, but persistence still snapshots direct/replay callers at this independent trust boundary.
 - **Durability.** append returns only once the batch is durable (the file backend fsyncs; a DB commits). create MAY defer the physical write until the first append (lazy materialization).
 
 ```ts cordis-catalog
@@ -220,7 +218,7 @@ list(): Session[]
 fork(source: SessionForkSource, boundary?: number, childSessionId?: SessionId): Session
 ```
 
-Source: [`packages/core/session/src/index.ts:427`](../../packages/core/session/src/index.ts)
+Source: [`packages/core/session/src/index.ts:591`](../../packages/core/session/src/index.ts)
 
 ## `ctx.skills` — `SkillService`
 
@@ -233,55 +231,52 @@ async list(options: SkillLookupOptions = {}): Promise<SkillSummary[]>
 async get(name: string, options: SkillLookupOptions = {}): Promise<SkillDefinition | undefined>
 ```
 
-Source: [`packages/skill/skill/src/index.ts:157`](../../packages/skill/skill/src/index.ts)
+Source: [`packages/skill/skill/src/index.ts:158`](../../packages/skill/skill/src/index.ts)
 
 ## `ctx.subagents` — `SubagentService`
 
-The `subagents` service: a registry of named SubagentProviders and a capability-checked start surface.
+Named provider registry and capability-checked start surface.
 
 ```ts cordis-catalog
 registerProvider(provider: SubagentProvider): () => Promise<void> | void
 getProvider(name: string): SubagentProvider | undefined
 list(): string[]
-start(name: string, request: SubagentStartRequest): SubagentRun
+async start(name: string, request: SubagentStartRequest): Promise<SubagentRun>
 ```
 
-Source: [`packages/subagent/subagent/src/index.ts:160`](../../packages/subagent/subagent/src/index.ts)
+Source: [`packages/subagent/subagent/src/index.ts:123`](../../packages/subagent/subagent/src/index.ts)
 
 ## `ctx.systemPrompt` — `SystemPrompt`
 
-Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and authoritative contribution protections; the agent loop calls `assemble(context)` once per step. Registers the harness-owned `harness:identity` and `deployment:persona` sections itself (see Config.persona).
+Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and owner-final contributions; the agent loop calls `assemble(context)` once per step. Registers the harness-owned `harness:identity` and `deployment:persona` sections itself (see Config.persona).
 
 ```ts cordis-catalog
 section(section: PromptSection): () => Promise<void> | void
 tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise<void> | void
 variable(name: string, provider: (context: AssembleContext) => string | undefined): () => Promise<void> | void
-protect(protection: PromptProtection): () => Promise<void> | void
 async assemble(context: AssembleContext = {}): Promise<PromptAssembly>
 ```
 
-Source: [`packages/core/system-prompt/src/index.ts:379`](../../packages/core/system-prompt/src/index.ts)
+Source: [`packages/core/system-prompt/src/index.ts:372`](../../packages/core/system-prompt/src/index.ts)
 
 ## `ctx.tools` — `ToolRegistry`
 
 Tool registry (`ctx.tools`): tool plugins register definitions; the agent loop executes calls through the `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute` → `tools/result` pipeline. The registry contributes its schemas into the system-prompt assembly — WHICH schemas is governed by its `mode` config (see Config.mode); under a non-native mode it also owns the reserved `run_code` presentation transport and the `tools:sdk` prompt section.
 
-Two registration layers (`@deepseek-ai/dsh-scope`): a registration through a plain plugin context is GLOBAL (visible to every agent); one through a scoped context (`agent.ctx`) is filed in that scope's layer — visible to that agent alone, disposed with the scope, and SHADOWING a global tool of the same name for that agent (most-specific-wins; within one layer a duplicate name still throws). restrict masks the global layer per scope. One visibility function (visible) feeds prompt assembly, get, and execute — and, under a non-native mode, the SDK section and `run_code`'s bindings — so what the model is shown, what a presenter renders, what a program can call, and what dispatches can never disagree.
+Two registration layers (`@deepseek-ai/dsh-scope`): a registration through a plain plugin context is GLOBAL (visible to every agent); one through a scoped context (`agent.ctx`) is filed in that scope's layer — visible to that agent alone, disposed with the scope, and SHADOWING a global tool of the same name for that agent (most-specific-wins; within one layer a duplicate name still throws). restrict masks the global layer per scope. One private visibility resolver feeds prompt assembly, get, and execute — and, under a non-native mode, the SDK section and `run_code`'s bindings — so what the model is shown, what a presenter renders, what a program can call, and what dispatches can never disagree.
 
 ```ts cordis-catalog
 register(definition: ToolDefinition): () => Promise<void> | void
 restrict(filter: ToolRestriction): () => Promise<void> | void
 guard(guard: ToolGuard): () => Promise<void> | void
-visible(scope?: ScopeKey): ToolDefinition[]
 get(name: string, scope?: ScopeKey): ToolDefinition | undefined
 schemas(scope?: ScopeKey): ToolSchema[]
-knownNames(scope?: ScopeKey): string[]
 async execute(exec: ToolExecutionInput): Promise<ToolExecutionResult>
 ```
 
 Types: [ToolDefinition](../core-data-structures/tools.md) · [ToolExecutionInput](../core-data-structures/tools.md) · [ToolExecutionResult](../core-data-structures/tools.md)
 
-Source: [`packages/core/tools/src/index.ts:481`](../../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:500`](../../packages/core/tools/src/index.ts)
 
 ## `ctx.userInteraction` — `UserInteractionService`
 
@@ -323,7 +318,7 @@ Abstract workflow execution service. Subclass, implement start, and load the sub
 Semantics every implementation must honor:
 
 - start throws synchronously for a request that cannot begin (an unparseable script, an invalid meta block). Once it returns a WorkflowRun, `result` NEVER rejects — every failure resolves with `stopReason: 'error'` (or `'cancelled'`) — and once the run is cancelled, `result` SETTLES within the implementation's bounded grace even if the script itself never settles (a consumer awaiting `result` must never be wedged past a cancellation).
-- The `workflow/*` events fire through emitWorkflowEvent (data snapshots, per-listener containment); `workflow/end` fires exactly once per started run, after `result` is settled or as it settles.
+- The `workflow/*` events fire through emitWorkflowEvent (borrowed immutable data, per-listener containment); `workflow/end` fires exactly once per started run, after `result` is settled or as it settles.
 - `dispose()` reaches quiescence within a bounded grace: it cancels, waits for the script to settle AND its started children to finish disposing, and abandons whatever is left rather than hanging its caller (the engine documents what abandonment leaves behind).
 - Runs are HOLDER-OWNED: the engine hands control (`cancel`/`dispose`) to the `start()` caller and does not track its live runs — disposing the engine's own fiber mid-run deliberately leaves those runs to their holders' teardown, so an engine reload cannot yank a run out from under the consumer awaiting it.
 
@@ -331,7 +326,7 @@ Semantics every implementation must honor:
 abstract start(request: WorkflowStartRequest): WorkflowRun
 ```
 
-Source: [`packages/workflow/workflow/src/index.ts:214`](../../packages/workflow/workflow/src/index.ts)
+Source: [`packages/workflow/workflow/src/index.ts:211`](../../packages/workflow/workflow/src/index.ts)
 
 ## Inherited `ctx` members (cordis core + loader/hmr/timer)
 
diff --git a/docs/cordis-primer.md b/docs/cordis-primer.md
index b59363eea7..5b14da901c 100644
--- a/docs/cordis-primer.md
+++ b/docs/cordis-primer.md
@@ -27,7 +27,7 @@ The mode is part of the event's public contract. New harness events document it
 
 `ctx.waterfall` is around-middleware. A listener receives `(...args, next)`. Call `next()` to delegate the possibly wrapped result to the next service; return without `next()` to short-circuit. Values propagate through `next()`'s return value.
 
-Cooperative listeners usually mutate a shared request or decision object and then delegate. A listener can also choose to repalce the result entirely and downstream listeners will only see the result after replacement. Use `prepend: true` only when the listener must run before ordinary registrations.
+Cooperative listeners usually mutate a shared request or decision object and then delegate. A listener can also choose to replace the result entirely and downstream listeners will only see the result after replacement. Use `prepend: true` only when the listener must run before ordinary registrations.
 
 For single-decision events, short-circuiting is the design. A policy listener can return without `next()` when it owns the decision, while a listener that only annotates or observes must delegate.
 
diff --git a/docs/core-data-structures/approval.md b/docs/core-data-structures/approval.md
index 997f4e7ab2..c5fa1fe13b 100644
--- a/docs/core-data-structures/approval.md
+++ b/docs/core-data-structures/approval.md
@@ -39,21 +39,21 @@ interface ApprovalRequest {
    * UI answerer only answers for agents it owns) and receives the audit
    * events on its session log.
    */
-  agent: Agent
+  readonly agent: Agent
   /** The tool the question is about (presentation and audit). */
-  toolName: string
+  readonly toolName: string
   /**
    * The exact tool call being decided, when the asker has one — lets a UI
    * attach the prompt to the tool call it already streamed.
    */
-  callId?: CallId
+  readonly callId?: CallId
   /** The asker's human-readable explanation of WHY it is asking. */
-  reason?: string
+  readonly reason?: string
   /**
    * Aborting withdraws the question: the request settles `'cancelled'`
    * immediately and a late answer from a still-pending answerer is discarded.
    */
-  signal?: AbortSignal
+  readonly signal?: AbortSignal
 }
 ```
 
diff --git a/docs/core-data-structures/core.md b/docs/core-data-structures/core.md
index b601c2ae29..ecf075b20f 100644
--- a/docs/core-data-structures/core.md
+++ b/docs/core-data-structures/core.md
@@ -16,8 +16,10 @@ Everything else is documented on a **sub-page**, not here. The rule that draws t
 | Sub-page | Owns |
 |---|---|
 | [llm-streaming.md](llm-streaming.md) | the `StreamChunk` wire protocol + adapter contract, `BlockAssembler`, the `LlmAdapter` seam |
+| [scope.md](scope.md) | scoped registration identity, dispatch carriers, and the owned `Scope` context |
 | [session.md](session.md) | the full `SessionEventMap` variant catalog, `TurnTrigger`/`TurnEndReason`, `deriveMessages()`, the turn-enclosure invariant |
 | [persistence.md](persistence.md) | the durability seam: `SessionPersistence`, JSONL + SQLite backends, `session/flush`, crash recovery, `SessionHeader` |
+| [system-prompt.md](system-prompt.md) | per-assembly context, tool-provider results, and canonical contribution protection |
 | [tools.md](tools.md) | `ToolDefinition` full fields, the schema DSL, `ToolExecution`/`ToolResult`, tool-presentation UI types, and the guarded execution pipeline |
 | [user-interaction.md](user-interaction.md) | the UI-backed human question/answer seam: `AskUserQuestionRequest`, answer/options vocabulary, provider API, error taxonomy |
 | [approval.md](approval.md) | the one-shot user-approval seam: `ApprovalRequest`, `ApprovalOutcome`, per-session policy, audit and answerer contracts |
@@ -265,12 +267,21 @@ interface Agent {
    */
   readonly ctx: Context
 
-  /** Queue a user message. Starts a turn when idle; otherwise waits for the next turn. */
+  /**
+   * Queue a user message. Starts a turn when idle; otherwise waits for the next
+   * turn. Content and the resolved source are accepted as one detached,
+   * deeply-frozen lossless-JSON record before notification or enqueue, so
+   * caller or `agent/queued` listener in-place mutation cannot change later
+   * log/model input. Throws synchronously when either value is not losslessly
+   * JSON-serializable; `agent/prompt-submit` may still return an explicit
+   * replacement.
+   */
   send(content: ContentBlock[], options?: SendOptions): void
 
   /**
    * Steer a running turn: content is injected between steps of the current
-   * turn. When idle, behaves like {@link send}.
+   * turn. Uses the same owned-value and synchronous-validation boundary as
+   * {@link send}; when idle, behaves exactly like that method.
    */
   steer(content: ContentBlock[], options?: SendOptions): void
 
diff --git a/docs/core-data-structures/persistence.md b/docs/core-data-structures/persistence.md
index 4dbb8fb2af..7bf102924b 100644
--- a/docs/core-data-structures/persistence.md
+++ b/docs/core-data-structures/persistence.md
@@ -25,15 +25,15 @@ interface SessionHeader {
    * session is created. A persistence backend rejects any other version on load
    * (no migration — see the constant).
    */
-  version: number
+  readonly version: number
   /** The session's id (mirrors the {@link Session}'s id). */
-  id: SessionId
+  readonly id: SessionId
   /** Unix epoch milliseconds when the session was created. */
-  createdAt: number
+  readonly createdAt: number
   /** Absolute working directory the session was created in (if any). */
-  cwd?: string
+  readonly cwd?: string
   /** The session this one was forked from (seed lineage), if any. */
-  parentSession?: SessionId
+  readonly parentSession?: SessionId
   /**
    * How many leading events were INHERITED via a seed rather than produced by
    * this session — the seed boundary. Set when a fork seeds a child with a
@@ -43,7 +43,7 @@ interface SessionHeader {
    * harness can skip the inherited prefix when deriving the child's OWN script
    * (the seeded events are the parent's, not this child's model calls).
    */
-  seedLength?: number
+  readonly seedLength?: number
 }
 ```
 
@@ -54,7 +54,7 @@ Creating a `Session` through the store takes a `seed` (replay/fork an existing e
 ```ts type-equiv
 interface CreateSessionOptions {
   /** Events to seed the new session with (replay/fork). */
-  seed?: SessionEvent[]
+  readonly seed?: readonly SessionEvent[]
   /**
    * Creation metadata. The store fills in `version`/`id` and defaults
    * `createdAt` to now; the caller supplies the storage-level fields (validated
@@ -67,7 +67,12 @@ interface CreateSessionOptions {
    * length, not the original boundary — the caller must pass the persisted
    * boundary back. A fresh fork passes its actual seeded-prefix length.
    */
-  meta?: { cwd?: string; parentSession?: SessionId; createdAt?: number; seedLength?: number }
+  readonly meta?: {
+    readonly cwd?: string
+    readonly parentSession?: SessionId
+    readonly createdAt?: number
+    readonly seedLength?: number
+  }
 }
 ```
 
diff --git a/docs/core-data-structures/scope.md b/docs/core-data-structures/scope.md
new file mode 100644
index 0000000000..66d5f40de9
--- /dev/null
+++ b/docs/core-data-structures/scope.md
@@ -0,0 +1,31 @@
+# Scoped Registration
+
+The [scope package](../../packages/core/scope) supplies the identity and carrier vocabulary that makes one registration context mean both per-agent visibility and shared lifetime ownership. It is a library primitive rather than a Cordis service; the [agent-scope runtime-design RFC](../rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md#scope-routing-one-opaque-key-selects-one-layer) owns the implementation rationale, while the package [README](../../packages/core/scope/README.md) owns the callable API and filtering semantics.
+
+Source: [`packages/core/scope/src/index.ts`](../../packages/core/scope/src/index.ts).
+
+## Identity and dispatch carrier
+
+`ScopeKey` is an opaque object identity. The shipped loop uses the live `Agent` object as its own key, but the primitive never inspects the object.
+
+```ts type-equiv
+type ScopeKey = object
+```
+
+`Scoped<T>` is the compile-time brand on the opaque routing receiver returned by `scopeTarget(base, key)`. Scope-filtered event declarations require this carrier as their `this` type, while the real event subject remains an explicit argument.
+
+```ts type-equiv
+type Scoped<T extends object> = object & { readonly [ScopedBrand]: T }
+```
+
+## Owned registration context
+
+`Scope` pairs the tagged registration context with two teardown surfaces. `rawDispose` preserves the exact Cordis disposer identity needed by an ordered composite effect; `dispose()` is the public shared quiescence boundary for direct and racing callers.
+
+```ts type-equiv
+interface Scope {
+  ctx: Context
+  rawDispose: () => Promise<void> | void
+  dispose(): Promise<void>
+}
+```
diff --git a/docs/core-data-structures/skills.md b/docs/core-data-structures/skills.md
index b356aba720..56ac91a6da 100644
--- a/docs/core-data-structures/skills.md
+++ b/docs/core-data-structures/skills.md
@@ -6,13 +6,13 @@ Source: [`packages/skill/skill/src/index.ts`](../../packages/skill/skill/src/ind
 
 ## Provider registry
 
-`ctx.skills` is a multi-provider registry. Providers can represent local directories, embedded plugin data, HTTP catalogs, or another source. Provider plugins register synchronously during `apply()`; remote initialization, authentication, and discovery are awaited by `list()`. The registry validates candidates, resolves duplicate skill names first-wins by rank/provider order/local order, and sorts the final summaries by `name` for deterministic consumers. A provider `list()` rejection is logged and skipped without caching the degraded catalog; malformed candidates still fail fast because they violate the provider contract.
+`ctx.skills` is a multi-provider registry. Providers can represent local directories, embedded plugin data, HTTP catalogs, or another source. Provider plugins register synchronously during `apply()`; remote initialization, authentication, and discovery are awaited by `list()`. Provider objects, lookup options, and candidates are readonly same-process contracts, so the registry borrows them instead of manufacturing defensive snapshots. The registry still validates semantic fields, resolves duplicate skill names first-wins by rank/provider order/local order, and sorts the final summaries by `name` for deterministic consumers. A provider `list()` rejection is logged and skipped without caching the degraded catalog; malformed candidates still fail fast because they violate the provider contract.
 
 ```ts type-equiv
 interface SkillProvider {
-  name: string
-  list(options: SkillLookupOptions): Promise<SkillCandidate[]>
-  get(candidate: SkillCandidate, options: SkillLookupOptions): Promise<SkillDefinition | undefined>
+  readonly name: string
+  readonly list: (options: SkillLookupOptions) => Promise<readonly SkillCandidate[]>
+  readonly get: (candidate: SkillCandidate, options: SkillLookupOptions) => Promise<SkillDefinition | undefined>
 }
 ```
 
@@ -28,7 +28,7 @@ The shipped local provider scans roots in rank order:
 | 400 | `user-dsh` | `<dshHome>/skills` |
 | 500 | `user-agents` | `<agentsHome>/skills` |
 
-The project root is the nearest ancestor containing `.git`; without one, the current cwd is used. When `ctx.fs` is available, the git-root walk probes `.git` through the filesystem service so remote or sandboxed workspaces do not fall back to the host filesystem boundary. The user DSH root skips its `.system` child, and DeepSeek Harness no longer ships built-in system skills from the local provider. Additional built-ins can be supplied later by another provider.
+The project root is the nearest ancestor containing `.git`; without one, the current cwd is used. When `ctx.fs` is available, the git-root walk probes `.git` through the filesystem service so remote or sandboxed workspaces do not fall back to the host filesystem boundary. The user DSH root skips its `.system` child. The local provider does not ship built-in system skills; deployments supply built-ins through another provider.
 
 ## Skill identity
 
@@ -44,13 +44,13 @@ type SkillSource = 'project-dsh' | 'project-agents' | 'runtime' | 'user-dsh' | '
 
 ```ts type-equiv
 interface SkillSummary {
-  name: string
-  description: string
-  whenToUse?: string
-  disableModelInvocation?: boolean
-  source: SkillSource
-  provider: string
-  resourceBase?: SkillResourceBase
+  readonly name: string
+  readonly description: string
+  readonly whenToUse?: string
+  readonly disableModelInvocation?: boolean
+  readonly source: SkillSource
+  readonly provider: string
+  readonly resourceBase?: SkillResourceBase
 }
 ```
 
@@ -58,10 +58,10 @@ interface SkillSummary {
 
 ```ts type-equiv
 interface SkillCandidate extends SkillSummary {
-  rank: number
-  locator: unknown
-  path?: string
-  metadata?: Record<string, unknown>
+  readonly rank: number
+  readonly locator: unknown
+  readonly path?: string
+  readonly metadata?: Readonly<Record<string, unknown>>
 }
 ```
 
@@ -69,16 +69,16 @@ interface SkillCandidate extends SkillSummary {
 
 ```ts type-equiv
 type SkillResourceBase =
-  | { kind: 'directory'; path: string }
-  | { kind: 'url'; url: string }
-  | { kind: 'opaque'; description: string }
+  | { readonly kind: 'directory'; readonly path: string }
+  | { readonly kind: 'url'; readonly url: string }
+  | { readonly kind: 'opaque'; readonly description: string }
 ```
 
 ```ts type-equiv
 interface SkillDefinition extends SkillSummary {
-  content: string
-  path?: string
-  metadata?: Record<string, unknown>
+  readonly content: string
+  readonly path?: string
+  readonly metadata?: Readonly<Record<string, unknown>>
 }
 ```
 
@@ -86,18 +86,18 @@ Runtime skills use the same complete shape and participate in the same first-win
 
 ```ts type-equiv
 type SkillRegistration = Omit<SkillDefinition, 'provider'> & {
-  provider?: string
+  readonly provider?: string
 }
 ```
 
 ## Lookup and configuration
 
-Skill lookup is cwd-sensitive because providers may expose workspace-local skills, and its optional signal cancels provider work for the caller. If no git root is found, the local provider treats the supplied cwd itself as the project root.
+Skill lookup is cwd-sensitive because providers may expose workspace-local skills, and its optional signal cancels provider work for the caller. Providers receive the same readonly options object used for cache identity and loading. Cancellation is checked before and after catalog selection, including cache hits, and races both discovery and full-definition loading. If no git root is found, the local provider treats the supplied cwd itself as the project root.
 
 ```ts type-equiv
 interface SkillLookupOptions {
-  cwd?: string | undefined
-  signal?: AbortSignal | undefined
+  readonly cwd?: string | undefined
+  readonly signal?: AbortSignal | undefined
 }
 ```
 
@@ -105,7 +105,7 @@ The registry owns only its discovery-cache bound. The local provider owns filesy
 
 ```ts type-equiv
 interface Config {
-  collectCacheMaxEntries?: number
+  readonly collectCacheMaxEntries?: number
 }
 ```
 
diff --git a/docs/core-data-structures/subagent.md b/docs/core-data-structures/subagent.md
index 3de6b5861e..5454f326b3 100644
--- a/docs/core-data-structures/subagent.md
+++ b/docs/core-data-structures/subagent.md
@@ -12,10 +12,10 @@ A provider advertises its **start-time** features on a static descriptor the ser
 
 ```ts type-equiv
 interface SubagentCapabilities {
-  outputSchema: boolean
-  depthLimit: boolean
-  toolFilter: boolean
-  persona: boolean
+  readonly outputSchema: boolean
+  readonly depthLimit: boolean
+  readonly toolFilter: boolean
+  readonly persona: boolean
 }
 ```
 
@@ -25,26 +25,28 @@ What a caller asks for when starting a subagent. The tool layer builds this from
 
 ```ts type-equiv
 interface SubagentStartRequest {
-  prompt: ContentBlock[]
-  parent: Agent
-  signal?: AbortSignal
-  agentOptions?: AgentOptions
-  outputSchema?: StructuredOutputSchema
-  maxDepth?: number
-  toolFilter?: { allow?: string[]; deny?: string[] }
-  persona?: string
+  readonly prompt: ContentBlock[]
+  readonly parent: Agent
+  readonly signal: AbortSignal
+  readonly agentOptions?: AgentOptions
+  readonly outputSchema?: StructuredOutputSchema
+  readonly maxDepth?: number
+  readonly toolFilter?: ToolRestriction
+  readonly persona?: string
 }
 ```
 
+`signal` is the single cancellation channel before and after readiness. The [subagent composition-controls RFC](../rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) owns the persona, live global-tool filter, absolute-depth, and visibility-not-authority rationale.
+
 ## The terminal result: `SubagentResult`
 
 The outcome of a run, resolved by `SubagentRun.result`. `structured` is present only after a requested `outputSchema` was successfully satisfied; requesting a schema does not guarantee it, and a provider may return `stopReason: 'error'` when the child fails or finishes without a valid capture. A non-`completed` `stopReason` means `output` may be partial — the consumer maps it to an `isError` tool result rather than reporting partial output as success.
 
 ```ts type-equiv
 interface SubagentResult {
-  output: ContentBlock[]
-  structured?: unknown
-  stopReason: SubagentStopReason
+  readonly output: ContentBlock[]
+  readonly structured?: unknown
+  readonly stopReason: SubagentStopReason
 }
 ```
 
@@ -62,38 +64,36 @@ interface SubagentStopReasonMap {
 
 ## A live run: `SubagentRun`
 
-The handle the consumer holds while a child executes. `started` is the provider's publication boundary: it resolves only after an in-process agent is live in `ctx.agents` or a remote transport has created its child session, and rejects when the attempt fails or is cancelled before that point. The consumer normally awaits `result`, may `cancel` mid-flight, and MUST `dispose` on every path to reach child quiescence (no leaked idle child / session). `result` does NOT reject on a child-level failure — a model/transport failure resolves with `stopReason: 'error'` — so the consumer maps a non-`completed` reason to an `isError` result; it rejects only on an infrastructure fault the seam cannot represent. `sendMessage` and `resume` are OPTIONAL: a provider that supports the runtime capability defines the method; one that doesn't omits it.
+The handle the consumer holds after a provider has established a ready child. The consumer awaits `result` and MUST `dispose` on every path to cancel remaining work and reach child quiescence. `result` does NOT reject on a child-level failure — a model/transport failure resolves with `stopReason: 'error'` — so the consumer maps a non-`completed` reason to an `isError` result; it rejects only on an infrastructure fault the seam cannot represent. `sendMessage` and `resume` are OPTIONAL: a provider that supports the runtime capability defines the method; one that doesn't omits it.
 
 ```ts type-equiv
 interface SubagentRun {
   readonly id: AgentId
-  readonly started: Promise<void>
   readonly result: Promise<SubagentResult>
-  cancel(reason?: string): void
   dispose(): Promise<void>
   sendMessage?(content: ContentBlock[]): void
-  resume?(content: ContentBlock[]): SubagentRun
+  resume?(content: ContentBlock[]): Promise<SubagentRun>
 }
 ```
 
 ## The provider seam: `SubagentProvider`
 
-One transport for running a child agent. Implementations register under a unique name via `SubagentService.registerProvider`; multiple coexist in one context. The service validates every requested start-time capability before calling `start`, so an implementation may assume e.g. `request.maxDepth` is honorable when present. `inheritsParentContext` is a DESCRIPTIVE fact beside the capabilities (nothing validates against it): whether a child sees the parent conversation (`fork`: true, `spawn`/`acp`: false) — the model-facing consumer derives truthful tool wording from it.
+One transport for running a child agent. Implementations register under a unique name via `SubagentService.registerProvider`; multiple coexist in one context. The service validates every requested start-time capability before calling `start`, so an implementation may assume e.g. `request.maxDepth` is honorable when present. `inheritsParentContext` is a DESCRIPTIVE fact beside the capabilities (nothing validates against it): whether a child sees the parent conversation (`fork`: true, `spawn`/`acp`: false) — the model-facing consumer derives truthful tool wording from it. It describes conversation history only, not tool registrations, injected services, or authority inheritance.
 
 ```ts type-equiv
 interface SubagentProvider {
   readonly name: string
   readonly capabilities: SubagentCapabilities
   readonly inheritsParentContext: boolean
-  start(request: SubagentStartRequest): SubagentRun
+  start(request: SubagentStartRequest): Promise<SubagentRun>
 }
 ```
 
-The service (`ctx.subagents`) emits `subagent/start` only after `run.started` fulfills and emits the paired `subagent/end` when that started run settles (see the [events catalog](../cordis-catalog/events.md)); a pre-publication readiness rejection emits neither event. For an in-process provider, a start listener can therefore resolve the live child with `ctx.agents.get(info.id)`; a remote provider need not publish into the local registry. `subagent/end` carries `lastAssistantMessage` (the child's final `output`) on the settle path, so an observer sees WHAT the subagent produced without holding the run (absent when the run rejected at the infrastructure level — no result was produced). These are **observe-only** events: both are plain `emit`s, so a subscriber observes but cannot change the run. Result settlement is observed immediately even while readiness is pending, then its cloned end payload is buffered until start has been announced; this prevents an early rejection from becoming unhandled while preserving start-before-end order and protecting the caller's result from listener mutation. Both emits contain a thrown listener **per listener** (logged, never propagated): one bad subscriber can neither strand a live run, surface as an unhandled rejection on the detached settle hook, nor starve the listeners registered after it.
+`SubagentProvider.start()` and `ctx.subagents.start()` are the publication boundary: their promises fulfill only with a ready run. The service attaches result observation, emits `subagent/start`, and returns the same holder-owned run; a rejected start has already cleaned provider-owned partial resources and emits neither lifecycle event. For an in-process provider, a start listener can resolve the live child with `ctx.agents.get(info.id)`; a remote provider need not publish into the local registry. `subagent/end` carries `lastAssistantMessage` (the child's final `output`) on the settle path and reports `error` on infrastructure rejection. Both lifecycle events are observe-only emits with per-listener exception containment.
 
 ## In-process backends: depth and seed
 
-The two in-process backends ([dsh-subagent-spawn](../../packages/subagent/subagent-spawn) fresh, [dsh-subagent-fork](../../packages/subagent/subagent-fork) seeded) run the child as a child `Agent` on the same application. They synchronously snapshot caller-owned data, install provider ownership before attaching the abort listener, create one run-owner fiber under `parent.ctx`, and invoke the factory through that fiber: parent teardown, provider teardown, and manual run disposal share the same pre-publication ownership and quiescence boundary, while the child still receives a flat new scope rather than inheriting the parent's capabilities. Their `started` promise projects the factory's successful publication and the result driver awaits that same promise before sending the prompt. Two pieces of vocabulary ride on the existing agent/session types rather than new core types:
+The two in-process backends ([dsh-subagent-spawn](../../packages/subagent/subagent-spawn) fresh, [dsh-subagent-fork](../../packages/subagent/subagent-fork) seeded) run the child as an ordinary `Agent` in the same application. The provider creates it directly through `parent.ctx`, passes the required signal into the core creation transaction, and delegates quiescent disposal to the returned `AgentHandle`. Provider removal prevents new starts but does not revoke an accepted run. The child receives a flat new scope rather than inheriting the parent's registrations. Two pieces of vocabulary ride on the existing agent/session types rather than new core types:
 
-- **Delegation depth** is a merge-extensible `AgentOptions.subagentDepth` field (`0` for a top-level agent, parent + 1 for a child). The seam owns it — the loop neither sets nor reads it — so a nested spawn reads its parent's depth from `parent.options.subagentDepth` and the `depthLimit` capability caps the tree by refusing a child whose depth would exceed `request.maxDepth`.
+- **Delegation depth** is a merge-extensible `AgentOptions.subagentDepth` field (`0` for a top-level agent, parent + 1 for a child). Only `undefined` means top level; every stored present value must be a non-negative safe integer. The seam owns it — the loop neither sets nor reads it — so a nested spawn validates its parent's stored depth, rejects a derived child depth outside the safe-integer domain, and applies a defined absolute `request.maxDepth` cap to that child.
 - **Fork seeding** uses `CreateAgentOptions.seed` (a `SessionEvent[]` prefix threaded through `AgentLoop.createAgent` → `ctx.sessions.prepare({ seed })`, the same primitive `resume` uses). The fork backend passes a *balanced completed-turn prefix* of the parent's log — the parent's events up to and including its last `turn/end` — so the seed is contiguous-from-0 and the [invariants](../../packages/support/invariants) replay accepts it (the in-flight, unbalanced turn is excluded).
diff --git a/docs/core-data-structures/system-prompt.md b/docs/core-data-structures/system-prompt.md
new file mode 100644
index 0000000000..bfd34b3626
--- /dev/null
+++ b/docs/core-data-structures/system-prompt.md
@@ -0,0 +1,40 @@
+# System Prompt Assembly
+
+The [system-prompt package](../../packages/core/system-prompt) owns the data exchanged between prompt contributors and one assembly call. The package [README](../../packages/core/system-prompt/README.md) documents registration, ordering, scoping, and rendering behavior; this page pins the literal cross-package shapes that plugins implement or pass.
+
+Source: [`packages/core/system-prompt/src/index.ts`](../../packages/core/system-prompt/src/index.ts).
+
+## Assembly context
+
+`AssembleContext` identifies the scope layer one assembly resolves. It is merge-extensible: `dsh-agent` adds the optional live `agent` field, and `assembleContextFor(agent)` sets that field and `scope` together.
+
+```ts type-equiv
+interface AssembleContext {
+  scope?: ScopeKey
+}
+```
+
+## Tool-provider result
+
+`ToolProviderResult.schemas` is the model-visible set for the current assembly. `knownNames` is the provider's pre-restriction name universe used to distinguish a configured-name typo from a known tool that is deliberately hidden in this scope. `ownerFinalNames` identifies tool contributions whose canonical presence or absence survives the assembly waterfall.
+
+```ts type-equiv
+interface ToolProviderResult {
+  readonly schemas: readonly ToolSchema[]
+  readonly knownNames?: readonly string[]
+  readonly ownerFinalNames?: readonly string[]
+}
+```
+
+## Prompt sections and owner finality
+
+`PromptSection` is a readonly same-process registration contract. `ownerFinal` is reserved for protocol-owned instructions whose canonical presence and definition must survive the complete assembly waterfall; ordinary sections remain transformable. Tool definitions declare the equivalent fact on their own contribution, and the tool provider reports the resolved names through `ownerFinalNames` above.
+
+```ts type-equiv
+interface PromptSection {
+  readonly name: string
+  readonly order: number
+  readonly text: string | ((context: AssembleContext) => string)
+  readonly ownerFinal?: boolean
+}
+```
diff --git a/docs/core-data-structures/tools.md b/docs/core-data-structures/tools.md
index ad741a7522..4785de84a3 100644
--- a/docs/core-data-structures/tools.md
+++ b/docs/core-data-structures/tools.md
@@ -19,6 +19,12 @@ interface ToolDefinition extends ToolSchema {
    * cooperative implementation that can reach quiescence when the signal aborts.
    */
   timeoutMs?: number
+  /**
+   * Whether this tool name's canonical wire presence or absence survives the
+   * complete system-prompt assembly waterfall. Reserved for protocol tools
+   * whose owner must retain the final definition.
+   */
+  readonly ownerFinal?: boolean
   /**
    * Optional: how to present the PENDING state of one call in a UI, derived from
    * the call's `args` (parsed arguments, `unknown` — the tool validates/narrows
@@ -81,16 +87,25 @@ type InferArgs<S extends SchemaSpec> = Simplify<
 
 `defineTool({ name, description, parameters, execute, … })` ties it together: `parameters` is a `SchemaSpec`, `execute(args, exec)` gets `args: InferArgs<typeof parameters>`, and the helper converts the spec to JSON Schema (`schemaSpecToJsonSchema`) for the wire and validates model-generated args (`validateArgs`) before the typed body runs. A mismatch throws `ToolArgsError` (`code: 'INVALID_ARGS'`), which the registry turns into an `isError` result so the model can self-correct. Why a custom DSL and not schemastery: tool parameters need JSON Schema (the LLM wire format), not validation/transformation — the lightweight DSL gives the best authoring DX with the smallest surface.
 
-Registration is a value boundary. `ToolRegistry.register()` validates `ToolDefinition.parameters` as lossless JSON before and after cloning, copies the scalar fields, binds the execute/presentation callbacks once to the original definition as their method receiver, and deep-freezes the stored record. Replacing a callback property on the caller-owned definition later does not change dispatch. `get()`/`visible()` expose only that frozen snapshot, while `schemas()` produces detached projections, so the model-visible and executable views cannot drift through a leaked mutable registry object.
+Registration is a trusted same-process contract. The registry borrows the typed definition as readonly input and validates only semantic requirements such as a positive finite `timeoutMs`; `schemas()` materializes the explicit model-facing projection at the model boundary so execution and presentation share one resolved definition without leaking callbacks onto the wire.
+
+## `ToolRestriction` — one scope's live global filter
+
+`ToolRestriction` applies only to the live deployment-global tool layer. The registry compiles readonly names into private sets, intersects multiple restrictions, then overlays scope-local tools. A deny-only filter admits later unlisted globals, while an allow-list excludes them.
+
+```ts type-equiv
+interface ToolRestriction {
+  readonly allow?: readonly string[]
+  readonly deny?: readonly string[]
+}
+```
 
 ## Execution: extensible waterfalls plus monotonic policy
 
-`ctx.tools.execute()` accepts a caller-owned `ToolExecutionInput`, snapshots it into a pipeline-owned `ToolExecution`, and runs that call through `tools/pre-execute` (the reorderable allow/deny/ask waterfall) → registered monotonic guards → `tools/execute` (around-dispatch wrappers) → `tools/post-execute` (inspect/replace the result) → `tools/result` (the immutable authoritative outcome). The outcome is a `ToolExecutionResult`.
+`ctx.tools.execute()` accepts a caller-owned `ToolExecutionInput`, materializes its parsed JSON arguments once into a pipeline-owned `ToolExecution`, and runs that call through `tools/pre-execute` (the reorderable allow/deny/ask waterfall) → registered monotonic guards → `tools/execute` (around-dispatch wrappers) → `tools/post-execute` (inspect/replace the result) → `tools/result` (the immutable authoritative outcome). The outcome is a `ToolExecutionResult`.
 
 ```ts type-equiv
-interface ToolExecutionToken {
-  readonly [toolExecutionTokenBrand]: true
-}
+type ToolExecutionToken = symbol & { readonly [toolExecutionTokenBrand]: true }
 ```
 
 ```ts type-equiv
@@ -118,7 +133,7 @@ interface ToolExecution extends ToolExecutionInput {
 }
 ```
 
-`ToolExecutionToken` is a compile-time opaque type and a frozen, property-free object at runtime; identity comparison is its only operation. Before policy runs, `ctx.tools.execute()` requires the caller's `arguments` to be losslessly JSON-serializable, checks again after cloning to contain unstable accessors, assigns a fresh token, and deep-freezes the detached arguments. A cloneable mutable exotic such as `Map` is rejected and normalized to an error before policy. `token`, `callId`, `name`, `arguments`, `agent`, and the optional `parent` token are non-writable throughout all waterfalls, so a listener cannot change which capability or scope was authorized or reach a live enclosing execution; an around-dispatch wrapper may add, replace, or remove only optional `signal`. After the complete pipeline the registry freezes the execution and exposes its stable identity to `tools/result` observers, where the execution remains usable as a `WeakMap` key without mutation races.
+`ToolExecutionToken` is a compile-time opaque fresh `Symbol` at runtime; identity comparison is its only operation. Before policy runs, `ctx.tools.execute()` materializes `arguments` as detached lossless JSON, assigns the token, and deep-freezes the accepted arguments. A non-JSON value is normalized to an error before policy. `token`, `callId`, `name`, `arguments`, `agent`, and the optional `parent` token are readonly throughout the waterfalls, while an around-dispatch wrapper may add, replace, or remove only optional `signal`. After the complete pipeline the registry freezes the execution and exposes its stable identity to `tools/result` observers.
 
 A `ToolGuard` is scope-aware final pre-dispatch policy. Its shape deliberately has no allow result: `undefined` preserves the waterfall decision, while a returned reason can only reduce permission, so a later listener cannot undo it.
 
@@ -158,7 +173,7 @@ interface ToolExecutionResult {
 }
 ```
 
-The registry rebuilds and validates the complete authoritative result after post-policy. Its content, structured error, additional context, and presentation metadata must round-trip losslessly through JSON; a malformed or non-JSON value becomes a JSON-safe `isError` result before `tools/result` observers run, so the live outcome is always safe for the later durable `tool/result` append.
+The registry materializes and freezes the final accepted result immediately before `tools/result`. Its content, structured error, additional context, and presentation metadata must round-trip losslessly through JSON; an invalid outcome becomes a JSON-safe `isError` result, so the observed live outcome is safe for the later durable `tool/result` append.
 
 Each interception waterfall returns a typed **Decision** (the idiom shared with the `agent/*` seams). `tools/pre-execute` listeners receive `(exec, next)` and return a `PreToolDecision`; `tools/execute` wrappers return a `ToolExecutionResult`; `tools/post-execute` listeners receive `(exec, result, next)` and return a `PostToolDecision`:
 
diff --git a/docs/development.i18n.yaml b/docs/development.i18n.yaml
index c1e557170d..e2dd772eb0 100644
--- a/docs/development.i18n.yaml
+++ b/docs/development.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write
-development.md: bd6f6b561480419abea7a42a44b4078e2c59b1cb
-development.zh.md: 54bf19765d2b4dc419e6b71684dbcfcd28230541
+development.md: ea5f2e5d08acbaf1dfce4661530218dbf1a051b9
+development.zh.md: 50877796f2ff47ad46cc67b35f3cd7b5704c8315
diff --git a/docs/development.md b/docs/development.md
index bd6f6b5614..ea5f2e5d08 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -67,7 +67,7 @@ These hooks do not exactly mirror CI. Notably, `pre-push` runs unit tests withou
 
 ## CI gates
 
-The keyless GitHub workflow has eight jobs: five Node 24 lanes run static gates, lint, coverage, snapshot replay, and artifact gates separately, and three compatibility jobs run `pnpm run check:node-compat` on Node 22.19, 24, and 26. The lane schedulers fan out independent gates from `package.json`: constraints, typecheck, lint, coverage, snapshot replay, `doc-sync` members, module-graph freshness, `knip`, and the echo-agent smoke test.
+The keyless GitHub workflow has eight jobs: five Node 24 lanes run static gates, lint, coverage, snapshot replay, and artifact gates separately, and three compatibility jobs run `pnpm run check:node-compat` on Node 22.19, 24, and 26. The compatibility command runs the TypeScript typecheck and a keyless workflow-workerthread source-launch smoke on every runtime, so the matrix proves that the source graph typechecks and that a real unbuilt Worker loader path executes; the other lane schedulers fan out independent gates from `package.json`: constraints, lint, coverage, snapshot replay, `doc-sync` members, module-graph freshness, `knip`, and the echo-agent smoke test.
 
 `pnpm run build` feeds the artifact lane, and `publint`, `verify-node-next-types`, and built-bin smoke tests wait for build output. The separate real-API workflow runs `pnpm run test:e2e` with a secret and `DSH_E2E_MAX_WORKERS=14`.
 
diff --git a/docs/development.zh.md b/docs/development.zh.md
index 54bf19765d..50877796f2 100644
--- a/docs/development.zh.md
+++ b/docs/development.zh.md
@@ -67,7 +67,7 @@ vendor manifest 守卫检查 `vendor/*/src` 下的改动是否连同对应的 `v
 
 ## CI 门禁
 
-keyless GitHub 工作流有八个 job：五个 Node 24 lane 分别运行 static gates、lint、coverage、snapshot replay 和 artifact gates，三个兼容性 job 在 Node 22.19、24 和 26 上运行 `pnpm run check:node-compat`。各 lane 调度器并发运行来自 `package.json` 的独立门禁：constraints、typecheck、lint、coverage、snapshot replay、`doc-sync` 成员、module graph 新鲜度、`knip` 和 echo-agent 冒烟测试。
+keyless GitHub 工作流有八个 job：五个 Node 24 lane 分别运行 static gates、lint、coverage、snapshot replay 和 artifact gates，三个兼容性 job 在 Node 22.19、24 和 26 上运行 `pnpm run check:node-compat`。兼容性命令会在每个运行时上运行 TypeScript 类型检查和 keyless 的 workflow-workerthread 源码启动冒烟测试，因此该矩阵既证明源码图能通过类型检查，也会实际执行一条未构建的 Worker loader 路径；其他 lane 调度器并发运行来自 `package.json` 的独立门禁：constraints、lint、coverage、snapshot replay、`doc-sync` 成员、module graph 新鲜度、`knip` 和 echo-agent 冒烟测试。
 
 `pnpm run build` 供给 artifact lane，`publint`、`verify-node-next-types` 和 built-bin 冒烟测试等待 build 输出。单独的真实 API 工作流带密钥运行 `pnpm run test:e2e`，并设置 `DSH_E2E_MAX_WORKERS=14`。
 
diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md
index 1ed2405671..aac25e71b9 100644
--- a/docs/event-producer-consumer.md
+++ b/docs/event-producer-consumer.md
@@ -7,46 +7,47 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 
 | Event | Mode | Declared in | Dispatchers | Listeners |
 | --- | --- | --- | --- | --- |
-| `agent/created` | `emit` | [`packages/core/agent/src/types.ts:300`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`emit`) | [`stdio-agent`](../packages/ui/stdio-agent) |
-| `agent/disposed` | `emit` | [`packages/core/agent/src/types.ts:314`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`emit`) | [`stdio-agent`](../packages/ui/stdio-agent) |
-| `agent/error` | `emit` | [`packages/core/agent/src/types.ts:587`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - |
-| `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:419`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`user-approval`](../packages/ui/user-approval) |
-| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:437`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) |
-| `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:342`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - |
-| `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:466`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - |
-| `agent/session-prefix` | `waterfall` | [`packages/core/agent/src/types.ts:518`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`tool-skill`](../packages/skill/tool-skill) |
-| `agent/session-start` | `emit` | [`packages/core/agent/src/types.ts:362`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`invariants`](../packages/support/invariants) |
-| `agent/status` | `emit` | [`packages/core/agent/src/types.ts:328`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), [`stdio-agent`](../packages/ui/stdio-agent) |
-| `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:533`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - |
-| `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:551`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) |
-| `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:570`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`strictSerial (serial)`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) |
-| `approval/request` | `waterfall` | [`packages/ui/user-approval/src/index.ts:72`](../packages/ui/user-approval/src/index.ts) | [`user-approval`](../packages/ui/user-approval) (`waterfall`) | [`acp`](../packages/ui/acp) |
+| `agent/created` | `emit` | [`packages/core/agent/src/types.ts:316`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) |
+| `agent/disposed` | `emit` | [`packages/core/agent/src/types.ts:331`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) |
+| `agent/error` | `emit` | [`packages/core/agent/src/types.ts:606`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - |
+| `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:438`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`user-approval`](../packages/ui/user-approval) |
+| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:456`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) |
+| `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:360`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - |
+| `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:485`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - |
+| `agent/session-prefix` | `waterfall` | [`packages/core/agent/src/types.ts:537`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`tool-skill`](../packages/skill/tool-skill) |
+| `agent/session-start` | `emit` | [`packages/core/agent/src/types.ts:381`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`invariants`](../packages/support/invariants) |
+| `agent/status` | `emit` | [`packages/core/agent/src/types.ts:345`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`invariants`](../packages/support/invariants), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), [`stdio-agent`](../packages/ui/stdio-agent) |
+| `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:552`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - |
+| `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:570`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) |
+| `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:589`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) |
+| `approval/request` | `waterfall` | [`packages/ui/user-approval/src/index.ts:70`](../packages/ui/user-approval/src/index.ts) | [`user-approval`](../packages/ui/user-approval) (`waterfall`) | [`acp`](../packages/ui/acp) |
 | `fs/edit-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:123`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) |
 | `fs/observed` | `emit` | [`packages/fs/fs/src/index.ts:138`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`emit`) | [`fs-policy`](../packages/fs/fs-policy) |
 | `fs/write-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:109`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) |
 | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:39`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`invariants`](../packages/support/invariants), [`llm-replay`](../packages/support/llm-replay) |
-| `session/created` | `emit` | [`packages/core/session/src/index.ts:47`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence) |
-| `session/event` | `emit` | [`packages/core/session/src/index.ts:61`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) |
-| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:79`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`parallel`) | [`session-persistence`](../packages/session-persistence/session-persistence) |
-| `skill/provider-added` | `emit` | [`packages/skill/skill/src/index.ts:130`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - |
-| `skill/provider-removed` | `emit` | [`packages/skill/skill/src/index.ts:136`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - |
-| `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:114`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) |
-| `subagent/provider-added` | `emit` | [`packages/subagent/subagent/src/index.ts:75`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`emit`) | [`tool-subagent`](../packages/subagent/tool-subagent) |
-| `subagent/provider-removed` | `emit` | [`packages/subagent/subagent/src/index.ts:86`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`tool-subagent`](../packages/subagent/tool-subagent) |
-| `subagent/start` | `emit` | [`packages/subagent/subagent/src/index.ts:101`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) |
+| `session/created` | `emit` | [`packages/core/session/src/index.ts:52`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence) |
+| `session/disposed` | `emit` | [`packages/core/session/src/index.ts:64`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | - |
+| `session/event` | `emit` | [`packages/core/session/src/index.ts:83`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) |
+| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:101`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`session-persistence`](../packages/session-persistence/session-persistence) |
+| `skill/provider-added` | `emit` | [`packages/skill/skill/src/index.ts:131`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - |
+| `skill/provider-removed` | `emit` | [`packages/skill/skill/src/index.ts:137`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - |
+| `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:90`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) |
+| `subagent/provider-added` | `emit` | [`packages/subagent/subagent/src/index.ts:66`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`emit`) | [`tool-subagent`](../packages/subagent/tool-subagent) |
+| `subagent/provider-removed` | `emit` | [`packages/subagent/subagent/src/index.ts:72`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`tool-subagent`](../packages/subagent/tool-subagent) |
+| `subagent/start` | `emit` | [`packages/subagent/subagent/src/index.ts:82`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) |
 | `system-prompt/assemble` | `waterfall` | [`packages/core/system-prompt/src/index.ts:45`](../packages/core/system-prompt/src/index.ts) | [`system-prompt`](../packages/core/system-prompt) (`waterfall`) | - |
 | `system-prompt/change` | `emit` | [`packages/core/system-prompt/src/index.ts:55`](../packages/core/system-prompt/src/index.ts) | [`system-prompt`](../packages/core/system-prompt) (`emit`) | - |
-| `tools/change` | `emit` | [`packages/core/tools/src/index.ts:176`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`emit`) | - |
-| `tools/execute` | `waterfall` | [`packages/core/tools/src/index.ts:131`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`timeout-policy`](../packages/timeout/timeout-policy) |
-| `tools/post-execute` | `waterfall` | [`packages/core/tools/src/index.ts:151`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) |
-| `tools/pre-execute` | `waterfall` | [`packages/core/tools/src/index.ts:104`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) |
-| `tools/result` | `parallel` | [`packages/core/tools/src/index.ts:166`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`events.dispatch`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) |
-| `workflow/agent-end` | `emit` | [`packages/workflow/workflow/src/index.ts:98`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
-| `workflow/agent-start` | `emit` | [`packages/workflow/workflow/src/index.ts:87`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
-| `workflow/end` | `emit` | [`packages/workflow/workflow/src/index.ts:108`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
-| `workflow/log` | `emit` | [`packages/workflow/workflow/src/index.ts:77`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
-| `workflow/phase` | `emit` | [`packages/workflow/workflow/src/index.ts:70`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
-| `workflow/start` | `emit` | [`packages/workflow/workflow/src/index.ts:62`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
+| `tools/change` | `emit` | [`packages/core/tools/src/index.ts:173`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`emit`) | - |
+| `tools/execute` | `waterfall` | [`packages/core/tools/src/index.ts:128`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`timeout-policy`](../packages/timeout/timeout-policy) |
+| `tools/post-execute` | `waterfall` | [`packages/core/tools/src/index.ts:148`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) |
+| `tools/pre-execute` | `waterfall` | [`packages/core/tools/src/index.ts:101`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) |
+| `tools/result` | `parallel` | [`packages/core/tools/src/index.ts:163`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`events.dispatch`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) |
+| `workflow/agent-end` | `emit` | [`packages/workflow/workflow/src/index.ts:96`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
+| `workflow/agent-start` | `emit` | [`packages/workflow/workflow/src/index.ts:85`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
+| `workflow/end` | `emit` | [`packages/workflow/workflow/src/index.ts:106`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
+| `workflow/log` | `emit` | [`packages/workflow/workflow/src/index.ts:75`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
+| `workflow/phase` | `emit` | [`packages/workflow/workflow/src/index.ts:68`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
+| `workflow/start` | `emit` | [`packages/workflow/workflow/src/index.ts:60`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | - |
 
 ## Non-harness or undeclared event strings seen in package source
 
diff --git a/CONTEXT.md b/docs/glossary.md
similarity index 52%
rename from CONTEXT.md
rename to docs/glossary.md
index 7fd11ae59e..81b9b4f84a 100644
--- a/CONTEXT.md
+++ b/docs/glossary.md
@@ -1,15 +1,17 @@
-# Context glossary
+# Glossary
 
-Domain vocabulary for the DeepSeek Harness SDK — one canonical term per concept. Terms link with `[[name]]`; implementation detail stays in the package READMEs and RFCs.
+Domain vocabulary for the DeepSeek Harness SDK uses one canonical term per concept. Terms link to their entries with standard Markdown anchors; implementation detail stays in package READMEs and RFCs.
+
+FIXME(glossary-completeness): Expand this glossary before the first release so it covers the SDK's other core and capability subsystems, not only agent scope.
 
 ## agent-scope
 
-- **scope** — the unit of per-agent registration: a contribution (tool, prompt section, variable, restriction, listener) is either *global* (visible to every agent) or *scoped* (owned by exactly one [[scope-key]]). Two levels, flat: nothing inherits down to subagents; subtree behavior is expressed with [[lineage]] data, never structure.
+- **scope** — the unit of per-agent registration: a contribution (tool, prompt section, variable, restriction, listener) is either *global* (visible to every agent) or *scoped* (owned by exactly one [scope key](#scope-key)). Two levels, flat: scoped registrations do not inherit down to subagents; subtree behavior is expressed with [lineage](#lineage) data, never scope structure.
 - **scope key** — the opaque identity a scope is keyed by, compared by object identity. The harness convention: a live agent is the key of its own scope. <a id="scope-key"></a>
-- **agent context (`agent.ctx`)** — the agent's scoped context; registrations through it are scope-visible AND scope-lifetime (one fact drives both), and listeners on it hear only that agent's dispatches.
+- **agent context (`agent.ctx`)** — the agent's scoped context; registrations through it are scope-visible AND scope-lifetime (one fact drives both), and listeners on it participate in that agent's scope-filtered dispatches. Registry-subject events may remain deliberately unfiltered under their own event contracts.
 - **scope carrier** — the `thisArg` a scope-filtered dispatch carries (built by `scopeTarget`); its filter admits untagged listeners plus the subject's own. A *subject-less* carrier (no key) admits untagged listeners only.
 - **scoped dispatch** — the rule: an event about one agent's activity dispatches with that agent's carrier. Events about a registry itself (a tool was added) are *registry-subject* and stay unfiltered.
 - **shadowing** — most-specific-wins name resolution: a scoped tool/section/variable replaces its same-named global twin for that scope alone. The per-agent persona and per-agent tool-variant mechanism.
-- **restriction / grant** — a restriction (`tools.restrict`) masks the GLOBAL tool surface for one scope (compose by intersection); a scoped registration is an explicit grant that bypasses restrictions. A restricted-away tool is absent from the prompt AND refuses execution, indistinguishably from a nonexistent one.
-- **setup window** — the creation slot where a creator composes an agent's scoped world (`CreateAgentOptions.setup`): after the scope exists and the agent is registered, before `agent/session-start` and the first prompt assembly. Setup registers; it never drives the agent.
+- **restriction / scope-local registration** — a restriction (`tools.restrict`) filters the GLOBAL tool surface for one scope (compose by intersection); scope-local registrations are merged after that filter. A filtered-away global tool is absent from the prompt AND refuses execution, indistinguishably from a nonexistent one.
+- **setup window** — the creation slot where a creator composes an agent's scoped world (`CreateAgentOptions.setup`): after the scope and agent object exist but before the agent or session is published, `agent/session-start` fires, or the first prompt is assembled. Setup registers; it never drives the agent.
 - **lineage** — parent/child facts carried as data (`parentSession`, `subagentDepth`); never affects visibility. <a id="lineage"></a>
diff --git a/docs/module-graph.md b/docs/module-graph.md
index 372c401954..2acee6ffc5 100644
--- a/docs/module-graph.md
+++ b/docs/module-graph.md
@@ -162,6 +162,10 @@ flowchart TD
   pkg_session_persistence_jsonl --> pkg_session_persistence
   pkg_session_persistence_sqlite --> pkg_session
   pkg_session_persistence_sqlite --> pkg_session_persistence
+  pkg_invariants --> pkg_agent
+  pkg_invariants --> pkg_llm
+  pkg_invariants --> pkg_scope
+  pkg_invariants --> pkg_session
   pkg_user_approval --> pkg_agent
   pkg_user_approval --> pkg_brand
   pkg_user_approval --> pkg_llm
@@ -227,12 +231,6 @@ flowchart TD
   pkg_hooks_codex --> pkg_llm
   pkg_hooks_codex --> pkg_session
   pkg_hooks_codex --> pkg_tools
-  pkg_invariants --> pkg_agent
-  pkg_invariants --> pkg_llm
-  pkg_invariants --> pkg_scope
-  pkg_invariants --> pkg_session
-  pkg_invariants --> pkg_system_prompt
-  pkg_invariants --> pkg_tools
   pkg_acp --> pkg_agent
   pkg_acp --> pkg_bash
   pkg_acp --> pkg_llm
@@ -289,6 +287,7 @@ flowchart TD
   pkg_workflow_workerthread --> pkg_agent
   pkg_workflow_workerthread --> pkg_brand
   pkg_workflow_workerthread --> pkg_llm
+  pkg_workflow_workerthread --> pkg_session
   pkg_workflow_workerthread --> pkg_subagent
   pkg_workflow_workerthread --> pkg_tools
   pkg_workflow_workerthread --> pkg_workflow
@@ -352,6 +351,7 @@ flowchart TD
 | [`hook-protocol`](../packages/hooks/hook-protocol) | `hooks` | [`bash`](../packages/bash/bash), [`session`](../packages/core/session) |
 | [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl) | `session-persistence` | [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence) |
 | [`session-persistence-sqlite`](../packages/session-persistence/session-persistence-sqlite) | `session-persistence` | [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence) |
+| [`invariants`](../packages/support/invariants) | `support` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session) |
 | [`user-approval`](../packages/ui/user-approval) | `ui` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt) |
 | [`user-interaction`](../packages/ui/user-interaction) | `ui` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm) |
 | [`workflow`](../packages/workflow/workflow) | `workflow` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm) |
@@ -367,7 +367,6 @@ flowchart TD
 | [`tool-todo`](../packages/todo/tool-todo) | `todo` | [`agent`](../packages/core/agent), [`session`](../packages/core/session), [`tools`](../packages/core/tools) |
 | [`tool-cordis`](../packages/cordis/tool-cordis) | `cordis` | [`scope`](../packages/core/scope), [`tools`](../packages/core/tools) |
 | [`hooks-codex`](../packages/hooks/hooks-codex) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`tools`](../packages/core/tools) |
-| [`invariants`](../packages/support/invariants) | `support` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) |
 | [`acp`](../packages/ui/acp) | `ui` | [`agent`](../packages/core/agent), [`bash`](../packages/bash/bash), [`llm`](../packages/llm/llm), [`sandbox`](../packages/sandbox/sandbox), [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`tools`](../packages/core/tools), [`user-approval`](../packages/ui/user-approval), [`user-interaction`](../packages/ui/user-interaction) |
 | [`tool-ask-user`](../packages/ui/tool-ask-user) | `ui` | [`agent`](../packages/core/agent), [`tools`](../packages/core/tools), [`user-interaction`](../packages/ui/user-interaction) |
 | [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | `guard` | [`agent`](../packages/core/agent), [`tools`](../packages/core/tools) |
@@ -378,7 +377,7 @@ flowchart TD
 | [`tool-subagent`](../packages/subagent/tool-subagent) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) |
 | [`hooks-claude`](../packages/hooks/hooks-claude) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) |
 | [`subagent-mock`](../packages/support/subagent-mock) | `support` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent) |
-| [`workflow-workerthread`](../packages/workflow/workflow-workerthread) | `workflow` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools), [`workflow`](../packages/workflow/workflow) |
+| [`workflow-workerthread`](../packages/workflow/workflow-workerthread) | `workflow` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools), [`workflow`](../packages/workflow/workflow) |
 | [`subagent-fork`](../packages/subagent/subagent-fork) | `subagent` | [`agent`](../packages/core/agent), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`subagent-inprocess`](../packages/subagent/subagent-inprocess) |
 | [`subagent-spawn`](../packages/subagent/subagent-spawn) | `subagent` | [`subagent`](../packages/subagent/subagent), [`subagent-inprocess`](../packages/subagent/subagent-inprocess) |
 | [`acp-agent`](../packages/ui/acp-agent) | `ui` | [`acp`](../packages/ui/acp), [`agent-core`](../packages/core/agent-core), [`app-boot`](../packages/ui/app-boot), [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl), [`tools`](../packages/core/tools), [`user-interaction`](../packages/ui/user-interaction) |
diff --git a/docs/persistence-catalog.md b/docs/persistence-catalog.md
index 4bbe894338..245d25fa5f 100644
--- a/docs/persistence-catalog.md
+++ b/docs/persistence-catalog.md
@@ -23,7 +23,7 @@ An approval question was put to the answerer chain — log-only audit (like `hoo
 
 Types: [CallId](core-data-structures/core.md)
 
-Source: [`packages/ui/user-approval/src/index.ts:86`](../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:84`](../packages/ui/user-approval/src/index.ts)
 
 #### `approval/decided` — log-only
 
@@ -33,7 +33,7 @@ The outcome of a prior `approval/asked` (same `id`) — log-only audit. Exactly
 'approval/decided': { id: ApprovalRequestId; outcome: ApprovalOutcome }
 ```
 
-Source: [`packages/ui/user-approval/src/index.ts:97`](../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:95`](../packages/ui/user-approval/src/index.ts)
 
 #### `approval/policy` — log-only
 
@@ -43,7 +43,7 @@ The session's approval policy was switched — log-only, durable, replayable, ne
 'approval/policy': { policy: ApprovalPolicy }
 ```
 
-Source: [`packages/ui/user-approval/src/index.ts:109`](../packages/ui/user-approval/src/index.ts)
+Source: [`packages/ui/user-approval/src/index.ts:107`](../packages/ui/user-approval/src/index.ts)
 
 ### `assistant/*`
 
@@ -57,7 +57,7 @@ Raw stream chunk — token-level replay fidelity.
 
 Types: [StreamChunk](core-data-structures/llm-streaming.md)
 
-Source: [`packages/core/session/src/types.ts:313`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:322`](../packages/core/session/src/types.ts)
 
 #### `assistant/message` — surface
 
@@ -69,7 +69,7 @@ Assembled assistant message for one step (derived history uses this). Carries th
 
 Types: [ContentBlock](core-data-structures/core.md) · [TokenUsage](core-data-structures/llm-streaming.md)
 
-Source: [`packages/core/session/src/types.ts:320`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:329`](../packages/core/session/src/types.ts)
 
 ### `bash/*`
 
@@ -129,7 +129,7 @@ In-session context injection (file-change notices, subdir AGENTS.md, skill conte
 
 Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md)
 
-Source: [`packages/core/session/src/types.ts:311`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:320`](../packages/core/session/src/types.ts)
 
 ### `hook/*`
 
@@ -165,7 +165,7 @@ A queued prompt an `agent/prompt-submit` listener VETOED — the durable record
 
 Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md)
 
-Source: [`packages/core/session/src/types.ts:305`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:314`](../packages/core/session/src/types.ts)
 
 ### `request/*`
 
@@ -177,7 +177,7 @@ Full snapshot of the EpochHeader the NEXT request is built under, with the Reque
 'request/header': { header: EpochHeader; reason: RequestHeaderReason }
 ```
 
-Source: [`packages/core/session/src/types.ts:365`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:374`](../packages/core/session/src/types.ts)
 
 #### `request/header-delta` — log-only
 
@@ -187,7 +187,7 @@ Amendment to the folded EpochHeader: at least one of a SystemDelta, a ToolsDelta
 'request/header-delta': { system?: SystemDelta; tools?: ToolsDelta; config?: LlmCallConfig; messagePrefix?: Message[] }
 ```
 
-Source: [`packages/core/session/src/types.ts:382`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:391`](../packages/core/session/src/types.ts)
 
 ### `steering/*`
 
@@ -201,7 +201,7 @@ Steering content injected between steps of a running turn.
 
 Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md)
 
-Source: [`packages/core/session/src/types.ts:338`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:347`](../packages/core/session/src/types.ts)
 
 ### `step/*`
 
@@ -213,7 +213,7 @@ Closes step `step` of turn `turn`.
 'step/end': { turn: number; step: number }
 ```
 
-Source: [`packages/core/session/src/types.ts:292`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:301`](../packages/core/session/src/types.ts)
 
 #### `step/start` — log-only
 
@@ -223,7 +223,7 @@ Opens step `step` of turn `turn` — one model call plus the tool executions it
 'step/start': { turn: number; step: number }
 ```
 
-Source: [`packages/core/session/src/types.ts:290`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:299`](../packages/core/session/src/types.ts)
 
 ### `todo/*`
 
@@ -239,7 +239,7 @@ NOT a SurfaceEventType: it produces no LLM message and never reaches `deriveMess
 
 Types: [TodoItem](core-data-structures/session.md)
 
-Source: [`packages/core/session/src/types.ts:352`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:361`](../packages/core/session/src/types.ts)
 
 ### `tool/*`
 
@@ -253,7 +253,7 @@ The model requested one tool invocation: `name` with the raw `arguments` JSON st
 
 Types: [CallId](core-data-structures/core.md)
 
-Source: [`packages/core/session/src/types.ts:326`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:335`](../packages/core/session/src/types.ts)
 
 #### `tool/code-dispatch` — log-only
 
@@ -277,7 +277,7 @@ A completed tool call's model-facing result, plus an optional tool-private `meta
 
 Types: [CallId](core-data-structures/core.md) · [ContentBlock](core-data-structures/core.md)
 
-Source: [`packages/core/session/src/types.ts:336`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:345`](../packages/core/session/src/types.ts)
 
 ### `turn/*`
 
@@ -291,7 +291,7 @@ Closes turn `turn` with the TurnEndReason that ended it. The loop fires the awai
 
 Types: [TurnEndReason](core-data-structures/session.md)
 
-Source: [`packages/core/session/src/types.ts:288`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:297`](../packages/core/session/src/types.ts)
 
 #### `turn/start` — log-only
 
@@ -303,7 +303,7 @@ Opens turn `turn`. `trigger` records what started it — a drained message batch
 
 Types: [TurnTrigger](core-data-structures/session.md)
 
-Source: [`packages/core/session/src/types.ts:282`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:291`](../packages/core/session/src/types.ts)
 
 ### `user/*`
 
@@ -317,4 +317,4 @@ A user-visible prompt (queued message drained at turn start).
 
 Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md)
 
-Source: [`packages/core/session/src/types.ts:294`](../packages/core/session/src/types.ts)
+Source: [`packages/core/session/src/types.ts:303`](../packages/core/session/src/types.ts)
diff --git a/docs/rfc/INDEX.md b/docs/rfc/INDEX.md
index 9b13bfe557..aab143fd7d 100644
--- a/docs/rfc/INDEX.md
+++ b/docs/rfc/INDEX.md
@@ -70,6 +70,7 @@ Generated by `pnpm run gen-rfc-index` from the RFC tree — never edit by hand;
 | [The session prefix — request-only messages in front of the derived history](implemented/feature/2026-07-07-session-prefix.md) | 2026-07-07 |
 | [Repeat-tool-call guard plugin](implemented/feature/2026-07-08-repeat-tool-guard.md) | 2026-07-08 |
 | [The self-referential cordis toolset](implemented/feature/2026-07-08-self-referential-cordis-toolset.md) | 2026-07-08 |
+| [Configure subagent persona, tool visibility, and depth](implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) | 2026-07-12 |
 
 ### Simplification
 
@@ -101,7 +102,7 @@ Generated by `pnpm run gen-rfc-index` from the RFC tree — never edit by hand;
 |---|---|
 | [Provider-neutral content-block vocabulary owned by dsh-llm](implemented/architecture/2026-06-11-content-block-vocabulary.md) | 2026-06-11 |
 | [Custom typed tool-schema DSL instead of schemastery](implemented/architecture/2026-06-11-custom-schema-dsl.md) | 2026-06-11 |
-| [Dev-mode invariants over compile-time deep-readonly](implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md) | 2026-06-11 |
+| [Source-owned session immutability and dev-mode invariants](implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md) | 2026-06-11 |
 | [Event-sourced sessions with derived message history](implemented/architecture/2026-06-11-event-sourced-sessions.md) | 2026-06-11 |
 | [Microkernel — extension via Cordis event taxonomy, one concrete loop](implemented/architecture/2026-06-11-microkernel-event-taxonomy.md) | 2026-06-11 |
 | [Runtime arg validation at the model boundary](implemented/architecture/2026-06-11-runtime-arg-validation.md) | 2026-06-11 |
@@ -133,6 +134,7 @@ Generated by `pnpm run gen-rfc-index` from the RFC tree — never edit by hand;
 | [A shared timeout/deadline primitive, with hard-kill left to each capability](implemented/architecture/2026-07-06-timeout-deadline-library.md) | 2026-07-06 |
 | [Tool-call timeout policy as a plugin](implemented/architecture/2026-07-07-tool-call-timeout-policy.md) | 2026-07-07 |
 | [The agent is a registration scope](implemented/architecture/2026-07-08-agent-scope-contexts.md) | 2026-07-08 |
+| [Agent-scope runtime design and correctness](implemented/architecture/2026-07-12-agent-scope-runtime-design.md) | 2026-07-12 |
 
 ### Process
 
diff --git a/docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md b/docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md
index a3240153d0..aac3991f46 100644
--- a/docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md
+++ b/docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md
@@ -1,29 +1,58 @@
-# RFC: Dev-mode invariants over compile-time deep-readonly
+# RFC: Source-owned session immutability and dev-mode invariants
 
 Status: implemented
 
 ## Problem
 
-The session log is append-only by contract, but the types don't enforce it: `session.events` returns `readonly SessionEvent[]` whose *elements* are mutable, and `deriveMessages()` handed the logged `content` arrays/blocks out by reference. The loop then passes those derived messages into the `agent/request` waterfall and on to adapters, where mutating the request is sanctioned — so a request middleware could reach back and rewrite history, silently breaking replay equivalence and the derived-history guarantee. Separately, the event taxonomy (turn/step nesting, seq monotonicity, tool-call/result pairing, legal status transitions) was asserted only where individual tests happened to look.
+The session log needs two different protections: immutable ownership of each stored fact, and checks for relationships among facts across time and service seams. Conflating them in an optional development plugin would leave production history vulnerable; trying to express both through TypeScript readonly types would not create a runtime boundary or describe relational rules.
 
-Two ways to defend the log: make immutability part of the type (`DeepReadonly<SessionEvent>` on the way out), or catch corruption at runtime in dev. The runtime-validation proposal took the runtime route; [the deep-readonly proposal](../../rejected/architecture/2026-06-11-immutable-public-surfaces.md) took the type route.
+The session log is the durable source of truth for replay, request reconstruction, persistence, and user-visible history. Code outside the session package must be able to inspect that history without retaining a reference that can rewrite it later, and inputs accepted from callers must not remain connected to caller-owned mutable objects.
+
+Immutability of individual values is only half of the contract. A log can contain perfectly immutable records whose sequence, turn/step nesting, tool-call pairing, scoped delivery, or reconstructed model request is wrong. Those rules relate multiple records or services and cannot be established by freezing one object.
+
+TypeScript readonly types are not a sufficient runtime boundary. They disappear when the program runs, a cast can bypass them, and a recursive `DeepReadonly<T>` would spread through every log and message consumer even though some downstream request-processing APIs intentionally work with mutable values.
 
 ## Decision
 
-Reject the pervasive `DeepReadonly<T>` type flip. Instead:
+Responsibility is split between an always-on storage boundary and optional development assertions.
 
-1. **Always-on:** `deriveMessages()` deep-clones the content it emits (one `structuredClone` per derived message). In-flight mutation of a request can no longer reach the log — this is the real fix, and it costs nothing meaningful next to a model call.
-2. **Dev-mode:** a new `dsh-invariants` plugin (pure listeners, off in production, on in tests and demos) asserts the event contract and `Object.freeze`s logged event data so any *other* code that mutates a logged event throws instead of corrupting silently. Seeded sessions are frozen and checked on `session/created` (the constructor copies the seed without emitting `session/event`).
+### Session owns immutable history
 
-The invariants encode the *real* contract, not an idealized one: a `tool/call` may have no `tool/result` (a thrown tool-execution pipeline step ends the turn), and both `idle→disposed` and `running→disposed` are legal.
+`Session` accepts an event only after one recursive pass has materialized a lossless JSON snapshot. That pass rejects unsupported values and produces the exact detached record that enters the log, so validation and storage cannot observe different values from a stateful getter or retain caller-owned nested references.
+
+The accepted event and all of its descendants are deep-frozen before publication. `append()` returns that owned frozen event, `session/event` observers receive the same record, and `session.events` returns a frozen array snapshot. A previously returned array does not grow after a later append. Seed records pass through the same validation, snapshot, and freeze boundary before construction succeeds.
+
+This guarantee belongs in `Session`, not in an optional listener, because every composition relies on trustworthy history. A production deployment, a focused test, or a custom embedding receives the same storage semantics whether or not development support plugins are registered.
+
+### Derived requests remain detached
+
+`deriveMessages()` projects logged surface events into detached, deep-frozen `Message` objects and returns a fresh array snapshot. Request assembly can therefore combine derived history with other inputs without exposing a path back into the log. The cache reuses safe immutable projections rather than recloning the complete history for each model call.
+
+### The invariants plugin checks relationships
+
+`dsh-invariants` is a pure-listener development plugin. It does not freeze records and has no configuration; disposal removes only its assertions. It checks rules that require trace state or observation of another seam, including monotonic sequence numbers, turn and step nesting, tool-call/result pairing, legal agent-status transitions, subject-correct scoped dispatch, and equality between a loop-built request and the request reconstructed from its session-log prefix.
+
+When the plugin attaches to an existing or seeded session, it replays the immutable log to rebuild trace state. This makes hot reload safe in the middle of a turn without giving the plugin ownership of session storage.
 
 ## Alternatives considered
 
-**The pervasive `DeepReadonly<T>` type flip** ([the rejected proposal](../../rejected/architecture/2026-06-11-immutable-public-surfaces.md)) — compile-time only (a plugin casts straight through it), high type-noise across every log/message consumer and adapter, and it would force readonly types through code where mutation is the sanctioned API. The clone draws the mutable/immutable boundary exactly at "logged vs in-flight" without any of that noise.
+### Pervasive deep-readonly types
+
+[The rejected immutable-public-surfaces proposal](../../rejected/architecture/2026-06-11-immutable-public-surfaces.md) would apply a recursive readonly type across public log and message surfaces. That provides editor feedback but not a runtime guarantee: TypeScript types are erased and plugin code can cast through them. It also pushes readonly types into consumers where mutation is intentional. Runtime ownership at the `Session` boundary protects every caller without that type propagation.
+
+### Development-only freezing
+
+Freezing history only when an invariants plugin is installed would make the core guarantee composition-dependent. Code could pass development tests and still corrupt history in production or in a focused composition that omits the plugin. Storage immutability is therefore always on, while the more expensive relational checks remain opt-in development support.
+
+### Clone only when deriving messages
+
+Detaching `deriveMessages()` would protect the most common request path but leave other readers of `session.events`, append return values, and session-event observers able to mutate durable history. The log must protect its own boundary; derived projections are an additional isolation boundary, not a substitute.
 
 ## Consequences
 
-- History corruption is caught loudly in tests and demos, at zero production cost and zero type noise. The trade-off is that the guarantee is dynamic (a dev-mode tripwire) rather than static.
-- The invariants plugin doubles as executable documentation of the event taxonomy — the assertions are the contract.
-- `Session.events` keeps its `readonly SessionEvent[]` type; no consumer churn.
-- This folds in [the deep-readonly proposal](../../rejected/architecture/2026-06-11-immutable-public-surfaces.md) — there is no separate deep-readonly record; this records the decision to *not* pursue that approach. `InvariantError` is a plain `Error` with a `code` for now; a later taxonomy change can promote it.
+- Every accepted live or seeded session event is detached from caller-owned inputs and deeply immutable before any observer can receive it.
+- `session.events` exposes stable immutable snapshots instead of the private growing array.
+- Request-side mutation cannot reach stored history through derived messages.
+- Development builds can enable relational assertions without changing storage behavior, and disposing or omitting the plugin does not weaken log immutability.
+- `dsh-invariants` has no `Config` surface because it has no behavior to tune.
+- The runtime boundary carries a recursive snapshot-and-freeze cost once per accepted event; later readers and cached projections reuse the owned immutable records.
diff --git a/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md b/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md
index 2b1c198812..80ca18b56f 100644
--- a/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md
+++ b/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md
@@ -16,9 +16,9 @@ A new `cancel()` verb on the `Agent` interface — the single public stop primit
 
 ### 2. `AgentHandle` async disposer
 
-`ctx.agents.create`/`resume` (and the `AgentFactory` interface) return `AgentHandle = { agent: Agent; dispose(): Promise<void> }`. The disposer is a **capability** — only the holder can tear down exactly this agent: stop its loop, `await` the loop's exit (true quiescence, not just the `disposed` status flip), unregister it, and remove its session from the store. `ctx.agents.get(id)` still returns a bare `Agent`. Config-created agents stay owned by the `AgentLoop` fiber (the handle is discarded). ACP holds each session's disposer in its `SessionRecord` and runs it on disconnect/teardown, so a bare client disconnect leaves no registered agent and no session-store entry — even when `session/load` races teardown (the just-resumed handle is disposed before the closed-guard throw).
+`ctx.agents.create`/`resume` (and the `AgentFactory` interface) return `AgentHandle = { agent: Agent; dispose(): Promise<void> }`. The disposer is a **consumer capability** — a registry observer holding only the bare `Agent` cannot tear it down. The caller fiber and registered factory provider are structural co-owners: caller unload enforces structured ownership, while provider unload must stop old instances whose scoped dependency surface resolves through that provider. All three paths reach the same memoized teardown: stop the loop, `await` its exit (true quiescence, not just the `disposed` status flip), unregister it, remove its session from the store, unwind its scope, and only then release both public IDs. Config-created agents are already owned by the `AgentLoop` fiber (the handle is discarded). ACP holds each session's disposer in its `SessionRecord` and runs it on disconnect/teardown, so a bare client disconnect leaves no registered agent and no session-store entry — even when `session/load` races teardown (the just-resumed handle is disposed before the closed-guard throw).
 
-**Teardown ORDER is load-bearing for durability**, and the implementation folds the session lifecycle into the agent's SINGLE composite cordis effect (`SessionStore.prepare`/`enter`/`announce`, replacing a sibling-effect split). A fiber unload disposes sibling effects concurrently (`Promise.all`), which would race the session's `onAppend` detach against the loop's closing `session/flush` and drop the closing `turn/end`; inside one effect the disposers run as an ordered LIFO chain (loop stopped + `await agent.done` BEFORE the session detaches), so the loop's final flush is captured on BOTH the handle's `dispose()` and a fiber unload. The register disposer's `agent/disposed` emit is contained (a throwing listener must not reject the chain and skip the later session detach).
+**Teardown ORDER is load-bearing for durability**, and the implementation folds the session lifecycle into the agent's SINGLE composite cordis effect (`SessionStore.prepare`/`enter`/`announce`, replacing a sibling-effect split). A fiber unload disposes sibling effects concurrently (`Promise.all`), which would race removing the session store's append publication hooks against the loop's closing `session/flush` and drop the closing `turn/end`; inside one effect the disposers run as an ordered LIFO chain (loop stopped + `await agent.done` BEFORE the session detaches), so the loop's final flush is captured on BOTH the handle's `dispose()` and a fiber unload. The contained `agent/disposed` and `session/disposed` notifications cannot reject the chain or skip later teardown.
 
 ### 3. Bash owner token in the seam
 
@@ -40,7 +40,7 @@ The bash owner-token comparison relies on `session.header.id` being unique among
 ## Alternatives considered
 
 - **A public `BashTask.owner` field** instead of the `BashExecutor.ownerOf(id)` seam — rejected: one read path, no redundant API.
-- **Sibling cordis effects for the agent's session lifecycle** — rejected: a fiber unload disposes sibling effects concurrently (`Promise.all`), racing the session's `onAppend` detach against the loop's closing `session/flush`; the single composite effect's ordered LIFO chain is what captures the closing `turn/end` on both disposal paths.
+- **Sibling cordis effects for the agent's session lifecycle** — rejected: a fiber unload disposes sibling effects concurrently (`Promise.all`), racing removal of the store-owned append publication hooks against the loop's closing `session/flush`; the single composite effect's ordered LIFO chain is what captures the closing `turn/end` on both disposal paths.
 - **A separate step-only `abort()` beside `cancel()`** — shipped originally, then removed as unused; `cancel()` is the single public stop primitive ([the public-stop-surface RFC](../simplification/2026-06-20-public-agent-stop-surface.md)).
 
 ## Consequences
diff --git a/docs/rfc/implemented/architecture/2026-06-30-event-domain-semantics.md b/docs/rfc/implemented/architecture/2026-06-30-event-domain-semantics.md
index 9375a6e248..f0ab95ca80 100644
--- a/docs/rfc/implemented/architecture/2026-06-30-event-domain-semantics.md
+++ b/docs/rfc/implemented/architecture/2026-06-30-event-domain-semantics.md
@@ -28,9 +28,9 @@ This is the foundational change in a stack that adds a Hooks subsystem; it estab
 
 ## Consequences
 
-- The loop no longer emits any boundary mirror; `closeStep` appends `step/end` only and `closeTurn` appends `turn/end` only. A throwing `step/end`/`turn/end` session-event listener is the surviving boundary-listener failure path (contained inside `closeStep`/`closeTurn` — `Session.append` pushes the event before notifying listeners, so the boundary is durable and the turn closes balanced regardless).
+- The loop no longer emits any boundary mirror; `closeStep` appends `step/end` only and `closeTurn` appends `turn/end` only. `Session.append` owns post-commit observer containment, so a throwing boundary observer cannot change the turn outcome or starve later consumers; an acceptance or internal validation failure still escapes before the boundary enters the log.
 - Tests that observed boundaries via the removed emits now observe the durable `turn/start`/`turn/end`/`step/start`/`step/end` session events — the behavior they pin (boundary ordering, step counting) is unchanged; only the feed they read moved to the canonical one. The tests that exercised a *throwing turn-boundary emit listener* were deleted, because that code path no longer exists (there is no emit to throw from). Per [AGENTS.md "tests document behavior, not golden truth"](../../../../AGENTS.md), the behavior and its test moved (or died) together.
-- The loop marks the step open (`stepOpen = true`) BEFORE appending `step/start`, because `Session.append` pushes the event to the log before notifying `session/event` listeners (validation throws happen earlier, before the push — see [the session append contract](../../../core-data-structures/session.md)). So a throwing `step/start` session-event listener runs with the step already open and the event already in the log: the loop's outer catch then calls `closeStep()`, which appends the balancing `step/end`, and the turn closes balanced with an error (`turn/start → step/start → step/end → turn/end` — verified by the invariants oracle in the regression test). Closing the open step is owed precisely because the marker is set first.
+- The loop marks the step open (`stepOpen = true`) only after `append('step/start')` returns. Internal dispatch validation runs before the log push and may reject without opening a step; post-commit `session/event` observer failures are contained inside `Session.append`. The marker therefore represents exactly the committed boundary that owes a later `step/end`.
 - The full realization of this is [the simplification RFC "Stop mirroring durable boundaries as agent events"](../simplification/2026-06-20-remove-agent-boundary-mirror-events.md): all four boundary mirrors are removed and every consumer reads boundaries off `session/event`. `agent/steering` (not a boundary mirror) stayed outside that RFC's scope and was removed by its own follow-up, [Remove the `agent/steering` mirror emit](../simplification/2026-07-04-remove-agent-steering-mirror.md) — it mirrored the durable `steering/message`.
 - The cordis events catalog (`docs/cordis-catalog/events.md`) is regenerated to drop the mirror events.
 
diff --git a/docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md b/docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md
index 24a525307e..53d3e63cdb 100644
--- a/docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md
+++ b/docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md
@@ -36,9 +36,9 @@ Plugins contribute named values via `ctx.systemPrompt.variable(name, provider)`;
 
 Per-tool semantics and when-to-use live in tool DESCRIPTIONS, which already ship in every request — the YAML prose was ~fully redundant with them. Sections carry only the cross-call habits a single call's description cannot: `dsh-tool-bash` contributes `tool:bash` (order 105) — check the `[exit code: N]` marker on every result; `dsh-tool-fs`'s read section gains the "not shell commands like cat" contrast. `todo_write` and the subagent tools need NO section — their descriptions already carry the whole contract. The leaf personas shrink to identity + behavior (verify your work; keep answers brief), and the welcome banner stops enumerating tools.
 
-### The subagent context contract
+### The subagent conversation-history descriptor
 
-`SubagentProvider` gains `readonly inheritsParentContext: boolean` — a DESCRIPTIVE fact beside `capabilities`, not in it (capabilities are start-time validation; nothing validates against this flag). Spawn and ACP declare `false`, fork declares `true`. `dsh-tool-subagent` derives both the tool description and the `prompt` parameter description from the flag (`providerWording`): the fork instance now tells the model the child inherits the conversation's completed turns (not the in-flight turn) and that its prompt should state only what is new. Deriving the description from a provider that arrives on its own fiber is what forced the provider-lifecycle events and the tool's reactive registration — that mechanism, its Loader-concurrency rationale, and its rejected alternatives are recorded in [the provider-lifecycle-events RFC](2026-07-05-subagent-provider-lifecycle-events.md).
+`SubagentProvider` gains `readonly inheritsParentContext: boolean` — a DESCRIPTIVE conversation-history fact beside `capabilities`, not in it (capabilities are start-time validation; nothing validates against this flag). Spawn and ACP declare `false`, fork declares `true`. The name refers only to conversation seeding, not Cordis scope, services, tools, or authority. `dsh-tool-subagent` derives both the tool description and the `prompt` parameter description from the flag (`providerWording`): the fork instance now tells the model the child is seeded with the conversation's completed turns (not the in-flight turn) and that its prompt should state only what is new. Deriving the description from a provider that arrives on its own fiber is what forced the provider-lifecycle events and the tool's reactive registration — that mechanism, its Loader-concurrency rationale, and its rejected alternatives are recorded in [the provider-lifecycle-events RFC](2026-07-05-subagent-provider-lifecycle-events.md).
 
 ## Alternatives considered
 
diff --git a/docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md b/docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md
index 73967c14b6..0b82e52581 100644
--- a/docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md
+++ b/docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md
@@ -24,7 +24,7 @@ Prefix-cache stability is corollary #1, not the headline: an append-only log pro
 
 **The loop, transmission-stateless.** Per step: render assembly (every step — value comparison needs no change-signal discipline, and a section that varies per step surfaces as a *logged* header event per step instead of a silent bust) → on the instance's FIRST step only, the `agent/session-prefix` waterfall — request-ONLY messages fronting the entire derived history (a frozen empty seed, contributions returned as an extension of `next()`; the home for session-stable openers that must NOT become history — a skills catalog, an AGENTS.md digest), deep-frozen and cached on the instance so reuse is structural and the prefix cannot drift mid-session — → `agent/pre-step`, carrying the composed prefix (compaction's surface mutations land before derivation, and its pressure gate counts the prefix this instance will actually send — never a previous instance's logged one, which could under-gate a resumed/forked instance whose contributor grew) → **messages snapshot, then `step/start` appended as the next operation in the same synchronous frame** → seed the call config (first request of the instance: from `AgentOptions`, so explicit options always beat the logged baseline — fork model-overrides and resume reconfiguration stay correct; afterwards: from the folded header) → the `agent/request` waterfall, re-typed `(agent, turn, step, config: LlmCallConfig, next) → LlmCallConfig` — a frozen seed and a returned replacement are ALL a listener shapes; durable content flows through the log channels (`inject()`, steering, prompt-submit `additionalContext`, sections via `system-prompt/assemble`) — → the header event the request owes the log, carrying the prefix as `messagePrefix` (no session event carries it, so the header is its only durable record; resume = a new instance = a recompose, anchored by its `'resume'` snapshot) → build `GenerateOptions` from `messagePrefix + snapshot` + header, deep-freeze (`deepFreeze` exempts the `AbortSignal`, the one live control channel — freezing one breaks `AbortController.abort()`), dispatch. The loop's per-instance bookkeeping is one boolean plus the cached prefix: whether this instance has logged its anchoring snapshot, and what it composed.
 
-**The reconstruction boundary is `step/start`, unconditionally.** A step's messages are the derivation over `events[0..stepStartSeq)`. Because the snapshot precedes the `step/start` append in the same synchronous frame, nothing can enter this request past the boundary: an `agent.inject()` from an `agent/request` listener (or any concurrent task, or a `session/event` listener firing on `step/start` itself) lands in the log after the boundary and joins the NEXT request. For waterfall-window appends this matches the prior loop (it also derived before its waterfall); for a synchronous `step/start` listener it is a deliberate change — such a listener could previously reach the current request — and `agent/pre-step` is the sanctioned seam for content that must affect the CURRENT request. A step's header for reconstruction is the fold after its own `request/header*` event (which sits between its `step/start` and first response event) or the fold carried forward.
+**The reconstruction boundary is `step/start`, unconditionally.** A step's messages are the derivation over `events[0..stepStartSeq)`. Because the snapshot precedes the `step/start` append in the same synchronous frame, an `agent.inject()` from an `agent/request` listener or any concurrent task lands after the boundary and joins the NEXT request. `session/event` is observe-only during publication: a reentrant append is rejected until the current callback list drains, preventing nested event delivery from overtaking the event being observed. `agent/pre-step` is the sanctioned seam for content that must affect the CURRENT request. A step's header for reconstruction is the fold after its own `request/header*` event (which sits between its `step/start` and first response event) or the fold carried forward.
 
 **Enforcement.** Dev-mode ([dsh-invariants](../../../../packages/support/invariants/src/index.ts)), on `llm/stream`: a frozen request with a live `sessionId` — the loop-built marker; hand-built one-shots are unfrozen and skipped — must carry messages deep-equal to the folded header's `messagePrefix` followed by the boundary derivation — the derivation rebuilt through a FRESH `Session` over `events[0..stepStartSeq)` so the live cache cannot vouch for itself — and header fields equal to `foldRequestHeader` over the log. There is no divergence allowance and nothing to allow: no seam can put unlogged content into a request — the `agent/session-prefix` seam's product enters only because the header event records it first. `prepend: true` only defends against the replay adapter's short-circuit (an append-registered listener); two prepended listeners have no defined mutual order in cordis, so correctness rests on the seq-bounded fold, never on listener timing. Measurement stays lean: the with-key e2e ([request-cache.e2e.ts](../../../../packages/core/agent-loop/tests/request-cache.e2e.ts)) proves `usage.cacheReadTokens > 0` on every request after the first against the live API, and per-step usage in the log is the production observable — a header event or compaction shows up as a cache-read collapse on the next step.
 
diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md
index 9091965a59..76c40805f8 100644
--- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md
+++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md
@@ -4,731 +4,173 @@ Status: implemented
 
 ## Problem
 
-One application can run many agents that share infrastructure but must not share every capability or policy. A child agent may need a different persona, fewer tools, its own structured-result schema, and listeners that govern only its work, while still using the deployment's model adapters, persistence backend, tool implementations, and user interface.
+One application needs to share infrastructure across many agents while letting each agent have its own tools, prompt contributions, policies, and listeners. Shared adapters, persistence, and user interfaces belong to the deployment; a persona, tool variant, or listener often belongs to one agent.
 
-This is a composition problem, not an application-isolation problem. Starting a separate service graph for every child would isolate too much; putting every registration in one global graph isolates too little.
+A separate service graph per agent duplicates shared infrastructure. One global registration graph has the opposite failure: an agent-specific contribution can leak into unrelated agents. Contributors need one ordinary registration mechanism that determines both who can see a contribution and when it is cleaned up.
 
-| Surface | What varies by agent | Failure when it is only global |
-|---|---|---|
-| Tools | Available capabilities, a child-only tool, or a scoped replacement for one implementation | The model receives excess authority, or a child-specific tool leaks into every prompt |
-| Prompt state | Persona, instructions, variables, and Code Mode SDK declarations | Every agent receives the same instructions or runtime facts |
-| Live policy | Hooks, execution guards, result observers, and continuation rules | A listener intended for one agent can alter another agent's work |
-| Lifetime | Cleanup when the agent fails, is cancelled, is disposed, or loses its owner | Registrations outlive the agent or disappear before its final work settles |
-
-Two consistency requirements make the problem deeper than filtering a list. First, the model-visible and executable views must agree: a hidden tool must not remain callable, and an advertised tool must not fail merely because execution used a different registry view. This agreement must also cover Code Mode bindings and UI presentation.
-
-Second, some rules are invariants rather than cooperative extensions. An ordinary middleware listener may replace a prompt assembly, turn an allow into a deny, rewrite a result, force another model step, or short-circuit listeners registered after it. Structured output therefore cannot rely on being “first” or “last” in an extensible listener chain; the owning service needs a final boundary for rules that later listeners must not undo.
-
-The subagent API makes both needs concrete. Two concurrent children can request different personas, tool filters, and output schemas. Those requests are honest only when each child receives an independently owned view and when its terminal-output protocol survives unrelated plugins.
+The mechanism also needs a publication boundary. An agent must not become visible before its local world is complete, and teardown must retain that world until final work has stopped.
 
 ## Decision
 
-Each live agent owns a registration context named `agent.ctx`, and services expose narrow owner-final policy boundaries where ordinary middleware ordering is not strong enough. Together these choices make one agent's world composable with normal plugin APIs while keeping authority, observation, and cleanup aligned.
+Every live agent owns one flat registration layer exposed as `agent.ctx`. Code registers through the context that owns a contribution; scope-aware services combine deployment-global registrations with exactly one matching agent layer; operations choose that layer from their real agent; and the layer exists for the agent's complete published lifetime.
 
-The design has three parts:
+Cordis is the plugin framework underneath the SDK. A Cordis **context** is the object plugins use to access services and register effects whose cleanup follows that context. The [Cordis primer](../../../cordis-primer.md) explains the framework in more detail.
 
-| Part | Rule | Purpose |
-|---|---|---|
-| Registration scope | A registration through a plain plugin context is global; the same registration through `agent.ctx` belongs to that agent | Reuse existing APIs for per-agent tools, prompt state, and listeners |
-| Lifecycle transaction | Create and resume await scoped setup while the agent and session are unpublished, then publish them in an ordered rollback-covered sequence | No observer sees a partially composed agent, and every failure path owns cleanup |
-| Owner-final policy | Prompt protection, tool guards, final tool-result observation, and terminal turn stopping run at service-owned boundaries | Invariants do not depend on listener registration order |
+For most contributors, the complete contract is four rules:
 
-The scope is flat. An agent resolves the deployment-global layer plus its own layer; a child does not inherit registrations from its parent's scope. Parent/child lineage remains explicit session data, and parent-owned disposal links lifetimes without silently inheriting authority.
-
-The implementation lives primarily in [`dsh-scope`](../../../../packages/core/scope/README.md), [`dsh-agent`](../../../../packages/core/agent/README.md), [`dsh-system-prompt`](../../../../packages/core/system-prompt/README.md), and [`dsh-tools`](../../../../packages/core/tools/README.md). The [generated Cordis event catalog](../../../cordis-catalog/events.md) is the exhaustive event-signature reference; this RFC explains why the contracts have their current shape.
-
-## Background: the small Cordis vocabulary used here
-
-The design relies on four framework ideas: contexts, effects, waterfall events, and dispatch receivers. This section gives the complete mental model needed for the rest of the RFC; the [Cordis primer](../../../cordis-primer.md) covers the framework more broadly.
-
-### A context is both a service view and a registration origin
-
-A Cordis `Context` is the object through which a plugin reaches services such as `ctx.tools`, `ctx.systemPrompt`, and `ctx.sessions`. A service method can recover the context through which it was accessed, so the service can tell whether a call came from an ordinary plugin context or from an agent's scoped context without adding a `scope` parameter to every registration API.
-
-A context also carries a capability view. A derived context reaches the services injected into the plugin that created it. Handing out `agent.ctx` therefore hands out the agent loop's injected service surface; it is not an ambient root context.
-
-### Effects give registrations an owner
-
-A Cordis effect is work whose cleanup belongs to a runtime unit called a fiber. Tool registration, prompt contribution, and event subscription are effects, so disposing their fiber unwinds them on normal teardown, failure, or hot reload.
-
-`dsh-scope` mounts a no-op plugin fiber for each scope. The plugin contributes no behavior; its fiber is the ownership bucket for everything registered through the scoped context.
-
-### A waterfall is ordered around-middleware
-
-A Cordis waterfall is an extensible middleware chain. A listener calls `next()` to delegate, can inspect or replace the downstream result, and can return without calling `next()` to short-circuit everything inside it.
-
-This flexibility is useful for cooperative transformations, but registration order is not an invariant boundary. A later plugin can prepend another listener, a wrapper can replace the downstream result after `next()` returns, and a short-circuit can prevent inner listeners from running at all.
-
-### The dispatch receiver selects scoped listeners
-
-Cordis filters event listeners using the dispatch receiver, the object exposed as `this` inside a function-style listener. `dsh-scope` supplies a receiver carrying the operation's scope key, so the event system can admit global listeners plus listeners registered for that key and reject listeners belonging to other agents.
-
-This receiver is live coordination state, not a durable session fact. The distinction matters later: `tools/result` is a live final-outcome notification, while the similarly named `tool/result` is an append-only session event stored for replay and model history.
-
-## Agent-scoped registrations
-
-An agent scope couples two facts that must not drift apart: who can see a registration and who disposes it. The calling context determines both facts, leaving the domain-specific merge rules to each registry.
-
-### The resolution model is global plus exactly one scope
-
-Every scope-aware registry keeps a global layer and per-scope layers. Resolving for agent A combines the global layer with A's layer only; it does not walk A's parent lineage or combine sibling scopes.
-
-| Registration origin | Visible to | Disposed with |
-|---|---|---|
-| Plain plugin context | Every agent | The registering plugin |
-| `agent.ctx` | That agent only | That agent's scope |
-
-Named scoped contributions shadow a same-named global contribution. A child persona is therefore a scoped `deployment:persona` section, and a per-agent tool implementation can keep the same model-facing name. Duplicate names within one layer still fail loudly. The deliberate exception is a globally protected prompt-section name, whose owner reserves it against scoped shadowing.
-
-The plugin-facing mechanism is the same API called through a different context. In language-neutral pseudocode:
-
-```text
-# Deployment-wide contribution
-appContext.tools.register(readTool)
-
-# Contribution visible only to agent A and disposed with A
-agentA.ctx.tools.register(childOnlyTool)
-
-resolveTools(agent A):
-  visible = copy(globalTools allowed by A's restrictions)
-  visible.overlay(tools registered through A.ctx)
-  visible.append(reserved presentation transport, when configured)
-  return visible
-```
-
-There is no `for each ancestor` step. Resolving for A never reads the parent or sibling layers.
-
-The scope key is an opaque object compared by identity. The harness uses the live `Agent` object as its own key, so event payloads, tool executions, and prompt assemblies that already carry the agent can select the correct layer without translating through a string ID that may later be reused.
-
-### `agent.ctx.agent` is an association, not the scope resolver
-
-`agent.ctx` carries an own `agent` property for setup code and plugin ergonomics. Contexts derived from it inherit that association, while a plain context reads `undefined`.
-
-The property is deliberately not treated as the authoritative scope tag. A nested scope can install a nearer scope key while still inheriting the original `ctx.agent` association, so lower-level services resolve layers with `scopeOf(context)`. In normal agent composition the two point at the same live agent; the separation keeps the generic scope primitive independent of the agent package.
-
-### The scope primitive has separate public and composite disposal forms
-
-`dsh-scope` exposes the minimum operations needed to create a layer, read it, target events, and dispose it. “Quiescent” here means that every asynchronous cleanup registered in the scope has settled and no teardown work remains in flight.
-
-| Operation | Responsibility |
+| Question | Rule |
 |---|---|
-| `createScope(context, key)` | Mount the ownership fiber and return its tagged derived context |
-| `scopeOf(context)` | Read the nearest inherited scope key |
-| `scopeTarget(subject, key)` | Build the receiver used for scope-filtered dispatch |
-| `Scope.dispose()` | Give ordinary callers an idempotent promise shared by repeat and racing calls until quiescence |
-| `Scope.rawDispose` | Expose the exact Cordis disposer so a larger generator lifecycle can nest it at a precise teardown position |
+| Where do I register behavior for one agent? | Call the ordinary registration API through `agent.ctx` |
+| What does an operation for an agent see? | Deployment globals plus that agent's layer, using the owning service's merge rules |
+| Which scoped listeners run? | Unscoped listeners plus listeners registered for the operation's agent |
+| How long does the layer exist? | Setup completes before publication; disposal keeps it until work reaches quiescence |
 
-The two disposal forms solve different framework constraints. Cordis identifies nested effects by disposer-function identity, so an ordered composite lifecycle must yield `rawDispose` exactly. Cordis disposers are also single-shot, so a second raw call may not await the first asynchronous teardown; `Scope.dispose()` follows the backing fiber's in-flight lifecycle and gives all ordinary callers the same quiescence boundary, including a race in which `rawDispose` started first. The test/tooling `ScopeHost.dispose()` extends that shared boundary across its host fiber and every minted child scope.
+The scope is flat. Resolution never walks parent or sibling scopes, and lifetime ownership does not imply registration inheritance.
 
-The primitive itself is small. Its essential implementation shape is:
+```mermaid
+flowchart LR
+  plain["Plain plugin context<br/>cleanup follows the plugin"] -->|"registers into"| globalLayer["Deployment-global layer"]
+  agentAContext["agentA.ctx<br/>cleanup follows Agent A"] -->|"registers into"| agentALayer["Agent A layer"]
+  agentBContext["agentB.ctx<br/>cleanup follows Agent B"] -->|"registers into"| agentBLayer["Agent B layer"]
 
-```text
-createScope(parentContext, key):
-  fiber = mount no-op plugin under parentContext
-  scopedContext = derive fiber.context with nearest-scope-tag = key
-
-  rawDispose = fiber's exact disposer
-  dispose = memoized operation that:
-    invoke rawDispose if it has not started
-    follow fiber's in-flight teardown until quiescent
-
-  return { ctx: scopedContext, rawDispose, dispose }
+  operationA["Operation for Agent A"] -->|"selects"| agentAView["Agent A view<br/>globals plus A local"]
+  globalLayer --> agentAView
+  agentALayer --> agentAView
+  operationB["Operation for Agent B"] -->|"selects"| agentBView["Agent B view<br/>globals plus B local"]
+  globalLayer --> agentBView
+  agentBLayer --> agentBView
 ```
 
-Derived contexts inherit the nearest scope tag. Mounting an ordinary plugin under `agent.ctx` therefore preserves the agent's scope, while deliberately creating another scope replaces the tag for registrations below it.
+The missing cross-edges are the isolation rule: Agent A's local registrations do not enter Agent B's view, and a parent's registrations do not enter a child merely because the parent owns the child's lifetime.
 
-### Registry resolution stays domain-specific
+The companion [runtime-design RFC](2026-07-12-agent-scope-runtime-design.md) explains the implementation and correctness reasoning. The [subagent composition-controls RFC](../feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) owns the separate `persona`, `toolFilter`, and `maxDepth` feature.
 
-The shared primitive answers “which layer?” and “who owns cleanup?” but does not force every service to merge data the same way. Tools, prompt sections, variables, and tool-schema providers retain rules appropriate to their domains.
+### Registration origin chooses visibility and cleanup
 
-Prompt sections, prompt variables, and tools use scoped-over-global shadowing by name. Tool-schema providers are additive, but a provider registered through `agent.ctx` participates only in that agent's assemblies. Read operations name the subject explicitly: tool lookup and execution receive an agent or scope, and prompt assembly receives an `AssembleContext` whose `scope` selects the layer.
+A registration made through a plain plugin context is deployment-global and is disposed with that plugin. The same method called through `agent.ctx` contributes to one agent and is disposed with that agent's scope.
 
-Calling a service through `agent.ctx` does not implicitly make every later read agent-scoped. For example, `agent.ctx.systemPrompt.assemble()` without an assembly scope still requests the global layer. This keeps shared services able to operate on behalf of any subject and makes the subject visible at the read or execution call site.
+| Registration origin | Default visibility | Disposed with |
+|---|---|---|
+| Plain plugin context | Every eligible agent view | Registering plugin |
+| `agent.ctx` | Exactly that agent's view | Agent scope |
 
-### Tool registrations are frozen snapshots
+Tools, prompt sections and variables, tool restrictions, guards, and scoped event listeners adopt this contract. Named local values ordinarily shadow a same-named global value for that agent; each owning service documents exceptions and merge behavior.
 
-The tool view must not change because a caller kept the object it passed to `register()` or received a definition from `get()` or `visible()`. Registration therefore creates the stored identity once; future changes happen through explicit unregister/register effects.
+The ordinary contributor pattern is to register the complete local world during agent setup:
 
-Tool parameters cross the model and log boundary, so the registry requires them to be lossless JSON before cloning and validates the clone again to contain unstable getters. It snapshots the scalar fields, binds each callback once to the original definition as its method receiver, and deep-freezes the stored record. Replacing `definition.execute` after registration therefore has no effect, while a callback can still deliberately read mutable state from its closure or original receiver. `get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached schema projections.
+```js
+const handle = await ctx.agents.create({
+  agentId: AgentId('reviewer'),
+  sessionId: SessionId('reviewer-session'),
+  agentOptions: { model: 'model-name' },
+  setup(agentCtx) {
+    agentCtx.systemPrompt.section({
+      name: 'deployment:persona',
+      order: 0,
+      text: 'Review code, but do not modify files.',
+    })
+    agentCtx.tools.register({
+      name: 'review_summary',
+      description: 'Return the review summary.',
+      parameters: { type: 'object', properties: {} },
+      async execute() {
+        return [{ type: 'text', text: 'review complete' }]
+      },
+    })
+  },
+})
 
-```text
-registerTool(context, definition):
-  require definition.parameters is lossless JSON
-  parameters = clone(definition.parameters)
-  require parameters is still lossless JSON
+ctx.tools.get('review_summary')                // undefined: not global
+ctx.tools.get('review_summary', handle.agent)  // the reviewer-local tool
 
-  stored = deepFreeze({
-    copied name, description, timeout,
-    parameters,
-    execute: bind definition.execute to definition,
-    presentation callbacks: bind once when present
-  })
-
-  layerFor(scopeOf(context)).add(stored.name, stored)
+await handle.dispose()
+ctx.tools.get('review_summary', handle.agent)  // undefined: scope is gone
 ```
 
-The reserved Code Mode transport uses the same frozen-definition contract even though it lives outside the ordinary layers.
+Setup receives a full trusted Cordis context so it can compose ordinary plugins and services. Its contract is composition-only: driving or publishing the in-flight agent through casts or internal registry calls is unsupported.
 
-### Tool restrictions reduce end capabilities without removing transport
+### The operation chooses the view
 
-A tool restriction masks the global end-capability layer for one agent, while tools registered in that agent's own layer are explicit grants. Multiple restrictions intersect, so separately installed policies can only reduce the global surface.
+Registration origin and operation subject are separate facts. Calling a service through `agent.ctx` selects where a new registration belongs; it does not bind later reads to that agent.
 
-The restriction snapshots its input, rejects an empty filter, and validates named tools against the pre-restriction capability universe. A restricted-away tool behaves like an unknown tool at execution, avoiding disclosure of a hidden global implementation.
+Tool lookup and execution receive the agent they act for. Prompt assembly receives an assembly context for the agent whose request is being built. Event dispatch receives its domain subject. This keeps shared service instances reusable across agents while making each operation's view explicit.
 
-[Code Mode](../feature/2026-06-15-code-mode.md)'s `run_code` is not an end capability. It is a reserved presentation transport that carries calls to the visible end capabilities, so the registry keeps it outside both global and scoped registration layers: restrictions cannot remove it, a scoped tool cannot shadow it, and configuration cannot explicitly allow or deny it. Without this exception, a restriction could leave the generated SDK in the prompt but remove the only way to invoke it.
+Only services that adopt the scope contract resolve an agent layer. `agent.ctx` does not automatically change arbitrary Cordis service calls.
 
-The registry still uses one executable visibility view. It first resolves restricted global capabilities plus scoped grants, then appends the reserved transport in non-native modes; registry-owned prompt schemas, lookup, execution, Code Mode SDK bindings, timeout lookup, inspection, and UI presentation all consume that view.
+### Scoped events keep routing separate from event data
 
-The guarantee covers the tool registry's contribution. A plugin can deliberately use the lower-level `systemPrompt.tools()` API or assembly waterfall to add an unrelated wire schema; that plugin owns the matching executable behavior and any ordering it introduces. Owner protection preserves reserved named infrastructure without turning the system-prompt service into a validator for unrelated contributions.
+An event about Agent A normally reaches unscoped listeners and A-scoped listeners, not B-scoped listeners. An event without an agent subject reaches only unscoped listeners.
 
-`knownNames` serves a narrower configuration purpose: it is the pre-restriction end-capability universe used to distinguish a typo from a deliberately hidden tool. The system-prompt provider adds presentation names when validating `toolOrder`: `code` mode accepts only `run_code`, `both` accepts end capabilities plus `run_code`, and a per-agent restriction may remove a known capability from one assembly without turning the deployment's order configuration into an error.
+At the Cordis level, `Scoped<T>` is an opaque routing receiver. It carries the filter used to choose listeners but is not the domain object. Event signatures therefore keep the real `Agent`, tool execution, approval request, or other subject as an explicit argument that listeners can inspect.
 
-## Scoped event delivery
+A listener registered with `{ global: true }` deliberately bypasses contextual audience filtering while its cleanup still follows the registering context. Registry-membership notifications remain unfiltered because they describe shared registry state rather than one agent's operation. The generated [event catalog](../../../cordis-catalog/events.md) is the exhaustive event reference.
 
-Scoped registration is incomplete unless behavior follows the same boundary. An event about agent A reaches global listeners and A-scoped listeners, never listeners installed for B.
+### Creation publishes last and disposal revokes last
 
-### Delivery is global plus the matching scope
+`ctx.agents.create()` and `resume()` build an unpublished session, scope, agent, and driver. They await `setup`, admit the final session and agent entries, announce them in order, start the loop, and only then return a handle.
 
-The dispatch receiver carries the operation's scope key. Its filter admits an unscoped listener or a listener registered through the matching scoped context, while a subject-less dispatch admits unscoped listeners only. Cordis's explicit `{ global: true }` listener option remains the intentional bypass for infrastructure that must observe every dispatch.
+An optional creation signal cancels work only while create or resume is pending. After the promise resolves, the returned `AgentHandle` owns explicit disposal.
 
-Registry-membership notifications remain unfiltered. Events such as `tools/change`, `system-prompt/change`, `skill/provider-*`, and `subagent/provider-*` describe shared registry state rather than one agent's activity, so a scoped subscriber still observes those global changes.
+If loading, setup, admission, or publication fails, the private transaction rolls back everything it prepared. Concurrent operations using the same caller-supplied live ID may both reach setup, but final registry entry admits only one; every loser rejects and cleans its private resources. Sequential reuse after awaited disposal remains valid.
 
-### Each event family derives its key from its real subject
+`AgentHandle.dispose()` reverses the boundary. It deactivates creation or driving, waits for synchronous publication to unwind, stops and drains the driver and final session flushes, detaches the agent and session, and finally disposes the scope. Repeated or racing disposal requests join one completion promise.
 
-The operation being described determines the key; callers cannot attach an unrelated scope. Fused helpers and store-owned carriers keep the payload subject and delivery subject together.
+The calling Cordis context and the concrete AgentLoop factory are structural co-owners. Unloading either disposes the transaction or live agent.
 
-| Event family | Scope source |
-|---|---|
-| `agent/*`, including `agent/turn-stop` | The event's agent |
-| `approval/request` | `ApprovalRequest.agent` |
-| `tools/pre-execute`, `tools/execute`, `tools/post-execute`, `tools/result` | `ToolExecution.agent`, or no key for an agent-less call |
-| `system-prompt/assemble` | `AssembleContext.scope` |
-| `session/created`, `session/event`, `session/flush` | The owner scope captured when the session enters the store |
-| `subagent/start`, `subagent/end` | The delegating parent agent |
+```mermaid
+flowchart TB
+  request["Create or resume"] --> privateWorld["Build private session, scope, agent, and driver"]
+  privateWorld --> setup["Await composition through agent.ctx"]
+  setup --> admission["Admit final session and agent entries"]
+  admission --> publish["Announce lifecycle and start the driver"]
+  publish --> live["Return AgentHandle"]
 
-Approval requests cross an asynchronous answer boundary, so the service snapshots the accepted record synchronously. It preserves the exact agent and abort-signal identities but copies the scalar fields, captures the agent's session once, and uses that one snapshot for `approval/asked`, scoped dispatch, cancellation, policy, and `approval/decided`. Mutating the caller-owned record after `request()` returns therefore cannot split the audit pair or redirect the question to another agent's listeners.
-
-The dispatch rule can be read independently of Cordis internals:
-
-```text
-dispatchScoped(subject, scopeKey, event, arguments):
-  carrier = proxy(subject, tag = scopeKey)
-
-  for listener in listeners(event):
-    if listener has no scope tag or requests the explicit global bypass:
-      call listener with this = carrier
-    else if listener.scopeTag == scopeKey:
-      call listener with this = carrier
-    else:
-      skip listener
+  privateWorld -->|"failure, cancellation, or owner loss"| rollback["Rollback private work"]
+  setup -->|"failure, cancellation, or owner loss"| rollback
+  admission -->|"duplicate or owner loss"| rollback
+  publish -->|"listener failure or owner loss"| rollback
+  live -->|"handle or owner disposal"| quiesce["Stop and drain work"]
+  rollback --> quiesce
+  quiesce --> detach["Detach agent, then session"]
+  detach --> revoke["Dispose the agent scope"]
 ```
 
-The real helpers fuse values that must agree. `agentEvents(context, agent)` uses the same agent as the subject, scope key, and first event argument. `assembleContextFor(agent)` similarly sets both the agent-facing field and the scope selector. The session store captures its carrier when a session enters because later appends and flushes may occur where the original agent context is no longer available.
+### Subagent controls are an independent feature
 
-### The carrier behaves like the subject but has distinct identity
+In-process subagents consume agent scope by installing their local composition during unpublished setup. Their optional persona, live global-tool filter, and absolute depth cap are not intrinsic scope semantics; the [subagent composition-controls RFC](../feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) defines those controls, provider capability checks, and dynamic tool behavior.
 
-Function-style listeners receive the carrier as `this`, and agent event APIs allow them to call subject methods. The carrier is therefore a JavaScript proxy that reads and writes through to the real subject and binds methods to it.
+`inheritsParentContext` describes conversation-history seeding only. It says nothing about Cordis scope, injected services, tools, or authority.
 
-Binding matters for classes with JavaScript private fields: a method called with the proxy itself as receiver would fail the runtime private-field identity check. The proxy preserves the subject's existing event filter and JavaScript object invariants, but it is intentionally not identity-equal to the subject; event arguments carry the real object whenever identity matters.
+## Security and authority are non-goals
 
-`Scoped<T>` is a TypeScript-only marker that requires this carrier at declared scoped dispatch sites. It improves authoring but adds no runtime security, so runtime marks and development invariants check the same contract for JavaScript, casts, and hand-written dispatches.
+Agent scopes compose trusted same-process registrations. They do not sandbox plugins, define a parent-to-child authority lattice, freeze grants at creation, or guarantee that a child can do no more than its parent.
 
-## Agent creation and teardown
+A parent may own a child whose visible tools are wider than its own because lifetime ownership does not donate or cap registrations. A plugin holding a Cordis context also runs in the same process and can call available services directly.
 
-An agent's scope, session, registry entry, and driver form one owned transaction. Setup finishes before publication, publication is synchronous and rollback-covered rather than magically atomic, and teardown reaches one ordered quiescent boundary.
-
-### Create and resume reserve identities before asynchronous work
-
-Programmatic create and resume reserve both the agent ID and session ID before work that can await. Create prepares a fresh or seeded session; resume first loads and reconstructs the persisted session. Both paths then construct the agent, mint `agent.ctx`, and install the complete teardown skeleton before awaiting setup.
-
-The factory captures IDs and the setup callback and clones caller-owned agent options, session metadata, and seed events before the first asynchronous boundary. Resume does the same before persistence loading. A caller mutating its options object later therefore cannot move the transaction away from the identities it reserved or change the configuration eventually published.
-
-Reservations prevent two concurrent transactions from composing different unpublished agents under the same public identity. They remain held across persistence loading and setup and are released on every success or failure path.
-
-Resume installs an owner-liveness sentinel before reserving IDs or starting persistence I/O, then races loading against owner disposal. If disposal wins, resume rejects and releases both reservations immediately; a backend promise that settles later cannot publish. After a successful load, the factory synchronously installs the full agent lifecycle before removing the sentinel, so ownership passes from load to setup without an unobserved disposal gap.
-
-The sentinel exists only for the interval in which no agent lifecycle can exist yet:
-
-```text
-resume(request):
-  snapshot request ids, options, and setup callback
-  sentinel = owner.effect(onDispose => signal ownerDisposed)
-  reserve(agentId, sessionId)
-
-  try:
-    persisted = await firstOf(persistence.load(sessionId), ownerDisposed)
-    session = reconstruct(persisted)
-
-    # This call installs the full lifecycle before its first await.
-    starting = startOwned(agentId, session, options, setup)
-    disarm and dispose sentinel
-    return await starting
-  finally:
-    release both ids
-    settle the sentinel transaction
-```
-
-If `ownerDisposed` wins, the load promise may continue inside the backend, but it has no path back to publication.
-
-### Setup composes an unpublished world
-
-The optional `setup(agentCtx)` callback receives the new agent context and may synchronously register contributions or await child-plugin activation. During setup, neither the session nor agent is visible through its global registry, but `agentCtx.agent` exposes the unpublished agent to the code composing it.
-
-Setup may register scoped tools, prompt sections, variables, restrictions, listeners, protections, or child plugins. If it throws or rejects, the scope unwinds without publishing either object, and the reserved IDs become reusable. If the owner unloads during an await, the preinstalled teardown skeleton marks the transaction inactive; late setup completion cannot publish.
-
-After setup settles, the factory yields one microtask checkpoint and rechecks the lifecycle flag, owner-fiber state, and owning agent's disposed state. Cordis begins owner unload synchronously but may run nested effect disposers in the next microtask; the explicit owner checks and checkpoint let a same-turn unload win instead of allowing an immediately fulfilled setup to publish an already-doomed agent.
-
-Setup composes but does not drive. The concrete agent rejects `send`, `steer`, `inject`, and `cancel` until publication reaches the session-start boundary, keeps its inbox in a JavaScript native-private field, and allows only one concrete driver to claim a session. Driver startup is absent from the package surface: the package exports neither its loop/inbox internals nor source subpaths, and only instance-bound controls held by the factory can enable and start the driver. JavaScript or a type cast therefore cannot bypass the lock by calling a public `start()` or writing directly into the queue. These boundaries prevent a turn from opening before lifecycle listeners know the session exists.
-
-The common create/resume tail makes the unpublished boundary explicit:
-
-```text
-startOwned(snapshot, preparedSession):
-  world = prepareLifecycle(snapshot, preparedSession)
-  # world now owns agent.ctx and the complete rollback/teardown skeleton
-
-  try:
-    await firstOf(snapshot.setup(world.agent.ctx), world.deactivated)
-    await oneMicrotask()
-    require world.lifecycleActive
-    require world.ownerFiberActive
-    require world.ownerAgentNotDisposed
-
-    world.publish(snapshot.source)
-    return handle(world.agent, world.dispose)
-  catch error:
-    await world.dispose()
-    throw error
-```
-
-`setup` can await arbitrary plugin activation, but every exit still passes through the already-installed disposer.
-
-### Publication is ordered and rollback-covered
-
-After setup succeeds, the factory publishes in one synchronous sequence with no `await` between steps:
-
-1. Enter the session store and capture its scope carrier.
-2. Enter the agent registry without announcing it.
-3. Emit `session/created`.
-4. Emit `agent/created`.
-5. Enable driving.
-6. Emit `agent/session-start`.
-7. Start the driver loop.
-
-The implementation keeps publication synchronous and leaves rollback to the surrounding owned transaction:
-
-```text
-publish(world):
-  world.detachSession = world.agent.ctx.sessions.enter(world.session)
-  world.detachAgent   = app.agents.enter(world.agent)
-  app.sessions.announce(world.session)
-  app.agents.announce(world.agent)
-  world.driver.enableDrivingVerbs()
-  emitNonVetoing(agent/session-start)
-  world.stopDriver = world.driver.start()
-```
-
-Both registry entries exist before the first creation listener runs, and setup-installed listeners receive both announcements. Driving opens immediately before `agent/session-start`, so that event remains the first supported place for a listener to inject or queue startup work.
-
-The sequence is not described as atomic because observers run between its steps. If a `session/created` or `agent/created` listener throws, the transaction rolls the registry entries and scope back, but effects already performed by an earlier listener cannot be retracted. An announced agent is paired with its disposal notification during rollback. `agent/session-start` is a non-vetoing notification: listener failures are logged and contained so the loop still starts.
-
-### Teardown stops work before revoking its world
-
-Every owner path uses the same reverse order: stop the loop and await its actual exit plus every agent-started durability checkpoint, remove the agent from the registry, detach the session, then unwind the scope. Final turn events, the turn-ending flush, and any outstanding idle-injection flush therefore settle while the session and scoped listeners are still live.
-
-```text
-disposeOwnedAgent(world):
-  await world.stopDriver()     # waits for loop exit and all agent-started flushes
-  world.detachAgent()          # emits agent/disposed when announced
-  world.detachSession()
-  await world.scope.dispose()
-```
-
-The actual Cordis generator yields these disposers in reverse so its last-in-first-out teardown executes in the order shown.
-
-`agent/disposed` means the driver is quiescent and the agent has left the registry; session detachment and scope unwind may still be completing after that notification. `AgentHandle.dispose()` is memoized so concurrent owners await the same full transaction, and `Scope.dispose()` provides the corresponding shared boundary for direct scope disposal and raw-disposer races.
-
-Parent-owned subagents use explicit ownership rather than capability inheritance. The driver creates one run-owner fiber under `parent.ctx` and invokes the child factory through that fiber, so lifecycle ownership exists before setup or publication begins; disposing a parent reaches its descendants even if a delegating tool never reaches its own `finally`. The child still receives a newly minted scope and resolves only global plus child-scoped capabilities.
-
-## Owner-final policy boundaries
-
-Cooperative waterfalls remain the general extension mechanism, but an invariant belongs after the last transformable point. The design adds four narrow boundaries, each owned by the service that can define what “final” means.
-
-### Prompt protection restores named canonical contributions
-
-`systemPrompt.protect({ sections, tools })` declares that selected names must match the canonical registry/provider assembly after the complete `system-prompt/assemble` waterfall. Protections registered globally and for the current scope compose by set union, so callback order cannot weaken them. Protection finalizes a returned assembly rather than recovering from listener failure; if the waterfall throws, assembly still fails.
-
-For each protected name, the service restores the canonical presence and definition. If the canonical assembly omitted the name, protection removes a listener-fabricated entry; this makes mode-dependent absence enforceable as well as presence.
-
-A global section protection also reserves the registry name against scoped shadowing. Registering a scoped section under an already protected global name throws, and adding global protection throws if any scoped shadow already exists. Section registration copies `name`, `order`, and the text value or callback before the check and stores that record, so later mutation of the caller's object cannot rename a safe section into a reserved one. This check must happen before assembly: otherwise the ordinary scoped-over-global merge would make the shadow itself look canonical, leaving post-waterfall restoration with the wrong owner's value. Tool-schema protection does not impose a blanket schema-name reservation because providers are additive and may deliberately contribute unrelated executable schemas.
-
-Restoration is intentionally not a whole-assembly reset. The service first removes protected names from the waterfall result, then reinserts protected canonical entries in their canonical order immediately before the first surviving later unprotected canonical neighbor, or at the end when no such neighbor survives. Unprotected entries keep the ordering and definitions chosen by the waterfall. This anchor rule preserves the protected contribution's meaningful local placement without claiming that protection restores every global relative position after arbitrary listener reordering.
-
-```text
-registerSection(input, scope):
-  stored = copy(input.name, input.order, input.text)
-  if scope exists and stored.name is globally protected:
-    fail before registration
-  sectionLayer(scope).add(stored)
-
-assemble(context):
-  canonical = assemble registries for context.scope
-  transformed = await systemPromptAssembleWaterfall(clone(canonical))
-
-  for each protected name:
-    remove every transformed entry with that name
-    if canonical contains the name:
-      if a later unprotected canonical neighbor survived:
-        insert the canonical entry before that neighbor
-      else:
-        append the canonical entry
-
-  return transformed
-```
-
-This algorithm restores a protected entry's definition, presence or absence, and useful local anchor without erasing unrelated listener output.
-
-Code Mode uses global protection for the `tools:sdk` section and reserved `run_code` schema. Structured output adds scoped protection for its instruction and capture schema. These are named guarantees: unrelated listeners may still contribute unrelated sections or tools.
-
-### Tool executions have stable identity
-
-`ctx.tools.execute(input)` accepts a caller-owned `ToolExecutionInput` and snapshots it into a distinct pipeline-owned `ToolExecution`. The registry requires `arguments` to be losslessly JSON-serializable, validates before cloning and again after cloning to contain unstable accessors, then deep-freezes the detached value. A cloneable but mutable exotic such as `Map` is rejected before policy rather than smuggled through an apparently frozen wrapper. Invalid input still produces one normalized final error notification.
-
-The registry assigns each pipeline trip a frozen, property-free `ToolExecutionToken`; callers cannot choose that token. The execution's `token`, `callId`, `name`, `agent`, optional opaque `parent` token, and detached `arguments` are non-writable and non-configurable from the first policy listener onward. `signal` is the only operational field: an around-dispatch wrapper may add, replace, or remove it, and the registry freezes the complete execution before outcome observation.
-
-Stable identity prevents a listener from changing which capability or scope was authorized after policy ran. It also gives commit-style observers a safe `WeakMap` key even when an adapter reuses a model call ID.
-
-For a nested transport dispatch, `parent` carries only the enclosing execution's opaque token rather than its live object. Code Mode sets an SDK sub-call's `parent` to the outer `run_code` execution's `token`, so an observer can correlate the two outcomes without receiving a reference that could mutate the still-running outer wrapper.
-
-The input-to-execution conversion is intentionally one-way:
-
-```text
-prepareExecution(input):
-  require input.parent is absent or a registry-minted token
-  require input.arguments is lossless JSON
-  detachedArguments = clone(input.arguments)
-  require detachedArguments is still lossless JSON
-
-  execution = {
-    token: new frozen property-free object,
-    callId: input.callId,
-    name: input.name,
-    arguments: deepFreeze(detachedArguments),
-    agent: input.agent,
-    parent: input.parent,
-    signal: input.signal
-  }
-
-  make every field except signal non-writable and non-configurable
-  return execution
-```
-
-### Tool guards can deny but never re-allow
-
-`ctx.tools.guard()` installs a synchronous global or scope-specific guard after the extensible `tools/pre-execute` waterfall and before dispatch. A guard returns a denial reason or `undefined`; it has no allow result.
-
-This one-way result makes the boundary monotonic. Pre-execution hooks can still compose ordinary allow, deny, and ask decisions; an ask resolves through the optional `ctx.approval` seam, where only `allowed-once` becomes allow and an absent channel or any non-grant becomes deny before guards run. No listener ordering can convert a guard denial back into dispatched work. A denied call still continues through result transformation and final observation as an error outcome.
-
-### `tools/result` observes the authoritative live outcome
-
-The complete live pipeline is `tools/pre-execute` → monotonic guards → `tools/execute` → `tools/post-execute` → `tools/result`. The first three named events are transformable waterfalls; `tools/result` is an awaited, observe-only notification after all transforms and the registry's outer error normalization. Immediately before that boundary, the registry validates that the entire authoritative result can round-trip losslessly through JSON; an invalid tool or listener result becomes a normal JSON-safe `isError` outcome instead of reaching observers as apparent success and failing later at the session log.
-
-Every `tools/result` listener receives the same frozen execution and deep-frozen result snapshot. Listener failures are contained independently, so they cannot change the caller's result or starve peer observers. Scope filtering derives from `execution.agent`.
-
-`tools/result` is not the durable session event `tool/result`. The live notification belongs to the registry and also fires for direct programmatic executions; the agent loop subsequently appends `tool/result` to the session log for replay, UI reconstruction, and model history. A policy that needs the final in-process verdict uses the former, while a consumer that needs persisted transcript state uses the latter.
-
-The entire registry method reads like one authority ladder:
-
-```text
-execute(input):
-  try:
-    execution = prepareExecution(input)
-  catch invalidInput:
-    execution = frozen identity shell with arguments = undefined
-    result = errorResult(invalidInput)
-    await tools/result observers with independent failure containment
-    return result
-
-  try:
-    gate = await tools/pre-execute(execution)
-    decision = gate
-    if gate asks:
-      decision = await resolveWithApproval(gate, execution.agent)
-    # approval absence and every non-grant resolve to deny
-
-    if decision allows:
-      denial = firstRegisteredGuardDenial(execution)
-    else:
-      denial = decision.denial
-
-    if denial exists:
-      result = errorResult(denial)
-    else:
-      result = await tools/execute(execution, next = dispatchRegisteredTool)
-      result = requireValidExecutionResult(result)
-
-    result = await tools/post-execute(execution, result)
-    result = requireLosslessJson(result)
-  catch pipelineFailure:
-    result = errorResult(pipelineFailure)
-
-  freeze(execution)
-  frozenResult = deepFreeze(clone(result))
-  await every tools/result observer independently, containing each failure
-  return result
-```
-
-Waterfalls can transform only at their named stages. Guards can only deny, and the final observers can only observe.
-
-### `agent/turn-stop` makes a composed continuation terminal
-
-Ordinary continuation remains extensible. The loop computes a default, runs the `agent/turn-continuation` waterfall, records any force-continue reason as steering, and folds pending steering into the decision because steering normally demands another model step.
-
-The scoped serial `agent/turn-stop` checkpoint runs after that folding. Its strict serial helper consults listeners in order until one returns a non-`undefined` value; a listener returns `{ action: 'stop' }` or abstains with `undefined`. The dedicated helper exists because ordinary Cordis serial dispatch treats `null` and `false` as framework abstentions, while this public contract has exactly one abstention value. A stop is terminal, so later listeners and pending steering cannot restore continuation. A malformed result, including `null` or `false`, or a throwing policy closes the current turn with an error while leaving the driver available for later work.
-
-Terminal stop deliberately discards steering while preserving ordinary queued prompts. Its terminal state remains in force through `turn/end` and the durability flush, so steering added by continuation, turn-close, or flush listeners cannot escape through the loop's late-steering fallback into another step or turn. This is the explicit exception to the normal rule that leftover steering becomes input for another turn. The authority is reserved for protocols, such as a completed structured child, where further model work would violate the result contract.
-
-```text
-afterSuccessfulStep(turn):
-  decision = await agent/turn-continuation(defaultDecision)
-  record decision.reason as steering when present
-  if steering is pending: decision = continue
-
-  terminal = await strictSerial(agent/turn-stop)
-  # undefined means abstain; null, false, malformed values, and throws are errors
-  if terminal == stop:
-    discard steering
-    terminalStopped = true
-    decision = stop
-
-  append turn/end
-  await session/flush
-
-  if terminalStopped:
-    discard steering added by turn/end or flush listeners
-  else:
-    move leftover steering to the next-turn queue
-```
-
-The queued-prompt FIFO is separate and is never drained by terminal stop.
-
-## Subagent composition
-
-In-process subagents demonstrate how the scope, lifecycle, and final-policy pieces compose. A provider builds the child's world during unpublished setup, then lets the ordinary agent lifecycle own it.
-
-### Inputs and ownership are fixed before asynchronous creation
-
-Provider registration first freezes an acceptance snapshot of the provider name, capability flags, parent-context descriptor, and `start` callback; the callback is bound to the original provider receiver so its intentional internal state stays live. Lookup, validation, model-facing wording, dispatch, lifecycle notifications, and HMR cleanup all use that snapshot. Mutating or reusing the caller's provider object later therefore cannot rename a live entry, change its advertised powers, replace its callback, or make its disposer delete the wrong key.
-
-Starting a run snapshots every accepted field before asynchronous owner setup. The parent and abort signal are retained as identity capabilities but never reread from the mutable request record; tool filters, seed events, agent options, output schema, and prompt are detached. The schema is validated before cloning, while the prompt must pass the same lossless-JSON check before and after cloning that the session log requires. Later caller mutation therefore cannot change lifecycle scope, configuration, the schema enforced by the capture tool, or the prompt eventually logged and sent.
-
-The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. The child factory runs through the owner fiber. Parent teardown, provider teardown, and manual run disposal all dispose this same node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat capability view.
-
-The returned run separates acceptance from publication with `started: Promise<void>`. For spawn and fork, it fulfills only after the child factory returns a published handle, so the service can emit `subagent/start` with `ctx.agents.get(run.id)` already live; it rejects when rollback prevents publication. The service observes `result` immediately but buffers its cloned end payload until readiness, preserving start-before-end order without leaving an early rejection unhandled. A readiness rejection emits neither lifecycle event. The result driver awaits the same boundary before sending the child prompt.
-
-```text
-startInProcessRun(providerContext, acceptedRequest):
-  snapshot all request data, including parent identity
-
-  providerLink = providerContext.effect(onDispose => disposeRunOwner())
-  attach snapshot.abortSignal listener
-  runOwner = mount no-op plugin under snapshot.parent.ctx
-
-  returnedRun.dispose = () =>:
-    dispose providerLink
-    await disposeRunOwner()
-
-  creation = runOwner.ctx.agents.create({
-    fresh ids and lineage,
-    cloned options and optional seed,
-    setup(childCtx) => install persona, tool restriction, structured runtime
-  })
-
-  returnedRun.started = creation.then(childHandle => publication complete)
-  returnedRun.result = async:
-    await returnedRun.started
-    send the child prompt, await idle, derive the terminal result
-
-SubagentService.start(...):
-  attach result settlement handlers immediately
-  await returnedRun.started
-  emit subagent/start; later emit the buffered or eventual subagent/end
-
-Workflow worker bridge after receiving returnedRun:
-  register the run so cancellation can reach pre-publication work
-  attach result settlement handlers immediately and snapshot the outcome
-  if returnedRun.started fulfills:
-    send ChildStarted; then send the buffered or eventual outcome
-  else:
-    send ChildStartError and dispose the attempt
-```
-
-Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, sends `ChildStarted` only after `started` fulfills, and sends `ChildStartError` plus host-driven disposal when readiness rejects. This keeps cancellation able to reach pending creation, prevents an early result rejection from going unhandled, and ensures `workflow/agent-start` never names an unpublished child.
-
-Parent teardown reaches `runOwner` by nesting; the provider and returned run handle reach the same node through their explicit disposers.
-
-### Persona, filtering, and lifetime use ordinary registrations
-
-A child persona is a scoped `deployment:persona` section that shadows the deployment-wide section. A child tool filter is a scoped restriction over global end capabilities. Omitted filters remain omitted; a materialized empty `allow` list means “allow nothing” and is not confused with absence.
-
-The child's persona, filter, and structured runtime are installed inside factory setup. The common run-owner fiber gives structured-concurrency-style teardown without importing the parent's capability layer into the child.
-
-### Structured output is a child-owned terminal protocol
-
-A structured child registers a real-schema `structured_output` tool and its instruction through its own context. Concurrent children can use different schemas because each scope resolves its own definition, with no global placeholder, reference count, or remove-for-everyone-else pass.
-
-Presentation mode changes where the model invokes the capture capability, but not which child owns it:
-
-| Tool mode | Registry's canonical wire contribution | Generated SDK | Structured-output guarantee |
-|---|---|---|---|
-| `native` | Visible end-capability schemas, including scoped `structured_output` | None | Protection restores the capture schema and instruction |
-| `code` | Reserved `run_code` transport | Visible end-capability bindings, including `structured_output` | Protection keeps `run_code` and the SDK present, keeps native `structured_output` absent from the wire, and restores the instruction |
-| `both` | Visible native schemas plus reserved `run_code` | Visible end-capability bindings, including `structured_output` | The model may call the protected capture capability natively or through the protected transport |
-
-The table describes the registry's named canonical contribution. An unrelated assembly listener may deliberately add another schema; protection does not erase unrelated names.
-
-### Capture uses stage, final commit, monotonic denial, and terminal stop
-
-The capture tool validates its arguments and stages the cloned value in a JavaScript `WeakMap` keyed by the immutable `ToolExecution`. This is an object-identity table whose key does not keep an abandoned execution alive. Validation failure becomes the ordinary `INVALID_ARGS` error that the model can correct within the turn.
-
-The scoped `tools/result` observer commits a direct native capture only when that exact execution's authoritative final result succeeds. A later call with a reused string call ID cannot reach the weak-keyed stage, and a post-execution block cannot promote it.
-
-```text
-# Native structured-output call
-structured_output.body(value, execution):
-  validate value against this child's schema
-  staged[execution] = clone(value)
-  return ordinary success
-
-on tools/result(execution, finalResult):
-  if execution is staged:
-    value = staged.remove(execution)
-    if finalResult succeeded:
-      captured = value
-```
-
-For a Code Mode SDK call, successful inner observation records a pending value against the child execution's opaque `parent` token instead of committing immediately. When the enclosing `run_code` reaches its own `tools/result`, the observer compares that pending token with the outer execution's `token` and commits only on success. A program error or outer post-policy block discards the pending value. This extra boundary is necessary because an inner side effect can succeed while the transport that is supposed to deliver the structured answer still fails.
-
-```text
-# Code Mode adds an outer transport commit
-on tools/result(innerStructuredCall, innerResult):
-  if innerStructuredCall is staged:
-    value = staged.remove(innerStructuredCall)
-    if innerResult succeeded:
-      pending = { outerToken: innerStructuredCall.parent, value }
-
-on tools/result(outerRunCodeCall, outerResult):
-  if pending.outerToken == outerRunCodeCall.token:
-    value = pending.value
-    pending = none
-    if outerResult succeeded:
-      captured = value
-```
-
-The native path has one final-result commit; Code Mode has two because the inner capability and outer transport can fail independently.
-
-Once a value is captured or pending on its outer transport, the scoped `ToolGuard` denies later calls in the same response. After a committed capture, the scoped `agent/turn-stop` ends the turn after ordinary continuation and steering have been folded. Together these boundaries prevent post-capture side effects and prevent a successful tool call from purchasing an otherwise automatic extra model step.
-
-The provider does not re-prompt a child that finishes without a committed capture. Such a run returns an error result with no `structured` value; requesting an output schema creates a requirement, not a guarantee that a failed child produces a value.
-
-## Correctness enforcement
-
-Scope mistakes are fail-open if they merely omit a carrier, so the implementation checks the contract at API, type, runtime, and repository-gate boundaries. None of these checks substitutes for using the correct runtime carrier.
-
-### API shape couples subjects that must agree
-
-`agentEvents(context, agent)` couples the dispatch carrier to the agent argument, `assembleContextFor(agent)` couples prompt facts to the scope selector, and `SessionStore.flush(session)` owns lookup of the carrier captured when the session entered the store. These helpers make a mismatched subject harder to express than the correct spelling.
-
-### Type markers cover every scoped event declaration
-
-Scoped agent, approval, tool, prompt, session, and subagent lifecycle events declare a `Scoped<T>` receiver. TypeScript therefore rejects a bare subject at typed dispatch sites, including the `subagent/start` and `subagent/end` paths whose scope is the delegating parent.
-
-The marker is compile-time only. JavaScript callers, casts, and direct use of Cordis's dispatch APIs can bypass it, which is why the runtime checks remain necessary.
-
-### Development invariants check actual dispatch
-
-The invariants plugin observes Cordis's internal dispatch path before listener delivery. For each scope-filtered event it requires a marked carrier and, where the event arguments expose the subject, verifies that the carrier key is the same object.
-
-Session and subagent payloads do not expose the owner key directly, so their invariant proves carrier presence while their service centralizes how the correct key is chosen. Additional invariants reject an assembly whose `agent` and `scope` disagree and a turn opened before `agent/session-start`.
-
-### Repository gates keep declarations and dispatchers aligned
-
-`verify-scoped-dispatch` compares the declared scoped events with the runtime invariant table, and the generated event matrix requires every declaration to have a recognized dispatcher. Source JSDoc is regenerated into the [event catalog](../../../cordis-catalog/events.md), keeping the exhaustive signature and mode reference in one place.
+Deployments that need non-escalation require a separate authority representation, propagation rule, and execution check. Parent-subset grants, creation-time authorization snapshots, explicit future-grant APIs, and generic capability/output/termination tags are outside this decision.
 
 ## Alternatives considered
 
-The rejected designs either split visibility from ownership, isolate the wrong boundary, or depend on extension ordering for correctness.
+The rejected designs either separate visibility from cleanup, cover only one registration family, duplicate shared infrastructure, or conflate lifetime ownership with inheritance.
 
 ### Pass an agent option to every registration
 
-An API such as `tools.register(definition, { agent })` leaves global registration as the leak-by-omission default and requires parallel scope plumbing in every registry. It also allows “visible to agent A, disposed with unrelated plugin B,” which the scoped context makes unrepresentable.
-
-### Create one isolated service graph per agent
-
-Service isolation chooses one registry instance for a context, while agent composition needs a merged view of deployment-global contributions plus one agent's additions. Per-agent graphs would duplicate shared adapters and force infrastructure such as persistence and UI bridges to discover every new instance.
-
-Isolation remains appropriate for independent applications. It is too coarse for collaborating agents inside one deployment.
-
-### Inherit the parent's scope into a child
-
-Hierarchical capability inheritance makes lifetime convenient but silently grants every child the parent's scoped tools and policies. A flat view plus an explicit parent-owned disposer separates the two questions: the parent owns the child without conferring its authority.
-
-### Publish the agent before running setup
-
-Early publication lets setup resolve the agent from global registries, but observers can see and act on a partially configured world. Rollback can remove entries but cannot retract external effects from already-run listeners.
-
-The unpublished callback already receives both the agent context and its `ctx.agent` association, so early global lookup is unnecessary.
-
-### Allow only synchronous setup
-
-Synchronous setup is simpler but cannot honestly compose a child plugin whose activation is asynchronous. In TypeScript, a callback returning a promise can also be assigned to a void-returning callback type, so declaring setup as synchronous would not reliably prevent accidental escape from the rollback boundary.
-
-Awaited setup makes the transaction explicit and keeps the first assembly behind it.
-
-### Enforce invariants with prepended waterfall listeners
-
-A prepended listener is not necessarily outermost: another plugin can prepend later, a short-circuit can skip inner work, and an outer wrapper can replace the result after delegation. The same issue appears in prompt assembly, tool authorization, result commit, and turn continuation.
-
-The owner-final APIs express the actual strength required by each rule: restore named canonical data, deny monotonically, observe the immutable final outcome, or stop after all ordinary continuation inputs are folded.
+An API such as `tools.register(definition, { agent })` repeats scope plumbing in every registry and permits visibility ownership to drift from cleanup ownership. Registering through `agent.ctx` makes both facts follow one Cordis effect owner.
 
 ### Filter events while keeping registries global
 
-Listener filtering prevents a hook from intercepting the wrong agent but does not scope tool schemas, executable lookup, prompt sections, variables, or Code Mode bindings. Persona, tool filtering, and concurrent structured schemas would still require global mutation.
+Listener filtering prevents the wrong hook from running but does not scope tool schemas, executable lookup, prompt sections, variables, or other registered data. Agent-local composition would still require temporary global mutation.
 
-### Add scope semantics to vendored Cordis
+### Create one service graph per agent
 
-Cordis already provides derived contexts, effect-owning fibers, and receiver-based listener filtering. The harness-level primitive combines those mechanisms without adding a framework fork whose synchronization cost would outlive this feature.
+The required view is shared deployment services plus one local registration layer. Per-agent graphs duplicate adapters and complicate shared persistence, provider registries, and application boot.
+
+### Inherit parent registration scopes
+
+Parentage describes lifetime and conversation lineage, not a universal merge policy. Hierarchical lookup makes unrelated services inherit accidentally and cannot define security without a separate authority model.
 
 ## Consequences
 
-The design makes per-agent composition ordinary and lifecycle-safe at the cost of a small scope runtime and several deliberately narrow final-policy APIs. The complexity is concentrated in services and dispatch helpers rather than repeated in every plugin.
+Contributors use one familiar pattern: register shared behavior through a plugin context, register local behavior through `agent.ctx`, select the real agent on operations, and dispose the returned handle. Setup is atomic from an observer's perspective, and teardown preserves local behavior until work stops.
 
-### Benefits
-
-The main benefit is one composition model across data, behavior, and lifetime: registrations follow their context, while service-owned finalizers protect only the invariants that require stronger ordering.
-
-- Plugin authors use the same registration APIs globally and per agent; only the context changes.
-- Registry-owned prompt schemas, executable lookup, Code Mode bindings, policy listeners, and UI presentation resolve from the same agent view.
-- Create and resume expose no partially configured registry entry during awaited setup.
-- Agent disposal revokes scoped contributions after the driver and all final or idle-injection session flushes have settled.
-- Structured output composes per child without global mutation or listener-order assumptions.
-- Existing unscoped plugins remain deployment-wide contributors and observers.
-
-### Costs and constraints
-
-The costs are concentrated in dispatch discipline, per-scope registry state, and explicit authority boundaries that are intentionally stronger than ordinary middleware.
-
-- Every scoped event dispatcher must carry the correct receiver; fused helpers, type markers, invariants, and gates exist because omission would otherwise deliver only to global listeners.
-- `agent.ctx` is capability-bearing. Its available services come from the agent loop's injected context, so holders receive that deliberate service surface.
-- Registries maintain per-scope maps and perform a global-plus-one-layer merge for the agent lifetime.
-- The dispatch carrier is proxy-shaped and not identity-equal to its subject, even though method calls and property access behave like the subject.
-- Flat scopes do not inherit parent capabilities; a desired child capability must be global or explicitly registered for the child.
-- `run_code` is protected transport infrastructure rather than a filterable end capability, so a policy that must forbid programs denies execution at the tool-policy layer instead of removing the transport from a Code Mode prompt.
-- Prompt protection restores named canonical contributions and their anchor placement, not the entire assembly; unprotected output remains extensible, while a globally protected section name is deliberately unavailable for scoped shadowing.
-- Terminal turn stopping has authority to discard pending steering. That power is appropriate for owner-enforced terminal protocols and too strong for ordinary cooperative continuation policy.
-- Programmatic `ctx.agents.create()` and `ctx.agents.resume()` are asynchronous because they await setup. The config-only `ctx.agentLoop.create()` path has no setup callback and remains synchronous.
-- Ordered composition requires both an exact raw scope disposer and a shared public quiescence promise; the dual surface reflects two distinct Cordis lifecycle requirements.
-
-### Deliberate boundaries
-
-The scope primitive is generic, but this decision applies it only where one agent needs a coherent registration view: tools, prompt state, scoped events, sessions, and in-process subagent composition. `agent.ctx` does not automatically scope every service call; filesystem policy, LLM interception, background subagent state, and future registries retain their existing seams until their own designs explicitly adopt the context rule.
+The cost is explicit subject selection, asynchronous programmatic creation, and service-specific scope adoption. Flat registration scope is intentionally not authority, and subagent composition controls remain a separate feature rather than hidden scope semantics.
diff --git a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md
new file mode 100644
index 0000000000..786dce250e
--- /dev/null
+++ b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md
@@ -0,0 +1,393 @@
+# RFC: Agent-scope runtime design and correctness
+
+Status: implemented
+
+## Problem
+
+The [agent-scope contract](2026-07-08-agent-scope-contexts.md) is simple for contributors: register through `agent.ctx`, resolve one global-plus-agent view, publish only after setup, and retain the scope until work stops. The runtime must preserve that contract across a cooperative plugin framework, asynchronous creation, reentrant listeners, durable session commits, and worker or process failure.
+
+The main design risk is adding a second mechanism for every race. Separate reservations, readiness sentinels, cancellation relays, snapshot layers, and protection registries can mirror the same fact until no reader can tell which one is authoritative. That machinery also encourages the runtime to treat trusted typed calls as hostile serialization boundaries.
+
+The implementation needs enough state to preserve real ownership and settlement boundaries, but no more. A correctness reviewer must be able to follow one fact from acceptance through publication and teardown without reconciling parallel representations.
+
+## Decision
+
+The runtime uses one mechanism per independent fact. Scope routing has an opaque carrier; each live registry object has one entry record; each create or resume operation has one transaction; typed same-process calls borrow readonly values; real data boundaries materialize once; and worker/process code retains separate terminal and quiescence state only where different owners can genuinely race.
+
+The design can be skimmed as seven choices:
+
+| Problem | Authoritative mechanism |
+|---|---|
+| Select global plus one agent's registrations | Opaque scope key and routing carrier |
+| Own one live agent or session | One registry entry captured by its disposer |
+| Coordinate create/resume | One `AgentCreationTransaction` |
+| Protect durable, queued, model, or wire data | Materialize once at that boundary |
+| Pass typed values inside one process | Readonly borrowed contract |
+| Preserve an owner's final prompt/tool policy | Contribution-owned finality and one final observer point |
+| Coordinate subagent, worker, and process shutdown | One cancellation signal plus the independent terminal/quiescence facts of that boundary |
+
+The rest of this RFC expands those choices in dependency order. It first explains the Cordis mechanics, then scope routing, creation and session commit, tools and prompts, subagents and workflows, and finally the checks that make the reasoning executable.
+
+The [July 8 RFC](2026-07-08-agent-scope-contexts.md) remains the contributor contract. The separate [subagent composition-controls RFC](../feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) owns `persona`, `toolFilter`, and `maxDepth`; this document discusses only how their setup fits the lifecycle.
+
+## Cordis model: context, fiber, effect, receiver, and waterfall
+
+Five Cordis ideas are required to understand the implementation. A context selects services and registration ownership; a fiber is one live plugin or child lifecycle; an effect attaches cleanup to a fiber; an event receiver selects listeners; and a waterfall lets listeners transform or veto an operation in sequence.
+
+### A context is an ownership path through one service graph
+
+All agents share one Cordis service graph. A derived context does not clone `ToolRegistry`, `SystemPrompt`, persistence, or model adapters; it changes how registrations made through that context are tagged and which effects own their cleanup.
+
+`agent.ctx` is such a derived context. Service calls still reach the shared instances, while a registration can inspect its calling context and store a contribution under the nearest scope key. Ordinary plugin contexts carry no scope key and therefore register globally.
+
+### Fibers and effects make cleanup structural
+
+A Cordis fiber is the live instance created when a plugin or child context is activated. Its state records whether that lifecycle is active, unloading, failed, or disposed. `ctx.effect()` and `ctx.on()` return disposers and also attach those disposers to the registering fiber, so unloading a plugin or agent scope removes everything registered through that context without a separate inventory.
+
+The vendored Cordis fiber implementation establishes ownership before arbitrary setup or `internal/plugin` observers run. A reentrant unload can see the child fiber or effect that has started, reject effects added after unload begins, and join cleanup already started through a public single-shot disposer. Teardown observers are contained individually so one callback cannot prevent structural cleanup.
+
+These are framework lifecycle guarantees rather than agent-specific policy. Agent creation depends on them because setup can activate arbitrary plugins and synchronously reenter owner disposal.
+
+### Receivers route listeners; waterfalls compose decisions
+
+Cordis filters listeners using the dispatch receiver (`this`), while harness listeners need an explicit agent, execution, request, or other subject. `Scoped<T>` marks the receiver expected by a scoped event declaration, but the runtime carrier deliberately exposes no subject API.
+
+Product helpers therefore construct the carrier and pass the domain subject separately. This prevents listener routing from becoming an alternate object model and keeps event signatures understandable without knowledge of carrier internals.
+
+A Cordis waterfall is middleware-style dispatch. Each listener receives `next()`: calling it delegates to the remaining listeners and base operation, while returning without it vetoes or replaces the downstream result. Waterfalls power prompt assembly and tool policy; ordinary emit events notify synchronously, and parallel events await all listeners without a veto result.
+
+## Scope routing: one opaque key selects one layer
+
+The scope package implements the smallest object needed for Cordis routing. Its carrier holds only a composed service filter and scope predicate, while the package records the opaque key privately and exposes the scope fiber's quiescent disposer separately.
+
+### Scope identity uses object identity
+
+A `ScopeKey` is an opaque object compared by identity. The harness uses the live `Agent` as its own key, but the primitive is domain-neutral and supports other scoped owners.
+
+`createScope(parent, key)` returns a scope whose `ctx` shares the parent's services and whose effects are tagged with that key. `scopeOf(ctx)` reads the nearest registration key. `scopeTarget(base, key)` creates the event receiver whose filter preserves the base receiver's Cordis service filter, then admits unscoped listeners and listeners with that exact key.
+
+The receiver is a small carrier rather than a transparent proxy for the domain object. Code that needs the agent receives the explicit event argument; code that needs registration ownership receives `agent.ctx`.
+
+### Registry reads overlay one exact map
+
+Scope-aware registries store global contributions separately from identity-keyed local contributions. A read resolves the global layer and at most one local layer; it never traverses parentage.
+
+Each service retains its domain rule. Named prompt values and tools use local shadowing, tool restrictions filter globals before local tools are added, and events select listener audiences rather than registered data. Scope supplies identity and ownership, not a universal merge algorithm.
+
+### Fused dispatch helpers prevent subject drift
+
+`agentEvents(context, agent)` constructs the agent's carrier and injects the same agent as the event subject. Session, tool, approval, prompt, and subagent services likewise derive routing from the object they already own instead of accepting an unrelated key.
+
+The type marker rejects ordinary bare-receiver mistakes, and development invariants cover direct JavaScript or casted dispatch. The subject remains explicit because routing correctness and useful event data are different concerns.
+
+## Agent creation: one transaction owns the complete operation
+
+Create and resume are one asynchronous lifecycle with several phases, not several lifecycles. `AgentCreationTransaction` owns caller and factory liveness, optional cancellation, private resources, publication, rollback, and the memoized teardown observed by every owner.
+
+### Registry entries are the only live identity records
+
+AgentRegistry and SessionStore each keep one entry per live object. The entry holds the stable ID, object, scoped carrier, and the small amount of publication or append state that belongs to that object.
+
+A detach closure captures its exact entry. It deletes only when the map still points to that entry, so an old disposer cannot delete a later object that reuses the same ID. No registry rereads a mutable caller object to decide identity.
+
+There is no reservation API. Caller-supplied IDs are admitted at final entry. Concurrent same-ID operations may both complete private setup; exactly one final `enter()` succeeds, and every loser rolls its private resources back. Sequential reuse is valid after the earlier disposer reaches quiescence.
+
+### The transaction owns preparation before awaiting it
+
+The transaction is installed under both the calling Cordis context and the concrete AgentLoop factory before persistence load or setup can suspend. It also observes an optional create/resume signal until the public operation settles.
+
+Create prepares a new Session. Resume loads and validates the persisted Session before preparing the same live session identity. Both paths then build the scope, agent, and driver and invoke the same setup/publication algorithm.
+
+The factory stores concrete trace targets but invokes them through a caller-bound Cordis trace. This preserves dependency origin and caller ownership without stacking trace proxies.
+
+### Setup is trusted composition inside a private world
+
+Setup receives the full child context and may await plugin activation. It can register tools, prompt sections, restrictions, listeners, and other effects, but the public contract does not support driving or publishing the in-flight agent through casts or internal registry calls.
+
+The transaction races asynchronous load and setup against deactivation rather than waiting forever for a promise owned by external code. If cancellation or owner unload wins, public creation rejects after transaction-owned cleanup even when the external promise never settles.
+
+### Publication has one ordered commit path
+
+Publication admits and announces resources in the order required by observers:
+
+1. Enter the session.
+2. Enter the agent.
+3. Announce `session/created`.
+4. Announce `agent/created`.
+5. Enable public driving.
+6. Emit `agent/session-start`.
+7. Start the driver.
+
+The agent never drives before both registries and creation notifications agree. A synchronous listener may veto or dispose an owner; the transaction records publication in progress and waits for that callback stack to unwind before teardown continues. Every creation announcement that begins has a matching disposal announcement during rollback.
+
+The sequence diagram isolates the non-obvious race: a synchronous creation listener can request disposal while the publication call stack still owns both registry entries. Teardown must deactivate immediately but wait for that stack to unwind before stopping and detaching anything.
+
+```mermaid
+sequenceDiagram
+  participant Tx as AgentCreationTransaction
+  participant Registries
+  participant Listener as Synchronous listener
+  participant Driver
+
+  Tx->>Tx: mark publication in progress
+  Tx->>Registries: announce agent/created
+  Registries->>Listener: invoke inside the same call stack
+  Listener->>Tx: dispose reentrantly
+  Tx->>Tx: deactivate, teardown waits for publication
+  Tx-->>Listener: disposal request accepted
+  Listener-->>Registries: return
+  Registries-->>Tx: announcement unwound
+  Tx->>Tx: resolve publication settlement
+  Tx->>Driver: stop and drain
+  Tx->>Registries: detach agent, then session
+  Tx->>Tx: dispose scope and resolve teardown
+```
+
+### Teardown preserves work before revoking registrations
+
+Every teardown request joins one memoized path. The order is:
+
+1. Deactivate creation or driving and let synchronous publication finish.
+2. Stop and drain the driver, including idle injection flushes.
+3. Detach the agent.
+4. Detach the session.
+5. Dispose the agent scope.
+6. Retire transaction ownership tracking.
+
+This order lets final agent and session events use the matching scoped listeners and keeps persistence observers attached through the final flush. Scope disposal comes last because registration revocation is the externally visible lifetime boundary.
+
+## Session append: materialize, validate, commit, notify
+
+Session events cross a durable boundary, so append owns their data. The rest of the algorithm uses one attached entry and one commit point.
+
+### Durable data is materialized once
+
+Session headers, seeds, and appended events are lossless JSON data. The Session constructor or append path materializes and validates them before storage and exposes frozen snapshots, so later caller mutation cannot change persistence, replay, or model reconstruction.
+
+This is a real ownership boundary: the values leave the caller, may be persisted, and must reconstruct the same request later. It is intentionally stricter than a typed same-process callback or registry definition.
+
+### Pre-commit listeners can veto; post-commit observers cannot
+
+Append follows one sequence:
+
+1. Materialize the durable event and surface intent.
+2. Claim the SessionEntry and reject reentrant append on that entry.
+3. Resolve scoped callbacks and run internal invariant validation.
+4. Push exactly once; this is the commit point.
+5. Notify each observer independently, containing synchronous and asynchronous failures.
+6. Release append state and honor a detach requested during publication.
+
+No observer error makes a committed event look uncommitted, and one bad listener cannot starve later listeners. Session invariants stage their transition before commit and apply it only when the same event reaches the contained post-commit observer.
+
+`flush()` starts every persistence listener and awaits every result before reporting failure. This deliberate all-settled behavior prevents a synchronous failure from starving another backend or final flush.
+
+## Trust boundaries: copy only when ownership actually changes
+
+The runtime distinguishes typed in-process contracts from serialization and durability boundaries. This is the main simplification rule for values and callbacks.
+
+| Boundary | Ownership rule |
+|---|---|
+| Typed service/plugin call in the same process | Borrow readonly values and callbacks |
+| Parsed plugin configuration or external file | Validate semantic and structural input |
+| Queued inbox message | Materialize before asynchronous consumption |
+| Model/tool JSON input or output | Materialize at the model/tool boundary |
+| Durable session or persistence data | Materialize and validate before commit |
+| Worker, process, or wire message | Serialize, validate, and own the decoded value |
+
+Tests that fabricate hostile getters, replace typed callbacks after handoff, or cast fake service objects do not define a production contract by themselves. The runtime keeps checks where data crosses a parser, queue, model, durable, file, worker, process, or wire boundary and relies on readonly types plus plugin discipline inside the trusted process.
+
+Callback containment is separate from data ownership. Listeners are arbitrary extension code and can throw even when their arguments are trusted; publication and post-commit paths still contain failures according to their event contract.
+
+## Tools and prompts: one view, one execution identity, explicit finality
+
+Tool presentation and execution share one private resolver, while prompt/tool owners declare the few contributions that cooperative middleware may not alter finally. No second registry mirrors ownership.
+
+### One resolver defines the tool view
+
+The private resolver applies the current presentation mode, live global restrictions, exact local overlay, and local shadowing. Schemas, lookup, execution, Code Mode SDK generation, restriction validation, and owner-final name derivation all use that resolver or its pre-restriction global-name view.
+
+The [subagent composition-controls RFC](../feature/2026-07-12-subagent-persona-tool-filter-and-depth.md#tool-filtering-is-one-live-global-view-rule) owns the user-visible allow/deny semantics. The implementation requirement is agreement: a filtered-away global cannot remain executable through a different lookup path, and a locally shadowed definition is the same definition presented and executed.
+
+`ToolRestriction` accepts readonly allow/deny names and compiles them into internal sets. Multiple restrictions intersect. Public `visible()` and `knownNames()` methods are unnecessary because only the registry needs the intermediate views.
+
+### Tool execution owns identity and boundary materialization
+
+The registry assigns every execution a fresh branded `Symbol` token. Nested Code Mode calls carry the outer token as `parent`, so structured output can correlate an inner capture with its enclosing `run_code` result by identity.
+
+A fresh registry-assigned Symbol provides collision-free execution identity without a WeakSet membership registry. Callers cannot supply the execution's own token through `ToolExecutionInput`; they only receive the pipeline-owned `ToolExecution` after the registry creates it. This is a trusted typed contract, not a runtime defense against arbitrary casts or JavaScript callers.
+
+Arguments are materialized once where model/tool JSON enters the pipeline. Pre-, around-, and post-execute listeners operate on the typed execution and decisions. Call ID correlation, approval, monotonic guards, and Code Mode nesting remain explicit relational checks.
+
+After the last post-execute listener, the registry materializes and freezes the accepted final result once. Every `tools/result` observer receives that exact committed object, and observer failures are awaited and contained individually. An outer pipeline failure is normalized into a committed error result, so observers can discard staged work against the same authoritative boundary.
+
+### Contribution-owned finality protects only named invariants
+
+Most prompt assembly remains a cooperative waterfall: listeners may reorder, replace, or remove ordinary sections and schemas. A contribution sets `ownerFinal: true` only when its owner must retain final control over that named entry.
+
+Prompt sections carry owner-finality directly. Tool definitions carry it through the tool provider's `ownerFinalNames`, including canonical absence when a presentation mode intentionally omits a tool. `tools:sdk`, `run_code`, and structured-output instruction/schema contributions use this flag.
+
+An owner-final name is reserved across the global and scoped layers: a scoped shadow cannot be added beneath a global owner-final contribution, and a global contribution cannot become owner-final while any scoped shadow already exists. This makes the registered owner definition unambiguous before assembly begins.
+
+Assembly takes one private canonical snapshot before the waterfall. After listeners finish, it restores only owner-final names to their canonical presence, absence, definition, and relative anchor among surviving entries. Unrelated listener additions and reordering remain untouched.
+
+Attaching finality to the owning contribution has two benefits. Registration and cleanup cannot drift from a separate protection registry, and the reader can see why a particular prompt/tool entry is special at its definition.
+
+### Structured output commits only authoritative outcomes
+
+Structured output uses the final prompt/tool boundaries as a two-phase commit. The child-scoped `structured_output` tool and its instruction are owner-final; the tool body validates a candidate and stages it by the current `ToolExecution`, but successful capture is decided only by immutable `tools/result` observations.
+
+For a native call, the observer deletes the stage and commits its value only when that exact execution's final result succeeds. A post-execute block or outer pipeline failure therefore cannot leave a captured value behind.
+
+For a Code Mode SDK call, the inner successful result records `{ parentToken, value }` rather than committing. The observer waits for the `run_code` execution whose token matches `parentToken` and commits only if that outer final result also succeeds. Program failure, runtime abort, or outer post-policy denial discards the pending value.
+
+Once a value is pending or committed, a scoped monotonic guard denies later tool calls. After commit, the ordinary serial `agent/turn-stop` listener returns a stop decision after continuation and steering have already folded. A schema-validation failure remains an ordinary `INVALID_ARGS` tool error and leaves the child able to retry within the same turn.
+
+Pure Code Mode omits `structured_output` from native wire schemas and exposes it through the generated SDK. Contribution-owned finality preserves that canonical absence, preventing an assembly listener from fabricating a second native route while keeping the instruction and SDK declaration intact.
+
+### Four final boundaries have four narrow powers
+
+Owner-final behavior is not a general priority system. Four domain owners need four different one-way powers after cooperative extension points:
+
+| Boundary | Final power | Why ordinary listener order is insufficient |
+|---|---|---|
+| Prompt assembly | Restore named canonical contributions | A later listener can remove or replace an invariant schema or instruction |
+| Tool pre-policy | Deny monotonically | A later listener must not re-allow an already denied call |
+| Tool result | Observe the immutable committed outcome | Structured output must commit only the result that actually escaped the pipeline |
+| Turn continuation | Stop after ordinary continuation folding | A committed terminal output must end the turn |
+
+`ToolGuard` remains the monotonic policy registry. Final tool observation is the contained `tools/result` point described above. Terminal structured output listens on the ordinary serial `agent/turn-stop` fold after normal continuation and steering decisions; no public `strictSerial()` dispatcher is needed for the typed listener contract.
+
+### Skill and approval services trust typed callers
+
+Skill registry definitions and approval policies are readonly same-process contracts. Their services do not clone callback objects or defend against post-handoff callback replacement.
+
+Skill still validates external skill files and parsed provider output, routes catalogs through the calling agent's tool view, and disposes registrations exactly. Approval still resolves policy, observes cancellation, routes `approval/request` by `request.agent`, records the durable audit pair, and contains answerer and post-commit observer failures.
+
+## Subagents: readiness is the start promise
+
+Subagent startup has one ownership transfer. The provider owns partial resources until its start promise fulfills with a ready published run; the caller owns the returned run and must dispose it.
+
+### The service contract has one cancellation channel
+
+`SubagentProvider.start()` and `SubagentService.start()` return `Promise<SubagentRun>`. The promise fulfills only after the backend has established the child it promises, so callers and `subagent/start` observers never need a second `run.started` readiness promise.
+
+`SubagentStartRequest.signal` is required. Aborting it requests cancellation during startup and after readiness. `SubagentRun.dispose()` also requests cancellation and awaits quiescence. There is no separate public `run.cancel()` channel.
+
+Optional `sendMessage()` supports a live backend that can accept steering. Optional `resume()` returns `Promise<SubagentRun>` because the resumed child has the same asynchronous readiness boundary.
+
+The service validates provider capabilities and request semantics before calling the provider. A provider rejection cleans any partial resources before the rejection escapes and emits no `subagent/start`/`subagent/end` pair. After fulfillment, the service attaches result observation, emits scoped start, and returns the run. Provider removal prevents later starts but does not revoke a run already accepted by the provider.
+
+### In-process providers reuse the core transaction
+
+Spawn and fork share one in-process driver. It creates the child through `parent.ctx`, passes the required signal into the core creation transaction, and installs persona, tool restriction, and structured-output contributions during unpublished setup.
+
+The provider awaits creation and returns only the published run. At the handoff, core creation detaches its creation-only abort listener; the provider immediately rechecks the signal before installing the live-run listener, so an abort in that narrow interval disposes the new handle instead of escaping cancellation. Parent teardown follows the child because the operation belongs to `parent.ctx`; provider unload blocks new starts but does not become a second revocation owner for accepted runs. The run disposer cancels the child and awaits the AgentHandle's ordered teardown.
+
+Spawn uses an empty session seed. Fork uses a validated completed-turn prefix. Conversation seeding changes history only and does not import scope, tools, services, or authority.
+
+### ACP providers own the process until readiness or cleanup
+
+An ACP provider crosses a real process and wire boundary, so it retains validation, environment scrubbing, message serialization, abort/process races, and kill-to-exit quiescence.
+
+Start resolves only after `initialize` and `newSession` succeed. Abort, spawn failure, RPC failure, or invalid startup response reaps the process before rejection. After readiness, result maps the ACP prompt outcome and streamed output; dispose requests cancellation, closes the connection, and awaits process exit through one memoized path.
+
+## Workflows and ACP UI: retain only independent async facts
+
+Worker and editor bridges need more state than same-process registries because messages, process death, and rendering can settle independently. Their state is organized around those real facts rather than duplicate cancellation protocols.
+
+### Workflow children are pending starts or published records
+
+The workflow host keeps pending provider-start promises and published child records. A child moves from pending to published only when async `SubagentService.start()` fulfills; rejected starts clean their partial provider work and produce no child lifecycle pair.
+
+One host-owned AbortController supplies the required signal to pending and live children. Closing workflow admission aborts that signal, so there is no duplicate `ChildCancel` worker RPC or explicit host-side `run.cancel()` fanout. Quiescence waits for both pending starts and published child disposal.
+
+The worker boundary still serializes requests and outcomes. The host retains first-terminal-outcome arbitration, exact child accounting, worker-death handling, grace termination, late/duplicate message rejection, and bounded cleanup because result receipt, worker exit, and child quiescence are genuinely independent facts.
+
+### Terminal result and physical cleanup remain separate
+
+The workflow result records the first accepted terminal outcome according to the public precedence rules. Cleanup can continue after that result is chosen: live children still need disposal, a worker still needs termination, and a slow external backend may outlive the configured grace bound.
+
+Public disposal claims its memoized promise before invoking callbacks. Worker death closes admission before processing any queued late child request, synthesizes missing lifecycle ends, and starts child/process cleanup without rewriting an outcome already claimed.
+
+### ACP prompt settlement does not depend on rendering success
+
+The ACP UI correlates a prompt with its observed turn directly. It does not scan from a `logWatermark` or use session status as a second reconciliation oracle.
+
+Prompt handling settles correlation in a `finally` around transcript rendering. A rendering failure can fail presentation, but it cannot skip prompt settlement or leave the session permanently in flight. Concurrent loads of the same persisted caller-supplied session ID remain excluded because that is a real persistence identity race, not a UUID collision concern.
+
+## Correctness enforcement
+
+The design is enforced at types, runtime escape points, generated contracts, and behavioral tests. No one layer is asked to prove what it cannot observe.
+
+### Types make the ordinary path hard to misuse
+
+Readonly contracts describe borrowed same-process values. `Scoped<T>` marks event receivers, `agentEvents()` fuses carrier and subject, tool inputs omit registry-owned tokens, and subagent async return types expose readiness directly.
+
+TypeScript cannot govern JavaScript casts, direct Cordis dispatch, process messages, or durable files, so runtime enforcement remains at those escape points.
+
+### Runtime invariants cover cross-service facts
+
+The invariants plugin verifies that every declared scoped event uses a marked carrier and that event families exposing a subject use the matching key. Session trace validation stages before append commit and advances after the same event commits.
+
+The plugin does not police trusted setup by scanning registries or reject prompt assembly objects fabricated through casts. Those checks would turn composition contracts into speculative runtime machinery without protecting a real external boundary.
+
+### Generated artifacts keep public contracts aligned
+
+The event catalog, service catalog, producer/consumer matrix, configuration catalog, module graph, tool catalog, and type-equivalence blocks are generated or freshness-gated from source. `verify-scoped-dispatch` keeps the declared scoped-event set aligned with runtime invariant coverage.
+
+Behavioral tests pin scoped routing and disposal, final-entry collision cleanup, publication rollback, ordered quiescence, durable pre/post-commit behavior, live tool filtering across presentation and execution, owner-final Code Mode and structured output, async subagent startup and signal cancellation, worker terminal arbitration, ACP settlement, and process teardown.
+
+## Alternatives considered
+
+The [July 8 RFC](2026-07-08-agent-scope-contexts.md#alternatives-considered) owns alternatives to the public flat-scope contract. The alternatives here concern implementation shape.
+
+### Use a transparent proxy as the scope carrier
+
+A proxy that impersonates the subject must preserve property, callable, constructable, private-field, descriptor, and proxy-invariant behavior that listener routing never needs. A small opaque carrier keeps the filter and key while the explicit event argument carries the subject.
+
+### Reserve agent and session IDs before setup
+
+Reservations prevent duplicate private setup work but require cross-service capabilities, release ordering, abandoned-reservation cleanup, and prepared-object binding. IDs are caller-supplied and concurrent reuse is caller error; final entry can choose the winner while the losing transaction rolls back cleanly.
+
+### Snapshot every typed same-process argument
+
+Universal copying defends against stateful getters and callers that violate readonly contracts, but it adds allocation, duplicated validators, and paths that can forget to copy. Materialization belongs at parser, queue, model, durable, worker, process, and wire boundaries where ownership actually changes.
+
+### Give readiness, cancellation, and disposal separate controllers
+
+Parallel sentinels can all mirror whether one operation is live. One transaction or start promise owns the operation; separate promises remain only where publication unwind, external work, terminal result, and physical quiescence can settle independently.
+
+### Keep synchronous subagent start plus `run.started`
+
+This splits provider acceptance from readiness and forces every consumer to register a partial run, attach result observation, await readiness, and clean up readiness failure. An async start promise makes provider-to-caller ownership transfer the readiness boundary itself.
+
+### Keep a separate prompt-protection registry
+
+A protection registration mirrors the names and lifetime already owned by prompt sections and tool definitions. `ownerFinal` keeps the exceptional policy on the contribution and lets assembly derive the canonical set directly.
+
+### Remove worker/process lifecycle guards with same-process hardening
+
+Worker messages, process death, and durable input do cross ownership and serialization boundaries. First-outcome arbitration, validation, environment scrubbing, and quiescent process cleanup remain necessary even though hostile same-process callback machinery does not.
+
+## Consequences
+
+The implementation is smaller and its proof follows the same shape as its ownership graph. One key selects a layer, one entry owns a live registry object, one transaction owns creation, one resolver owns a tool view, and one async promise transfers subagent ownership.
+
+### What the design guarantees
+
+- A scoped contribution is visible only in its exact agent view and is disposed with that scope.
+- Create and resume expose no partially configured handle; final-entry losers and publication failures clean every prepared resource.
+- Disposal retains scoped listeners and persistence through driver drain and final session work, then revokes the scope.
+- Durable, queued, model, worker, process, and wire values are owned at their real boundary; typed same-process values follow readonly contracts.
+- Tool presentation and execution resolve the same live view, and committed results have one immutable observation point.
+- Owner-final prompt/tool contributions survive cooperative assembly without freezing unrelated middleware behavior.
+- Subagent start returns only a ready run, required signals cancel pending or live work, and disposal reaches the backend's quiescence contract.
+- Worker/process result precedence and cleanup remain correct under death, late messages, and bounded teardown.
+
+### Costs and limits
+
+Scope-aware services still maintain global and identity-keyed maps, and operations must carry their real agent explicitly. Async create/resume and subagent start require callers to await ownership transfer and dispose returned handles.
+
+The design trusts typed plugins in the same process. It does not defend against arbitrary casts, stateful getters, mutation that violates readonly contracts, or a plugin deliberately using ambient service access outside the supported composition API.
+
+The [security and authority non-goal](2026-07-08-agent-scope-contexts.md#security-and-authority-are-non-goals) remains fundamental. These mechanisms prove registration composition, publication, and lifetime ownership; they do not prove confinement or parent-to-child non-escalation.
diff --git a/docs/rfc/implemented/feature/2026-06-15-code-mode.md b/docs/rfc/implemented/feature/2026-06-15-code-mode.md
index be18e94ae0..16f42104be 100644
--- a/docs/rfc/implemented/feature/2026-06-15-code-mode.md
+++ b/docs/rfc/implemented/feature/2026-06-15-code-mode.md
@@ -24,11 +24,11 @@ Three decisions, each elaborated in its own section below:
 
 `ToolRegistry` gains a schemastery-validated config (`static Config`), its first: `mode: 'native' | 'code' | 'both'`, default `'native'`. A deployment flips it from `cordis.yml` (`tools: { mode: code }`) — no code edit, per the no-hardcoded-tunables convention.
 
-**Wire tool list = the registry's contribution.** The registry feeds assembly through a mode-aware provider: `'native'` contributes every capability visible to that assembly scope, `'code'` contributes only `run_code`, and `'both'` contributes both. Because [`PromptAssembly.tools` is the single source the loop's request header snapshots](../../../../packages/core/system-prompt/src/index.ts), the presentation is logged and reconstructable. The reserved transport is not a capability: it lives outside global/scoped registration and restriction layers, cannot be registered or shadowed, and cannot be named by `ctx.tools.restrict()`. `systemPrompt.protect()` restores its canonical schema after the complete assembly waterfall, so listeners cannot strip, replace, duplicate, or fabricate it. The mode governs only the registry's contribution; a deployment that deliberately installs another direct `systemPrompt.tools()` provider still owns that provider's schemas.
+**Wire tool list = the registry's contribution.** The registry feeds assembly through a mode-aware provider: `'native'` contributes every capability visible to that assembly scope, `'code'` contributes only `run_code`, and `'both'` contributes both. Because [`PromptAssembly.tools` is the single source the loop's request header snapshots](../../../../packages/core/system-prompt/src/index.ts), the presentation is logged and reconstructable. The reserved transport is not a capability: it lives outside global/scoped registration and restriction layers, cannot be registered or shadowed, and cannot be named by `ctx.tools.restrict()`. Its `ToolDefinition` declares `ownerFinal: true`, so the provider reports the name as final and assembly restores its canonical schema or canonical absence after the waterfall. The mode governs only the registry's contribution; a deployment that deliberately installs another direct `systemPrompt.tools()` provider still owns that provider's schemas.
 
 **Interaction with `toolOrder`, stated up front:** a configured `systemPrompt.toolOrder` naming native capabilities rejects every assembly under `mode: 'code'`, because those names are outside that mode's wire-validation universe. This is correct behavior, not a bug: a deployment using Code Mode updates its order config or drops it.
 
-**The SDK prompt section.** Under `'code'` and `'both'` the registry registers one lazy prompt section (`tools:sdk`, in the 100–199 tool-guidance order band) whose thunk regenerates, for each assembly scope, a TypeScript declaration of every visible end-capability tool plus fixed usage instructions. It uses the same visibility resolver as lookup and execution, so scoped grants and shadows appear while restricted globals disappear; the reserved `run_code` transport itself is excluded. The thunk emits tools in lexicographic name order, so an unchanged visible set produces byte-identical text, and `systemPrompt.protect()` restores the canonical section after every assembly listener. Because that protection is global, it also reserves the `tools:sdk` registry name against scoped section shadows; otherwise scoped-over-global resolution could make a later shadow look canonical before restoration.
+**The SDK prompt section.** Under `'code'` and `'both'` the registry registers one lazy prompt section (`tools:sdk`, in the 100–199 tool-guidance order band) whose thunk regenerates, for each assembly scope, a TypeScript declaration of every visible end-capability tool plus fixed usage instructions. It uses the same visibility resolver as lookup and execution, so scoped grants and shadows appear while restricted globals disappear; the reserved `run_code` transport itself is excluded. The thunk emits tools in lexicographic name order, so an unchanged visible set produces byte-identical text. The section declares `ownerFinal: true`, which restores its canonical contribution after every assembly listener and reserves the global name against scoped shadows.
 
 **Codegen.** A pure `jsonSchemaToTs(schema)` module inside `dsh-tools` (sibling of `json-schema.ts` — `schemas()` and the SDK are two projections of the same store) maps the JSON-Schema subset the `defineTool` DSL emits (object/string/number/boolean/array, `properties`, `required`, string `enum` → literal union, nested objects, array `items`, `description` → JSDoc) to a TS type literal. It is **total**: any construct outside that subset (`$ref`, `oneOf`/`anyOf`, `integer`, future MCP shapes, …) degrades to `unknown` without throwing. Because `ToolSchema.name` is an arbitrary string, the SDK is declared as one object constant — `declare const tools: { "some-mcp-tool"(args: …): Promise<string>; bash(args: …): Promise<string>; … }` — quoted keys make every name reachable with no sanitization or alias-collision logic. Typing is advisory (the runtime executes type-stripped JS); the instructions say so.
 
diff --git a/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md b/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md
index 474abd2c67..c24c6102d9 100644
--- a/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md
+++ b/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md
@@ -35,9 +35,9 @@ A new package group `packages/subagent/`:
 | `@deepseek-ai/dsh-subagent-mock` | support: a scripted provider for testing the seam through the real load path |
 | `@deepseek-ai/dsh-tool-subagent` | consumer: the model-facing `subagent` tool over `ctx.subagents` |
 
-### The primitive: `start → SubagentRun`
+### The primitive: async `start → SubagentRun`
 
-A provider exposes `start(request) → SubagentRun`. The run carries `started` (the provider's publication/readiness promise), `result` (the terminal `SubagentResult`), `cancel()`, and `dispose()`. The transport-neutral verb is **`start`**; "spawn" is reserved for the in-process `dsh-subagent-spawn` backend's identity, not the service verb. The service's `start(name, request)` resolves the named provider, validates capabilities, delegates, and waits for `started` before emitting the paired `subagent/start` / `subagent/end`; an attempt that never establishes a child emits neither lifecycle event. For an in-process backend, readiness means the child is published in `ctx.agents`; for ACP it means the remote session exists.
+A provider exposes `start(request) → Promise<SubagentRun>`. Promise fulfillment is the publication/readiness and provider-to-caller ownership boundary: for an in-process backend the child is already published in `ctx.agents`, and for ACP the remote session already exists. `SubagentStartRequest.signal` is the single cancellation channel before and after readiness; `SubagentRun` carries the terminal `result` and a `dispose()` method that cancels remaining work and awaits quiescence. The transport-neutral verb is **`start`**; "spawn" is reserved for the in-process `dsh-subagent-spawn` backend's identity, not the service verb. A rejected start cleans provider-owned partial resources and emits neither subagent lifecycle event.
 
 ### Two kinds of optional capability, discovered two ways
 
@@ -46,7 +46,7 @@ A provider exposes `start(request) → SubagentRun`. The run carries `started` (
 
 ### Fork vs. fresh are separate backends, not a flag
 
-Rather than a `context: 'fresh' | 'fork'` request field, the distinction is the provider's identity: `dsh-subagent-spawn` (fresh, isolated, own system prompt) and `dsh-subagent-fork` (seeded from the parent's log) are two registered providers. You pick behavior by picking a provider — consistent with the registry being the selection mechanism. The fork backend seeds only a **balanced, completed-turn prefix** of the parent log: at tool-execute time the parent's turn is open (it holds the `assistant/message` and the dangling spawn `tool/call` with no `tool/result`), and seeding that raw prefix would give the child an unbalanced turn the [invariants](../../../../packages/support/invariants/src/index.ts) freeze-check rejects.
+Rather than a `context: 'fresh' | 'fork'` request field, the distinction is the provider's identity: `dsh-subagent-spawn` (fresh, isolated, own system prompt) and `dsh-subagent-fork` (seeded from the parent's log) are two registered providers. You pick behavior by picking a provider — consistent with the registry being the selection mechanism. The fork backend seeds only a **balanced, completed-turn prefix** of the parent log: at tool-execute time the parent's turn is open (it holds the `assistant/message` and the dangling spawn `tool/call` with no `tool/result`), and seeding that raw prefix would give the child an unbalanced turn that the [invariants](../../../../packages/support/invariants/src/index.ts) trace replay rejects.
 
 ### Child isolation and the parent log
 
@@ -54,7 +54,7 @@ Each subagent runs in its **own `Session`** (own id, `parentSession` lineage), p
 
 ### Synchronous collect (first cut)
 
-The `dsh-tool-subagent` consumer awaits `run.result` and returns the child's final output as the tool result, blocking the parent's turn until the child finishes. It does so inside a `try/finally` that always `dispose()`s the run (no leaked idle child/session on any path), bridges `exec.signal` to `run.cancel()`, and maps a non-`completed` stop reason to an `isError` result rather than returning partial output as success. Steering (`sendMessage`) is part of the contract but **intentionally unused** this cut.
+The `dsh-tool-subagent` consumer passes its execution signal into the start request, awaits the ready run's `result`, and returns the child's final output as the tool result, blocking the parent's turn until the child finishes. A `try/finally` always `dispose()`s the run, so no success, failure, or cancellation path leaks an idle child/session. A non-`completed` stop reason maps to an `isError` result rather than returning partial output as success. Steering (`sendMessage`) is part of the contract but intentionally unused in this consumer.
 
 ### Provider selection is config, not model-facing
 
@@ -66,7 +66,7 @@ The seam is tested through the real cordis Loader / export path, not a hand-buil
 
 ## Consequences
 
-- **Recursion.** Without a guard, an in-process child inherits the spawn tool and can spawn unboundedly. Depth-limit is an optional capability (the in-process backends enforce it; ACP advertises it off and rejects a `maxDepth` request); tool-filtering is likewise optional. Tool-filtering, when implemented, needs a `tools/pre-execute` deny in the child context — schema filtering alone is insufficient because a model can hallucinate a denied tool name.
+- **Recursion.** Without a bound, an in-process child can see the delegation tool and recurse. The in-process backends implement the optional absolute depth limit and scoped live-global `toolFilter`; ACP advertises both capabilities off and rejects such a request. The [subagent composition-controls RFC](2026-07-12-subagent-persona-tool-filter-and-depth.md) owns their exact semantics and security limits.
 - **Blocking the parent turn.** Synchronous collect holds the parent's `runStep` open for the child's full duration. This is acceptable for the first cut; **background / poll / spill semantics are deferred to a future redesign that unifies long-running-tool handling across subagents AND bash** (a sub-agent and a long `bash` background task pose the same "the model started something slow, how does it collect later" problem, and should share one mechanism rather than each inventing its own).
 - **Live progress.** This cut surfaces only lifecycle + final result; a per-chunk child→parent update stream is deferred with the background redesign.
 - **ACP client surface.** Proxying `fs`/`terminal` from the ACP child back to the parent (a shared-workspace mode) is future work; the first cut advertises neither, so the child self-serves in its own process.
diff --git a/docs/rfc/implemented/feature/2026-06-22-acp-subagent-backend.md b/docs/rfc/implemented/feature/2026-06-22-acp-subagent-backend.md
index ec608177b4..518f9dedef 100644
--- a/docs/rfc/implemented/feature/2026-06-22-acp-subagent-backend.md
+++ b/docs/rfc/implemented/feature/2026-06-22-acp-subagent-backend.md
@@ -34,7 +34,7 @@ The child is a separate process, so it inherits an environment. Credential-shape
 
 Designed at every tier the backend touches, per the root AGENTS.md rule that a new capability shape names its coverage at every tier at plan time:
 
-- **Keyless unit/integration** (`subagent-acp.spec.ts`): spawns a scripted mock ACP server subprocess (`tests/mock-acp-server.ts`) and drives it through the real backend over real ACP stdio. Covers: the prompt round-trip + output accumulation; every StopReason mapping; cancellation via `run.cancel()` and via the request signal; the already-aborted-before-start case; the cancel-races-ahead-of-newSession case; a torn-pipe-after-cancel (child crashes on cancel) settling `aborted`; permission auto-answer under both policies (including the allow-policy-no-allow-option fallback); a non-message update consumed but not accumulated; a nonexistent-command spawn failure settling `error`; HMR provider cleanup; and the namespace export shape. 100% per-file coverage.
+- **Keyless unit/integration** (`subagent-acp.spec.ts`): spawns a scripted mock ACP server subprocess (`tests/mock-acp-server.ts`) and drives it through the real backend over real ACP stdio. Coverage includes the prompt round-trip and output accumulation; every StopReason mapping; cancellation through the required request signal and through disposal; already-aborted and cancel-races-ahead-of-newSession starts; a torn pipe after cancellation settling `aborted`; permission auto-answer under both policies; non-message updates; nonexistent-command startup failure with process reaping; provider HMR; and the namespace export shape.
 - **With-key e2e** (`subagent-acp.e2e.ts`): the harness drives ITSELF — the backend spawns the real `acp-agent` example process and a real model in that child answers a prompt (PONG) and does real file work (writes `proof.txt`, verified on disk). Self-skips without `DEEPSEEK_API_KEY`. This is the "talk to our own process" smoke and the out-of-process analogue of the in-process spawn e2e.
 - **Snapshot**: deferred as `TODO(acp-subagent-replay)`. An ACP child is a distinct replay shape — each child is its own PROCESS with its own single-agent replay (booted under `DSH_SNAPSHOT=replay` with its own sessions-root + fixture), unlike the in-process per-session keying that [the per-session replay RFC](../testing/2026-06-22-subagent-snapshot-replay.md) added. The keyless mock-server tests give deterministic coverage of the backend in the meantime; the snapshot follow-up would record the parent driving a real-but-replayed ACP child.
 
diff --git a/docs/rfc/implemented/feature/2026-06-30-interception-seams.md b/docs/rfc/implemented/feature/2026-06-30-interception-seams.md
index ba372b98b2..52d7e2b425 100644
--- a/docs/rfc/implemented/feature/2026-06-30-interception-seams.md
+++ b/docs/rfc/implemented/feature/2026-06-30-interception-seams.md
@@ -20,13 +20,13 @@ The canonical surface separates transformable policy, around-dispatch control, a
 
 ### The tool pipeline gives each phase one kind of authority
 
-Every call follows one ordered pipeline: `tools/pre-execute` → monotonic guards → `tools/execute` → core dispatch → `tools/post-execute` → `tools/result`. The registry requires caller-owned `arguments` to survive lossless-JSON validation before and after cloning, then snapshots `ToolExecutionInput` into a pipeline execution with its own opaque token: identity fields and deeply frozen detached arguments are immutable for the whole pipeline, and a nested call's `parent` contains only the enclosing execution's token rather than its live object. Optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove, and the complete object freezes before final observers run. This identity contract prevents a policy listener from silently changing what the log, UI, and tool body believe ran.
+Every call follows one ordered pipeline: `tools/pre-execute` → monotonic guards → `tools/execute` → core dispatch → `tools/post-execute` → `tools/result`. The registry reads each caller-owned input field once, materializes `arguments` as detached lossless JSON in one recursive pass, and snapshots `ToolExecutionInput` into a pipeline execution with its own opaque token. Identity fields and deeply frozen arguments are immutable for the whole pipeline, and a nested call's `parent` contains only the enclosing execution's token rather than its live object. Optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove, and the complete object freezes before final observers run. This identity contract prevents a policy listener from silently changing what the log, UI, and tool body believe ran.
 
 - **`tools/pre-execute`** is the extensible waterfall gate. Its `PreToolDecision` allows, denies, or asks. Deny skips `tools/execute` and core dispatch. Ask resolves through the optional approval seam: only `allowed-once` continues through guards and dispatch; rejection, cancellation, an unavailable channel, a missing approval service, or an agent-less call becomes a normalized denial. Every outcome still reaches post-policy and final observers.
 - **`ctx.tools.guard()`** installs synchronous scope-aware policy after the whole pre-execute waterfall. A guard may deny or abstain, never force-allow, so listener ordering cannot resurrect an operation that a final invariant forbids.
 - **`tools/execute`** is the around-dispatch waterfall for timeout, retry, and metrics plugins. A wrapper delegates to core dispatch with `next()`, may add, replace, or remove only `exec.signal` before doing so, and receives the already-normalized result of a thrown or unknown tool; returning its own valid result short-circuits dispatch.
 - **`tools/post-execute`** is the inspect/transform waterfall. Its `PostToolDecision` accepts, blocks with feedback, optionally replaces content, or attaches `additionalContext`; in-place mutation of the result is not a transform channel, because the registry rebuilds the outcome from a protected snapshot plus the returned decision.
-- **`tools/result`** is the awaited parallel notification after every transform, lossless-JSON validation, and the outer error boundary. It receives the same frozen execution identity and an immutable snapshot of the authoritative result; observer failures are contained per listener and cannot change or reject `ToolRegistry.execute()`'s returned outcome.
+- **`tools/result`** is the awaited parallel notification after every transform, lossless-JSON materialization, and the outer error boundary. It receives the same frozen execution identity and an immutable snapshot of the authoritative result; observer failures are contained per listener and cannot change or reject `ToolRegistry.execute()`'s returned outcome.
 
 Core dispatch and the tool body sit inside normalization boundaries, so tool, listener, malformed-result, non-JSON result, and identity-shape failures resolve as JSON-safe `isError` results rather than escaping the turn. A post-execute listener can therefore inspect a thrown tool, and a final observer sees exactly what the caller receives and the session log can persist.
 
@@ -42,7 +42,7 @@ Core dispatch and the tool body sit inside normalization boundaries, so tool, li
 
 ### Pre-tool input rewrite is a separate consistency decision
 
-`PreToolDecision` is allow/deny/ask only — **no `arguments` rewrite**. Output replacement is safe because `tool/result` is logged after execution from the final result. Input rewrite is different: `assistant/message` (model history) and `tool/call` (the audit record) are logged before `ToolRegistry.execute()`, while ACP and tool presentation read those arguments. The registry therefore seals the cloned arguments before `tools/pre-execute`; no listener or test shim can mutate them in place. An honest rewrite must update history, audit, presentation, and execution as one unit before that identity is created, which belongs to the separate [pre-tool input-rewrite proposal](../../proposed/feature/2026-06-30-pre-tool-input-rewrite.md) and its loop-side `TODO(pre-tool-input-rewrite)`.
+`PreToolDecision` is allow/deny/ask only — **no `arguments` rewrite**. Output replacement is safe because `tool/result` is logged after execution from the final result. Input rewrite is different: `assistant/message` (model history) and `tool/call` (the audit record) are logged before `ToolRegistry.execute()`, while ACP and tool presentation read those arguments. The registry therefore seals the materialized arguments before `tools/pre-execute`; no listener or test shim can mutate them in place. An honest rewrite must update history, audit, presentation, and execution as one unit before that identity is created, which belongs to the separate [pre-tool input-rewrite proposal](../../proposed/feature/2026-06-30-pre-tool-input-rewrite.md) and its loop-side `TODO(pre-tool-input-rewrite)`.
 
 ### Boundaries
 
diff --git a/docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md b/docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md
index 17730458de..aa853edd24 100644
--- a/docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md
+++ b/docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md
@@ -6,13 +6,13 @@ Status: implemented
 
 The hooks subsystem ([interception seams RFC](2026-06-30-interception-seams.md)) lets a plugin observe and gate the agent at lifecycle points. Claude Code and Codex both expose **SubagentStart / SubagentStop** hooks, and CC's carry the subagent's final message. The harness already emits `subagent/start` and `subagent/end` lifecycle events ([the subagent capability-seam](2026-06-21-subagent-capability-seam.md)), but their payloads were minimal (`provider`, `id`, and on end `stopReason`) — not enough for a hooks bridge to report WHAT a subagent produced without separately reaching for the live run.
 
-This RFC enriches the end payload. It is deliberately **observe-only**: no control-flow change, no waterfall, no `start()` restructure. A run-affecting subagent-stop decision (continuation, injection that changes the run) is a separate, larger redesign and stays out of scope.
+This RFC enriches the end payload. It is deliberately **observe-only**: no control-flow change and no waterfall. A run-affecting subagent-stop decision (continuation, injection that changes the run) is a separate, larger redesign and stays out of scope.
 
 ## Decision
 
-**Add `lastAssistantMessage` — the child's final output — to `SubagentRunEndInfo`.** On the settle path it is a DEEP CLONE of `SubagentResult.output` (so an observer sees WHAT the subagent produced without holding the run). On the REJECT path (an infrastructure fault where no `SubagentResult` was produced — the seam only knows `stopReason: 'error'`) it is absent. The clone is load-bearing for observe-only: the `subagent/end` emit fires from a detached `.then` registered *before* `start()` returns, i.e. before the caller's own `await run.result` continuation — handing listeners the same array reference would let a mutating listener corrupt the caller's `SubagentResult.output`. `structuredClone` makes the event a read-only view (a regression test mutates the event's array and asserts the caller's result is untouched); a clone failure is contained (logged, the event still fires without `lastAssistantMessage`) rather than becoming an unhandled rejection on the detached `.then`.
+**Add `lastAssistantMessage` — the child's final output — to `SubagentRunEndInfo`.** On the settle path it is the readonly typed `SubagentResult.output`, so an observer sees what the child produced without holding the run. On an infrastructure rejection where no `SubagentResult` exists, it is absent and the event reports `stopReason: 'error'`. Providers and listeners are trusted same-process collaborators and honor the borrowed immutable payload contract.
 
-Both events stay plain **`emit`s**. The service waits for `run.started` before firing `subagent/start`; an in-process listener can therefore reach the published child via `ctx.agents.get(info.id)` and `inject()` into it, while a remote provider need not have a local registry entry. It observes `run.result` immediately, snapshots the end payload before the caller can mutate it, and emits `subagent/end` only after start; readiness rejection emits neither event. The callbacks remain observe-only and per-listener containment keeps one bad subscriber from stranding a live run, surfacing as an unhandled rejection, or starving later listeners.
+Both events stay plain **`emit`s**. Async `SubagentService.start()` attaches result observation to the ready provider run, emits `subagent/start`, and then returns the run; an in-process listener can therefore reach the published child via `ctx.agents.get(info.id)`, while a remote provider need not have a local registry entry. A rejected provider start emits neither event. The callbacks remain observe-only and per-listener containment keeps one bad subscriber from stranding a live run or starving later listeners.
 
 ## Alternatives considered
 
diff --git a/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md b/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md
index a5f294f76d..ed718686ef 100644
--- a/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md
+++ b/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md
@@ -24,7 +24,9 @@ One deliberate strictness DIVERGENCE from CC: hook misuse — unknown or deferre
 
 **Trust premise (governs every engine decision below)**: workflow scripts are MODEL-WRITTEN — the same trust level as the model's existing bash access — so the engine defends against BUGGY scripts, never hostile ones. In scope: `result` never rejects, no unhandled rejections from dropped hook promises, loud rejection of values JSON cannot carry, fatal-vs-null hook discipline, cancellation that always frees the caller. Out of scope, deliberately: adversarial values (throwing/spinning accessors, proxies with hostile traps, prototype forgery, `prepareStackTrace` hijack) AND Node-API escape from the script's context — the vm context shares object machinery with its surrounding realm, so a script can reach the `Function` constructor (`globalThis.constructor.constructor`) and from it `process` and every Node builtin; the absent globals are API surface, not containment, and a worker thread is NOT a security boundary (an escapee holds process-wide privileges — Node's permission model is per-process). Worker-side code MAY run script code while reading script values, and that is accepted: a synchronous spin costs the script its OWN thread (terminated at the post-cancel grace), never the host loop, so containing error VALUES would be cost without a threat model. Genuine sandboxing (isolated-vm, a separate process) remains an engine swap behind the seam, not incremental defenses here.
 
-**Why node:worker_threads**: one run = one worker thread, no pooling — a run is heavyweight (many children), so thread spin-up (~tens of ms) is noise. The script runs in a vm context INSIDE the worker, keeping the script-visible surface exactly the hook contract above (a bare worker realm would leak `setTimeout`/`fetch`/`process` as accidental API), and every `agent()` bridges to `ctx.subagents` by message-port RPC — children are I/O-bound LLM loops and stay on the host loop; the thread isolates the SCRIPT, the only part that can spin. What the thread buys: `start()` never blocks the host (an in-process engine runs the initial synchronous slice inline and cannot kill a spin past the first await — it could only ABANDON such a script, leaving the spin on the host loop), the post-cancel grace ends in a REAL `worker.terminate()`, and the value boundary is serialization by construction. isolated-vm was rejected for actual sandboxing: maintenance mode, `--no-node-snapshot` on EVERY consumer process (including published bins) on Node ≥ 20, node-gyp source-build fallback. Key mechanics (details in the package README): meta shape-validation and a body pre-parse stay HOST-side (preserving the seam's synchronous throws), a ready→go handshake keeps a run cancelled before start from ever executing the body, `cancel()` drives both child-cancel channels host-side (the shared request signal AND each child's explicit `cancel()` — a wedged worker cannot relay its own cancel RPCs), a host-side child registry backs worker-death reaping and `dispose()` quiescence, the wire protocol is enum-keyed payload maps private to the package, and on a termination path `agentsStarted` degrades to the host-observed count. Coverage puts the worker-side session on an in-process `MessageChannel` (real-Worker code is invisible to main-process v8) and proves the built `lib/worker.js` — a second tsdown entry, sanctioned in the workspace-constraints gate by the `"./worker"` subpath export — under plain node in the built-bin smoke gate.
+**Why node:worker_threads**: one run uses one unpooled worker because a workflow run is already heavyweight relative to thread startup. The script runs in a vm context inside the worker, keeping the script-visible surface to the hook contract instead of exposing a bare worker realm, while `agent()` bridges by message-port RPC to I/O-bound child loops on the host. This keeps `start()` from blocking the host on the script's synchronous slice, makes the post-cancel deadline end in a real `worker.terminate()`, and gives cross-thread values a serialization boundary by construction. isolated-vm was rejected for its maintenance state, required `--no-node-snapshot` consumer flag on Node ≥ 20, and node-gyp fallback.
+
+Host-side meta validation and body pre-parsing preserve the seam's synchronous errors, and private enum-keyed payload maps define the wire protocol. Pending async starts, published child records, one host cancellation signal, worker-death reaping, result precedence, and disposal quiescence preserve the subagent run contract across that wire; the [agent-scope runtime-design RFC](../architecture/2026-07-12-agent-scope-runtime-design.md#workflow-children-are-pending-starts-or-published-records) owns those race algorithms. Coverage uses an in-process `MessageChannel` for worker-side logic that main-process V8 coverage cannot see and separately proves the built `lib/worker.js`—a second tsdown entry sanctioned by the `"./worker"` subpath export—under plain Node in the built-bin smoke gate.
 
 **Meta as data, never evaluated**: the meta block reaches the seam as a plain JSON request field (the tool's schema-validated `meta` parameter) and the engine only shape-validates it, every violation named. This is a host-isolation invariant, not a convenience: evaluating a meta literal host-side — even one contractually "pure", in an empty timed vm context — hands script-controlled getters a host stack with no timeout the moment the result is READ, defeating the exact spin isolation the worker thread buys.
 
@@ -38,10 +40,9 @@ A `workflow` tool mirroring `dsh-tool-subagent`'s synchronous shape: start, awai
 
 `SubagentStartRequest.outputSchema` is implemented by `dsh-subagent-inprocess` for both in-process backends. Each structured child receives its own scoped capture tool, instruction, and enforcement registrations on `child.ctx`; concurrent children can use different schemas without sharing mutable policy, and disposing the child removes the entire attachment.
 
-- **Assembly is owner-protected.** The child registers `structured_output` with the run's real schema plus an order-190 instruction, then `systemPrompt.protect()` restores their canonical presence and definition after the complete assembly waterfall. Restored entries anchor before the first surviving later unprotected canonical neighbor, or at the end, without undoing listener ordering of unprotected entries. In native and both modes the capture tool remains a native wire tool. In pure Code Mode its canonical native presence is absent, so protection removes injected copies while the scoped tool remains in the generated SDK; the Code Mode owner independently protects `tools:sdk` and the reserved `run_code` transport. The loop logs the final assembly as `request/header`, keeping the demand reconstructable.
-- **Capture uses a two-level commit.** The capture body validates and stages a cloned value in a `WeakMap` keyed by that immutable execution object; only the observe-only `tools/result` notification commits it when the authoritative JSON-safe result after pre-policy, guards, around dispatch, post-policy, and outer error normalization succeeds. A capture called from a `run_code` program carries only the enclosing execution's opaque token as `parent`: inner success becomes pending, and commits when that token matches the enclosing transport's own successful `tools/result`. An outer runtime failure or post-policy block therefore cannot report structured success, and the observer never receives a live outer execution reference.
-- **Finality is monotonic within and after the step.** A scoped `ctx.tools.guard()` denies calls after capture has become pending or committed, and it runs after the entire extensible `tools/pre-execute` waterfall so listener order cannot force-allow a later side effect. After the step, scoped serial `agent/turn-stop` runs after ordinary continuation and steering folding; a captured child stops with no extra model step, and neither a continuation wrapper nor late steering can resurrect it.
-- **Schema and failure behavior stay explicit.** `start()` clones the schema so caller mutation cannot drift enforcement. `ToolArgsError` keeps validation retry inside the same turn. A child that finishes cleanly without a committed capture settles `error` to the parent; there is no re-prompt loop. `StructuredOutputSchema` is the raw enforceable JSON-Schema subset in `dsh-tools` (single-string `type`, `properties`/`required`/`additionalProperties`, `items`, scalar `enum`/`const`), and unsupported keywords fail loudly because that wire data becomes the capture tool's parameters verbatim.
+An output schema makes a schema-valid committed capture mandatory for successful child completion. The scoped runtime preserves the canonical capture tool and instruction, commits only a successful final outcome—including the enclosing `run_code` outcome for an SDK call—denies later side effects after capture becomes pending, and stops the child without another model step after commit. A validation failure remains a retryable tool error; clean completion without a committed capture settles as an error.
+
+`StructuredOutputSchema` is the raw enforceable JSON-Schema subset in `dsh-tools` (single-string `type`, `properties`/`required`/`additionalProperties`, `items`, scalar `enum`/`const`), and unsupported keywords fail loudly because that wire data becomes the capture tool's parameters verbatim. The [agent-scope runtime-design RFC](../architecture/2026-07-12-agent-scope-runtime-design.md#structured-output-commits-only-authoritative-outcomes) owns the assembly, commit, guard, and terminal-stop correctness algorithms.
 
 ## Deferred (documented non-goals of this cut)
 
diff --git a/docs/rfc/implemented/feature/2026-07-06-approval-seam.md b/docs/rfc/implemented/feature/2026-07-06-approval-seam.md
index 1257554d30..5d82226a96 100644
--- a/docs/rfc/implemented/feature/2026-07-06-approval-seam.md
+++ b/docs/rfc/implemented/feature/2026-07-06-approval-seam.md
@@ -49,11 +49,11 @@ The `escalation-rejected` twin ends in `{"outcome": "rejected"}` instead: nothin
 
 #### The seam: mechanism and policy split
 
-`ApprovalService.request(req)` always resolves to a closed `ApprovalOutcome` — `allowed-once` / `rejected` / `cancelled` / `unavailable` — and never rejects. The service synchronously snapshots and shallow-freezes the accepted request before its first asynchronous boundary: scalar fields are copied while the agent and `AbortSignal` remain exact identity capabilities, so later caller mutation cannot redirect scope, payload, cancellation, or either audit event. The service dispatches the `approval/request` waterfall, races the captured signal (abort settles `cancelled`; a late answer is discarded, never double-audited), contains a throwing answerer as `unavailable`, normalizes a rogue non-vocabulary return to `unavailable`, and lands the log-only audit pair `approval/asked`/`approval/decided` (paired by the branded `ApprovalRequestId`) on the captured agent's captured session log. A session observer runs after an event enters the append-only log; if one throws, the service recognizes the recorded event, contains the callback failure, and completes the pair. Grants are one-shot by definition: `allowed-once` authorizes the single asked-about action, never a class of future ones, and the service stores nothing between requests. The one precondition: `request()` throws (before appending anything) when the agent's session has no open turn — the audit pair must be turn-enclosed, the turn being the durable log's commit/replay boundary (a bare event between turns is dropped as crash tail on reload); every ask path runs mid-turn already, and idle asks are a deferred design.
+After request validation and a successful `approval/asked` append, the answerer phase always resolves to a closed `ApprovalOutcome` — `allowed-once` / `rejected` / `cancelled` / `unavailable`. `ApprovalRequest` is a readonly same-process contract, so the service borrows its routing identity and cancellation signal instead of copying the record or capturing a parallel callback bundle. It dispatches the `approval/request` waterfall, races the request signal (abort settles `cancelled`; a late answer is discarded, never double-audited), contains a throwing answerer as `unavailable`, normalizes a rogue non-vocabulary return to `unavailable`, and lands the log-only audit pair `approval/asked`/`approval/decided` (paired by the branded `ApprovalRequestId`) on the request agent's session log. Request acceptance and either pre-commit audit append may still reject; returning a decision that could not be logged would violate the pair. Session owns post-commit observer containment, so a callback failure cannot turn an authoritative audit append into a rejected request or suppress the matching event. Grants are one-shot by definition: `allowed-once` authorizes the single asked-about action, never a class of future ones, and the service stores nothing between requests. `request()` also throws before appending anything when the agent's session has no open turn — the audit pair must be turn-enclosed, the turn being the durable log's commit/replay boundary (a bare event between turns is dropped as crash tail on reload); every ask path runs mid-turn already, and idle asks are a deferred design.
 
 Answerers are the policy, and they are `approval/request` waterfall listeners. The waterfall buys exactly what the seam needs: with zero listeners the dispatch falls through to the caller-supplied default — `unavailable`, so fail-closed needs no configuration and no code in any deployment; a listener that recognizes the request's agent answers by returning an outcome without calling `next()` (the decision slot is single-occupancy, first answer wins — the same documented semantics as the `fs/write-intent` gate); a listener that does not recognize the agent MUST delegate via `next()` so another answerer or the default gets the question; and listeners dispose with their owning fiber, so an unloaded UI plugin degrades the next ask to `unavailable` instead of leaving a dangling channel. Registration order across sibling plugins is not load-order deterministic (the loader starts siblings concurrently), so a deployment composes ONE terminal answerer and reserves `prepend` listeners for decide-or-delegate gates.
 
-`ApprovalRequest` carries the asking `agent` (routes the question; receives the audit events), the `toolName`, the optional exact `callId`, the asker's human-readable `reason`, and the optional `signal`. The caller owns this input record; `request()` owns its frozen acceptance snapshot. The vocabulary is deliberately self-contained — it names the tool-call by the `CallId` brand from `dsh-llm` and never imports `dsh-tools` — because `dsh-tools` depends on `dsh-user-approval` (the ask routing) and a `ToolCallView` import would close a package cycle. It deliberately does NOT carry tool arguments: a UI answerer attaches the prompt to the already-streamed tool call via `callId` instead of re-rendering the call.
+`ApprovalRequest` carries the asking `agent` (routes the question; receives the audit events), the `toolName`, the optional exact `callId`, the asker's human-readable `reason`, and the optional `signal`. The caller retains ownership and honors the readonly contract for the duration of `request()`. The vocabulary is deliberately self-contained — it names the tool-call by the `CallId` brand from `dsh-llm` and never imports `dsh-tools` — because `dsh-tools` depends on `dsh-user-approval` (the ask routing) and a `ToolCallView` import would close a package cycle. It deliberately does NOT carry tool arguments: a UI answerer attaches the prompt to the already-streamed tool call via `callId` instead of re-rendering the call.
 
 #### Ask routing in dsh-tools
 
@@ -79,7 +79,7 @@ One package, no cycles: `dsh-user-approval` peers on `cordis`, `dsh-session` (ev
 
 ### Testing
 
-Unit tier: the service's outcome branches (fail-closed default, first-wins slot, delegation, containment, rogue-value normalization, abort-before and abort-during with late-answer discard, fresh ids, fiber-disposal degradation), accepted-request mutation across agent scopes, post-append observer throws on both audit events, and the policy tier (both values × dispatch/decide, a `'never'` decision unbypassable even by an answerer prepended AFTER the service, audit pair intact) in `dsh-user-approval`; the ask routing matrix (grant dispatches; three non-grant reasons pinned verbatim; unmounted and agent-less degrades; the registry's own exhaustiveness backstop against a non-conforming stand-in) in `dsh-tools`; the answerer (wire shape of the prompt, outcome mapping, unknown-option conservatism, foreign-agent and call-less delegation) driven through a real bridge + scripted client in `dsh-acp`.
+Unit tier: the service's outcome branches (fail-closed default, first-wins slot, delegation, containment, rogue-value normalization, abort-before and abort-during with late-answer discard, fresh ids, fiber-disposal degradation), scoped routing, post-append observer throws on both audit events, and the policy tier (both values × dispatch/decide, a `'never'` decision unbypassable even by an answerer prepended AFTER the service, audit pair intact) in `dsh-user-approval`; the ask routing matrix (grant dispatches; three non-grant reasons pinned verbatim; unmounted and agent-less degrades; the registry's own exhaustiveness backstop against a non-conforming stand-in) in `dsh-tools`; the answerer (wire shape of the prompt, outcome mapping, unknown-option conservatism, foreign-agent and call-less delegation) driven through a real bridge + scripted client in `dsh-acp`.
 
 Snapshot tier: the harness accepts scripted permission answers (`permissionAnswers` in a scenario's `input.json`, consumed FIFO; an unscripted prompt answers `cancelled`, fail closed). The seam's wire is recorded end to end in the sandbox example's suite: both escalation branches drive `session/request_permission` through this seam over scripted answers (grant and rejection), and the recorded `mode-switching` scenario pins the `'never'` prompt sentence and the policy-switch notice ([the sandbox RFC](2026-07-06-sandbox.md) § Testing).
 
@@ -105,7 +105,7 @@ The implemented contract is pinned by the suites in Testing:
 - With an ApprovalService and an answerer composed, a hook's `ask` reaches a human and `allowed-once` dispatches the tool; every other outcome denies with its distinct reason.
 - A `'never'` session auto-rejects every ask without prompting anyone, states the policy in its prompt, and narrates switches (the shared switching mechanics are pinned in [the sandbox RFC](2026-07-06-sandbox.md)).
 - Every unanswerable path fails closed to `unavailable`: no service, no listener, a foreign or agent-less request, a throwing answerer, a rogue return value, or a dead client connection.
-- Every `request()` snapshots its routing identity and lands exactly one `approval/asked`/`approval/decided` pair on that agent's captured log, replayable and invisible to the model transcript; post-append observer failures cannot split the pair.
+- Every `request()` routes through its readonly agent identity and lands exactly one `approval/asked`/`approval/decided` pair on that agent's log, replayable and invisible to the model transcript; post-append observer failures cannot split the pair.
 - Prompts route per-session through the bridge's ownership map; one session's prompt can never reach another session's editor.
 - A deployment with no ApprovalService emits no approval prompt or approval audit events and denies every `ask` request.
 
diff --git a/docs/rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md b/docs/rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md
new file mode 100644
index 0000000000..5b6eeb4ccb
--- /dev/null
+++ b/docs/rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md
@@ -0,0 +1,92 @@
+# RFC: Configure subagent persona, tool visibility, and depth
+
+Status: implemented
+
+## Problem
+
+A reusable subagent provider answers how to run a child, but different delegation tools need different child behavior. One deployment may want a reviewer persona, a research-only tool set, or a hard recursion bound without creating a new provider for every combination.
+
+These controls affect the child's first model request and therefore cannot be installed after the child is visible. They also need honest provider support: an ACP backend cannot silently accept an in-process-only tool filter, and a filter must not be described as a security boundary when every plugin runs in the same trusted process.
+
+## Decision
+
+Subagent starts have three independent composition controls: `persona`, `toolFilter`, and `maxDepth`. A provider advertises support for each control, the service rejects unsupported requests before starting a run, and an in-process provider installs the requested composition while the child is still unpublished.
+
+The controls answer different questions:
+
+| Control | Question | Result |
+|---|---|---|
+| `persona` | What role instructions replace the deployment persona for this child? | A child-local prompt section shadows `deployment:persona` |
+| `toolFilter` | Which deployment-global tools enter this child's visible tool view? | A scoped restriction filters globals before child-local tools are added |
+| `maxDepth` | How deep may this delegation tree grow? | A start whose child depth exceeds the absolute cap is rejected |
+
+`dsh-tool-subagent` exposes the controls as plugin configuration and copies them into each request it creates. Direct `SubagentService` callers may choose them per request. The provider capability descriptor remains the source of truth for whether a backend can honor each field.
+
+### Persona is a scoped shadow
+
+The persona control changes one child without changing deployment-wide prompt assembly. During unpublished setup, an in-process provider registers a child-scoped section named `deployment:persona`; ordinary most-specific-wins resolution replaces the global section only in that child's assemblies.
+
+The value has the same strict template semantics as the deployment persona. Omitting it inherits the deployment section through the global layer; an explicit empty string shadows the global persona with an empty section. Parent and sibling personas never enter the child's flat scope.
+
+This uses the normal system-prompt registration mechanism rather than a second persona channel. The first prompt therefore sees the same named contribution that later prompts and prompt-inspection tools see.
+
+### Tool filtering is one live global-view rule
+
+The tool filter controls visibility and executable lookup together. An in-process provider installs `ToolRegistry.restrict()` in the child's scope before publication, and the registry's single resolver applies the same result to prompt schemas, lookup, execution, and Code Mode SDK generation.
+
+Resolution follows these rules:
+
+1. Each restriction applies `allow` before `deny` to the live deployment-global tool registry.
+2. Multiple restrictions intersect, so every installed restriction must admit a global tool.
+3. Child-scoped tools are added after global filtering and may shadow an admitted global tool.
+4. Reserved `run_code` presentation and other scope-local protocol contributions are outside the global filter.
+
+Configuration fails loudly when a filter supplies neither `allow` nor `deny`, or names something outside the current global restrictable set, including a scope-local-only or reserved name. `allow: []` is valid and deliberately hides every global tool. These checks catch misspellings and prevent configuration from appearing effective when it cannot affect the named entry.
+
+The global registry remains live. A deny-only filter admits a later global name unless it explicitly denies that name; an allow-list excludes a later global name unless it explicitly allows that name. Removing a global tool removes it from every resolved view. These semantics preserve hot registration while making the difference between allow and deny explicit.
+
+### Depth is an absolute tree cap
+
+The depth limit bounds recursive delegation independently of tool visibility. A top-level agent has depth zero; an in-process child has its parent's validated depth plus one. `maxDepth` is an absolute non-negative safe integer, and a start rejects before child ownership begins when the derived child depth is greater than the cap.
+
+Every public entry validates the domain rather than relying on one model-facing configuration path. Negative values, fractions, negative zero, non-finite values, unsafe integers, malformed stored parent depth, and derived overflow all reject. Omitting the cap leaves depth unbounded by this mechanism.
+
+A deployment can combine depth and filtering. For example, it may keep the delegation tool visible at depth one but set `maxDepth: 1`, or deny the delegation tool entirely in children. Neither choice changes the provider's conversation-history behavior.
+
+### Capability gating keeps providers honest
+
+Capabilities separate a requested feature from a provider implementation. `SubagentCapabilities` advertises `persona`, `toolFilter`, and `depthLimit`; `SubagentService.start()` checks every present request field against those flags before calling the provider.
+
+This lets spawn and fork providers share the in-process implementation while external providers advertise only what they can enforce. A request never degrades silently: selecting an unsupported control produces `UNSUPPORTED_CAPABILITY`, and no run or lifecycle event exists.
+
+### Unpublished setup makes the first request correct
+
+All child-local composition is complete before the child becomes observable. The in-process provider supplies one setup callback to agent creation; that callback installs persona, tool restriction, and structured-output contributions in the child's scope. Only after setup succeeds does creation publish the session and agent and allow the driver to start.
+
+A setup failure rolls back the private child. No observer can acquire a child whose first prompt used the deployment persona or unfiltered tool set and whose later prompts use the requested configuration.
+
+## Visibility is not authority
+
+These controls compose trusted same-process behavior; they do not authorize it. `toolFilter` changes the child view resolved by the tool registry, but it does not create a parent-to-child grant lattice, require a child to be a subset of its parent, sandbox plugins, or prevent code with another Cordis context from calling services directly.
+
+In particular, a child-local tool is added after the global filter and may be absent from the parent's view. A deny-only child also sees later global tools not named by the deny-list. Those are deliberate live-composition semantics, not non-escalation guarantees.
+
+A security design would need a separate authority representation, propagation rule, and execution-time enforcement point. Creation-time grant snapshots, parent-subset grants, explicit future-grant APIs, and generic capability/output/termination tags are outside this feature.
+
+## Alternatives considered
+
+**Create one provider per persona or tool set.** This multiplies providers that share the same transport and lifecycle implementation, makes dynamic deployment configuration awkward, and still needs a recursion mechanism. Providers remain about execution transport; requests carry per-child composition.
+
+**Copy the parent's complete tool view.** Registration scope is flat by design, and lifetime ownership does not imply visibility inheritance. Copying a resolved view would also freeze dynamic global registrations and conflate composition with authority without defining either contract fully.
+
+**Snapshot allowed global tools at child creation.** A frozen allow-set makes future registration uniformly unavailable, but it changes hot-registration semantics and starts an authorization design. The implemented filter stays a live registry predicate and documents allow-versus-deny behavior directly.
+
+**Hide only tool schemas.** Presentation-only filtering lets the model execute a tool that the prompt says does not exist through Code Mode or a forged call. One resolver governs both presentation and execution instead.
+
+**Use only tool filtering to stop recursion.** Removing the delegation tool is useful but provider-specific and does not protect direct service callers or alternate delegation tools. Absolute depth is an independent structural bound.
+
+## Consequences
+
+Contributors can configure child role, visible global tools, and recursion without defining new providers. Capability checks fail before ownership starts, unpublished setup makes the first request consistent, and one tool resolver prevents presentation/execution drift.
+
+The cost is that deployments must understand live allow/deny behavior and the distinction between visibility and authority. Provider authors must advertise each supported control accurately, and in-process providers must install every requested contribution before publication. The controls deliberately do not solve security confinement or parent-to-child non-escalation.
diff --git a/docs/rfc/implemented/process/2026-07-06-node-engine-floor.md b/docs/rfc/implemented/process/2026-07-06-node-engine-floor.md
index 72c9f09eda..51328a5a1a 100644
--- a/docs/rfc/implemented/process/2026-07-06-node-engine-floor.md
+++ b/docs/rfc/implemented/process/2026-07-06-node-engine-floor.md
@@ -8,7 +8,7 @@ The Node 22 branch of the root `engines.node` range is a contract for the instal
 
 ## Decision
 
-Set `engines.node` to `^22.19.0 || >=24.0.0` and test the keyless CI compatibility matrix on `['22.19', 24, 26]`. The real-API e2e workflow stays on Node 24 because it exercises API integration rather than the runtime floor.
+Set `engines.node` to `^22.19.0 || >=24.0.0` and test the keyless CI compatibility matrix on `['22.19', 24, 26]`. Every matrix leg runs the TypeScript typecheck plus a keyless source-mode worker smoke, so the floor is exercised through both a complete source typecheck and a real unbuilt runtime path. The real-API e2e workflow stays on Node 24 because it exercises API integration rather than the runtime floor.
 
 Two Node features gate the source runtime:
 
@@ -22,7 +22,7 @@ Those source features clear on the 22.x line at **22.18**, but the installed Pi
 ## Consequences
 
 - The advertised LTS branch no longer undercuts the Pi adapter dependency floor.
-- CI proves the Node 22 LTS floor directly with Node 22.19, keeps the Node 24 branch on `node: 24`, and keeps Node 26 for the next even line.
+- CI proves the Node 22 LTS floor directly with Node 22.19, keeps the Node 24 branch on `node: 24`, and keeps Node 26 for the next even line; each leg typechecks the source graph and launches the unbuilt workflow worker for real.
 - The built-bin smoke needs no version-conditional flag: at 22.19 type-stripping is already the default, so the test stays the plain `node lib/bin.js` path it documents.
 - A future dependency or source API that raises the runtime floor must move `engines.node`, the compatibility matrix, and this RFC in the same change.
 
diff --git a/docs/rfc/implemented/process/2026-07-06-parallel-github-ci-gates.md b/docs/rfc/implemented/process/2026-07-06-parallel-github-ci-gates.md
index d63a8ad713..061d534b9b 100644
--- a/docs/rfc/implemented/process/2026-07-06-parallel-github-ci-gates.md
+++ b/docs/rfc/implemented/process/2026-07-06-parallel-github-ci-gates.md
@@ -10,9 +10,9 @@ The hard part is the artifact boundary. `publint`, `verify-node-next-types`, and
 
 ## Decision
 
-[CI](../../../../.github/workflows/ci.yml) keeps the keyless workflow to a few broad jobs instead of one job per gate. The Node 24 matrix has five lanes: static gates (`pnpm run check:ci:static`), lint (`pnpm run check:ci:lint`), coverage (`pnpm run check:ci:coverage`), snapshot replay (`pnpm run check:ci:snapshot`), and artifact gates (`pnpm run check:ci:artifacts`). The Node 26 compatibility job installs once and runs `pnpm run check:node-compat`.
+[CI](../../../../.github/workflows/ci.yml) keeps the keyless workflow to a few broad jobs instead of one job per gate. The Node 24 matrix has five lanes: static gates (`pnpm run check:ci:static`), lint (`pnpm run check:ci:lint`), coverage (`pnpm run check:ci:coverage`), snapshot replay (`pnpm run check:ci:snapshot`), and artifact gates (`pnpm run check:ci:artifacts`). The compatibility matrix has Node 22.19, 24, and 26 jobs; each installs once and runs `pnpm run check:node-compat`.
 
-Each lane delegates to [scripts/run-gates.ts](../../../../scripts/run-gates.ts), an in-process scheduler with bounded concurrency (`DSH_GATE_CONCURRENCY`). The static lane fans out constraints, the echo-agent demo smoke, `doc-sync` leaf gates, module-graph freshness, and `knip`; the lint lane runs ESLint with its own Node heap cap and a content-strategy ESLint cache; the coverage lane runs Vitest coverage with bounded file workers (`DSH_COVERAGE_MAX_WORKERS`); the snapshot lane isolates replay; the artifact lane builds once and then fans out the artifact consumers; the Node 26 compatibility job owns the TypeScript typecheck. The scheduler buffers each gate's output and prints a named result block with duration, so independent failures stay attributable inside each broad job log.
+Each lane delegates to [scripts/run-gates.ts](../../../../scripts/run-gates.ts), an in-process scheduler with bounded concurrency (`DSH_GATE_CONCURRENCY`). The static lane fans out constraints, the echo-agent demo smoke, `doc-sync` leaf gates, module-graph freshness, and `knip`; the lint lane runs ESLint with its own Node heap cap and a content-strategy ESLint cache; the coverage lane runs Vitest coverage with bounded file workers (`DSH_COVERAGE_MAX_WORKERS`); the snapshot lane isolates replay; the artifact lane builds once and then fans out the artifact consumers. Every compatibility job runs the TypeScript typecheck and a keyless workflow-workerthread source-launch smoke, which starts a real unbuilt worker and therefore catches Node-version-specific loader/runtime failures that typechecking cannot. The scheduler buffers each gate's output and prints a named result block with duration, so independent failures stay attributable inside each broad job log.
 
 Generated `.sessions/` logs and `.doc-typecheck-*` temp directories are ignored by lint. The aggregate local CI mode still runs demo smoke after lint, while the split GitHub static lane can run demo smoke directly because lint is isolated in its own lane.
 
@@ -36,4 +36,4 @@ The broad-lane split repeats checkout, setup, and install more often than a sing
 
 The split introduces a maintenance obligation: when `package.json` adds or removes a gate that belongs in CI, [scripts/run-gates.ts](../../../../scripts/run-gates.ts) needs the matching leaf. That obligation is intentional because the runner is the parallel execution plan for the same gate vocabulary, not a separate quality policy.
 
-The Node 26 signal is narrower than the primary Node 24 signal. It proves the source graph on the newer runtime without doubling documentation, coverage, publication, snapshot, and smoke checks whose failures are not expected to vary by Node minor version.
+The compatibility signal is narrower than the primary Node 24 signal. It proves that the source graph typechecks and that the real unbuilt workflow-worker launch path executes on every advertised runtime line without doubling documentation, coverage, publication, snapshot replay, and unrelated smoke checks whose failures are not expected to vary by Node version.
diff --git a/docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md b/docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md
index e4b72ab5d1..dbef22f3a3 100644
--- a/docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md
+++ b/docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md
@@ -13,7 +13,7 @@ Status: implemented
 
 ## Problem
 
-The loop records the canonical transcript in `SessionEvent` and also emitted a parallel set of live `agent/*` boundary mirror events: `agent/turn-start`, `agent/turn-end`, `agent/step-start`, and `agent/step-end`. The mirrors made consumers choose between two sources of truth for the SAME durable fact. ACP already chose the session log for the editor-facing transcript because a throwing peer listener can prevent later `agent/*` listeners from observing a boundary, while the session event was already appended. The stdio UI was the only production consumer that still rendered turn boundaries from the mirror events; it already rendered tool calls and results from `session/event`.
+The loop records the canonical transcript in `SessionEvent` and also emitted a parallel set of live `agent/*` boundary mirror events: `agent/turn-start`, `agent/turn-end`, `agent/step-start`, and `agent/step-end`. The mirrors made consumers choose between two sources of truth for the SAME durable fact. ACP already chose the session log for the editor-facing transcript because it is the one durable, replayable record; consuming a live mirror would require reconciling its timing with the boundary already stored in that log. The stdio UI was the only production consumer that still rendered turn boundaries from the mirror events; it already rendered tool calls and results from `session/event`.
 
 This duplication is not free. Every lifecycle change had to update the session event, the mirror event, docs, invariants, tests, and snapshot expectations. The duplicate boundary events also made failure ordering subtle: a turn can be durably closed before a live `agent/turn-end` listener runs, so a post-boundary listener failure has no valid in-log position left and must be reported out of band.
 
diff --git a/docs/rfc/rejected/architecture/2026-06-11-immutable-public-surfaces.md b/docs/rfc/rejected/architecture/2026-06-11-immutable-public-surfaces.md
index 6c404a05a9..3eedd92a2d 100644
--- a/docs/rfc/rejected/architecture/2026-06-11-immutable-public-surfaces.md
+++ b/docs/rfc/rejected/architecture/2026-06-11-immutable-public-surfaces.md
@@ -1,25 +1,24 @@
 # RFC: Deep-readonly public surfaces
 
-Status: rejected — the pervasive `DeepReadonly<T>` type flip was rejected in favor of an always-on `deriveMessages` clone plus dev-mode `Object.freeze` + invariants. The immutability *goal* shipped via that alternative; see [dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md).
+Status: rejected — the pervasive `DeepReadonly<T>` type flip is replaced by source-owned runtime immutability in `Session` plus relational development assertions. See [source-owned session immutability and dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md).
 
 ## Problem
 
-The session log is append-only by contract, but `session.events` returns `readonly SessionEvent[]` whose *elements* are mutable: a plugin can reach in and rewrite history (`events[0].data.content.push(...)`), silently breaking replay equivalence and the derived-history guarantee. The same applies to derived messages and prompt assemblies passed through waterfalls — mutation is sometimes the intended idiom (waterfall middleware mutates the request) and sometimes corruption (mutating a *logged* event), and the types don't distinguish.
+The rejected proposal targeted an ownership hole that a `readonly SessionEvent[]` type alone cannot close: its elements remain mutable at runtime, so a cast or plain JavaScript can rewrite nested history. The implemented design closes that hole in `Session` by materializing and deep-freezing every accepted event and returning frozen array snapshots. In-flight prompt waterfalls remain intentionally transformable, so immutability is an ownership boundary rather than a blanket type rule.
 
 ## Proposal
 
-> **Implemented differently — see the Status line and [dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md).** The `DeepReadonly<T>` design below was rejected as written (compile-only, high type-noise, castable). What shipped: an always-on deep clone in `deriveMessages` (closing the request/adapter aliasing path) plus a dev-mode `Object.freeze` + invariants plugin. The proposal text is kept for the record.
+> **Implemented differently — see the Status line and [source-owned session immutability and dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md).** The `DeepReadonly<T>` design below is rejected as written: it is compile-only, noisy across consumers, and castable. `Session` instead snapshots and deep-freezes accepted events and public log snapshots in every composition; `deriveMessages()` returns detached frozen projections; the development plugin checks cross-record and cross-seam relationships.
 
 Make immutability part of the type where mutation is corruption:
 
 - `SessionEvent` data becomes `DeepReadonly` on the way OUT of a session (`events`, `session/event` listeners); `append()` keeps taking plain mutable input. A `DeepReadonly<T>` utility type lands in dsh-llm next to the brand/never helpers.
 - `deriveMessages()` returns deep-readonly messages; the loop clones before handing a mutable request to the `agent/request` waterfall (mutation there is sanctioned — the clone makes the boundary explicit and cheap, once per step).
 - `PromptAssembly` stays mutable through its waterfall (sanctioned) but the registry's internal section list is cloned per assembly (already true).
-- Optionally, dev-mode `Object.freeze` of event data behind [the dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md) flag, so sanctioned-mutation violations throw in tests rather than corrupting silently.
 
 ## Plan
 
-Introduce `DeepReadonly`, flip the session read paths, fix resulting compile errors in consumers (expected: a handful in tests), add the freeze-in-dev option alongside [the dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md) plugin.
+Introduce `DeepReadonly`, flip the session read paths, and fix the resulting compile errors in consumers.
 
 ## Risks
 
diff --git a/packages/AGENTS.md b/packages/AGENTS.md
index 6a39b65b1f..1fe9e1da84 100644
--- a/packages/AGENTS.md
+++ b/packages/AGENTS.md
@@ -5,6 +5,8 @@ This directory contains all `@deepseek-ai/dsh-*` harness packages. Repo-wide con
 - **Plugin export shape — namespace OR default, never both.** A *service* package exports the service class as `export default` (the Loader instantiates it). A *function/namespace* plugin exports `name` / `inject` / `Config` / `apply` as separate named exports and **must NOT add `export default`** — the cordis Loader's `unwrapExports` does `exports.default ?? exports`, so a stray default export collapses the module to the bare `apply` function and silently discards the `inject`/`name`/`Config` namespace, leaving the plugin with no injected services (it then throws `cannot get property … without inject` at load). See [docs/postmortem/0001](../docs/postmortem/0001-acp-default-export-drops-inject.md).
 - **Read an optional (non-injected) service via `ctx.get(name)`, not `ctx.<name>`.** For a service a plugin reads opportunistically but deliberately leaves out of `static inject` (e.g. `AgentLoop` reading `sessionPersistence`), the `ctx.<name>` property proxy resolves by an ancestor-only fiber walk that throws when the call arrives through a foreign traceable shadow (the service lives on a sibling fiber). `ctx.get(name)` is the topology-independent global-store lookup, strict by default (an inactive/absent backend reads as `undefined` — prefer it over the `ctx.get(name, false)` overload, which also skips the active-state check). Services that ARE in `static inject` resolve fine via `ctx.<name>`. See [docs/postmortem/0001](../docs/postmortem/0001-acp-default-export-drops-inject.md).
 - **A plugin shipped via `cordis.yml` needs at least one test through the REAL Loader/export path** — hand-built `ctx.plugin({...})` mounts bypass `unwrapExports` and cannot catch a broken export shape. Full testing policy (tiers, with-key generosity, real-entry-path guards): [docs/testing.md](../docs/testing.md).
+- **Typed same-process service and plugin calls are contracts, not serialization boundaries.** Prefer readonly borrowed values; materialize or defensively validate only at parser/config, queued, model/tool JSON, durable/file, worker, process, or wire boundaries.
+- **Represent one asynchronous operation with one lifecycle controller or transaction.** Separate readiness, cancellation, disposal, reservation, or sentinel state requires an independent owner or settlement boundary; otherwise fold it while preserving rollback, callback containment, and quiescence.
 
 Naming notes:
 
diff --git a/packages/compact/compact-basic/tests/compact-basic.spec.ts b/packages/compact/compact-basic/tests/compact-basic.spec.ts
index e3d80cd567..e47ca434e3 100644
--- a/packages/compact/compact-basic/tests/compact-basic.spec.ts
+++ b/packages/compact/compact-basic/tests/compact-basic.spec.ts
@@ -1700,7 +1700,7 @@ describe('BasicCompactService under the real invariants plugin', () => {
   async function setup(): Promise<{ ctx: Context; session: Session; svc: BasicCompactService }> {
     const ctx = new Context()
     await ctx.plugin(SessionStore)
-    await ctx.plugin(Invariants, {})
+    await ctx.plugin(Invariants)
     await ctx.plugin(LlmService)
     ctx.llm.registerAdapter(['test-model'], new ScriptedAdapter('CONDENSED'))
     await ctx.plugin(BasicCompactService, cfg({ auto: false }))
diff --git a/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts b/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts
index f2ca3ccdd0..1efb417b48 100644
--- a/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts
+++ b/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts
@@ -76,7 +76,7 @@ async function harness(toolSteps: number): Promise<{ ctx: Context; compact: Repr
   const ctx = new Context()
   await ctx.plugin(LlmService)
   await ctx.plugin(SessionStore)
-  await ctx.plugin(Invariants, {})
+  await ctx.plugin(Invariants)
   await ctx.plugin(SystemPrompt)
   await ctx.plugin(ToolRegistry)
   await ctx.plugin(AgentRegistry)
diff --git a/packages/cordis/tool-cordis/src/api-catalog.ts b/packages/cordis/tool-cordis/src/api-catalog.ts
index 7f7882f2b7..3ee6d1081f 100644
--- a/packages/cordis/tool-cordis/src/api-catalog.ts
+++ b/packages/cordis/tool-cordis/src/api-catalog.ts
@@ -54,11 +54,11 @@ export interface TypeApiEntry {
 export const SERVICE_API: readonly ServiceApiEntry[] = [
   {
     key: 'agentLoop',
-    summary: 'The agent-loop plugin (`ctx.agentLoop`): creates ReactLoopAgents, runs their loops, and registers them in `ctx.agents`.',
+    summary: 'Concrete ReactLoopAgent factory and driver service.',
     methods: [
       'create(id: AgentId, options: AgentOptions = {}, meta: Pick<SessionHeader, \'cwd\'> = {}): ReactLoopAgent',
-      'async createAgent(options: CreateAgentOptions): Promise<AgentHandle>',
-      'async resume(options: ResumeAgentOptions): Promise<AgentHandle>',
+      'async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise<AgentHandle>',
+      'async resume(ownerCtx: Context, options: ResumeAgentOptions): Promise<AgentHandle>',
     ],
   },
   {
@@ -177,22 +177,21 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
   },
   {
     key: 'subagents',
-    summary: 'The `subagents` service: a registry of named SubagentProviders and a capability-checked start surface.',
+    summary: 'Named provider registry and capability-checked start surface.',
     methods: [
       'registerProvider(provider: SubagentProvider): () => Promise<void> | void',
       'getProvider(name: string): SubagentProvider | undefined',
       'list(): string[]',
-      'start(name: string, request: SubagentStartRequest): SubagentRun',
+      'async start(name: string, request: SubagentStartRequest): Promise<SubagentRun>',
     ],
   },
   {
     key: 'systemPrompt',
-    summary: 'Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and authoritative contribution protections; the agent loop calls `assemble(context)` once per step.',
+    summary: 'Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and owner-final contributions; the agent loop calls `assemble(context)` once per step.',
     methods: [
       'section(section: PromptSection): () => Promise<void> | void',
       'tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise<void> | void',
       'variable(name: string, provider: (context: AssembleContext) => string | undefined): () => Promise<void> | void',
-      'protect(protection: PromptProtection): () => Promise<void> | void',
       'async assemble(context: AssembleContext = {}): Promise<PromptAssembly>',
     ],
   },
@@ -203,10 +202,8 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
       'register(definition: ToolDefinition): () => Promise<void> | void',
       'restrict(filter: ToolRestriction): () => Promise<void> | void',
       'guard(guard: ToolGuard): () => Promise<void> | void',
-      'visible(scope?: ScopeKey): ToolDefinition[]',
       'get(name: string, scope?: ScopeKey): ToolDefinition | undefined',
       'schemas(scope?: ScopeKey): ToolSchema[]',
-      'knownNames(scope?: ScopeKey): string[]',
       'async execute(exec: ToolExecutionInput): Promise<ToolExecutionResult>',
     ],
   },
@@ -249,7 +246,7 @@ export const EVENT_API: readonly EventApiEntry[] = [
     name: 'agent/disposed',
     mode: 'emit',
     signature: '\'agent/disposed\'(this: Scoped<Agent>, agent: Agent): void',
-    summary: 'An agent was removed from the registry after its driver and any in-flight turn reached quiescence.',
+    summary: 'An agent was removed from the registry.',
   },
   {
     name: 'agent/error',
@@ -353,6 +350,12 @@ export const EVENT_API: readonly EventApiEntry[] = [
     signature: '\'session/created\'(this: Scoped<Session>, session: Session): void',
     summary: 'A session was created in the store.',
   },
+  {
+    name: 'session/disposed',
+    mode: 'emit',
+    signature: '\'session/disposed\'(this: Scoped<Session>, session: Session): void',
+    summary: 'A previously announced session left the store.',
+  },
   {
     name: 'session/event',
     mode: 'emit',
@@ -381,25 +384,25 @@ export const EVENT_API: readonly EventApiEntry[] = [
     name: 'subagent/end',
     mode: 'emit',
     signature: '\'subagent/end\'(this: Scoped<SubagentService>, info: SubagentRunEndInfo): void',
-    summary: 'A started subagent run settled — emitted when SubagentRun.result resolves (any stop reason) or rejects (reported as `error`).',
+    summary: 'A ready child settled.',
   },
   {
     name: 'subagent/provider-added',
     mode: 'emit',
     signature: '\'subagent/provider-added\'(provider: SubagentProvider): void',
-    summary: 'A provider became resolvable in the SubagentService registry.',
+    summary: 'A provider became resolvable in the registry.',
   },
   {
     name: 'subagent/provider-removed',
     mode: 'emit',
     signature: '\'subagent/provider-removed\'(name: string): void',
-    summary: 'A provider left the registry (its plugin\'s fiber was disposed — an unload or an HMR reload).',
+    summary: 'A provider left the registry.',
   },
   {
     name: 'subagent/start',
     mode: 'emit',
     signature: '\'subagent/start\'(this: Scoped<SubagentService>, info: SubagentRunInfo): void',
-    summary: 'A subagent run started — emitted only after SubagentRun.started fulfills, when the provider has established a live child.',
+    summary: 'A provider established a ready child.',
   },
   {
     name: 'system-prompt/assemble',
@@ -411,7 +414,7 @@ export const EVENT_API: readonly EventApiEntry[] = [
     name: 'system-prompt/change',
     mode: 'emit',
     signature: '\'system-prompt/change\'(): void',
-    summary: 'A section, tool provider, variable provider, or protection was registered or unregistered (the assembly inputs changed — possibly for one scope only).',
+    summary: 'A section, tool provider, or variable provider was registered or unregistered (the assembly inputs changed — possibly for one scope only).',
   },
   {
     name: 'tools/change',
@@ -428,7 +431,7 @@ export const EVENT_API: readonly EventApiEntry[] = [
   {
     name: 'tools/post-execute',
     mode: 'waterfall',
-    signature: '\'tools/post-execute\'(this: Scoped<ToolRegistry>, exec: ToolExecution, result: ToolExecutionResult, next: () => Promise<PostToolDecision>): Promise<PostToolDecision>',
+    signature: '\'tools/post-execute\'(this: Scoped<ToolRegistry>, exec: ToolExecution, result: Readonly<ToolExecutionResult>, next: () => Promise<PostToolDecision>): Promise<PostToolDecision>',
     summary: 'Waterfall AFTER a tool runs — where hook plugins inspect the result and accept it (optionally REPLACING the model-facing content, and/or attaching `additionalContext` for the next request) or block it with corrective `feedback` (Claude Code\'s `PostToolUse`).',
   },
   {
@@ -489,7 +492,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'AgentFactory',
-    declaration: 'export interface AgentFactory {\n    createAgent(options: CreateAgentOptions): Promise<AgentHandle>;\n    resume(options: ResumeAgentOptions): Promise<AgentHandle>;\n}',
+    declaration: 'export interface AgentFactory {\n    createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise<AgentHandle>;\n    resume(ownerCtx: Context, options: ResumeAgentOptions): Promise<AgentHandle>;\n}',
   },
   {
     name: 'AgentHandle',
@@ -513,7 +516,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ApprovalRequest',
-    declaration: 'export interface ApprovalRequest {\n    agent: Agent;\n    toolName: string;\n    callId?: CallId;\n    reason?: string;\n    signal?: AbortSignal;\n}',
+    declaration: 'export interface ApprovalRequest {\n    readonly agent: Agent;\n    readonly toolName: string;\n    readonly callId?: CallId;\n    readonly reason?: string;\n    readonly signal?: AbortSignal;\n}',
   },
   {
     name: 'AskUserQuestionAnswer',
@@ -641,11 +644,11 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'CreateAgentOptions',
-    declaration: 'export interface CreateAgentOptions {\n    agentId: AgentId;\n    sessionId: SessionId;\n    meta?: {\n        cwd?: string;\n        parentSession?: SessionId;\n        seedLength?: number;\n    };\n    seed?: SessionEvent[];\n    agentOptions?: AgentOptions;\n    setup?: (agentCtx: Context) => Promise<void> | void;\n}',
+    declaration: 'export interface CreateAgentOptions {\n    readonly agentId: AgentId;\n    readonly sessionId: SessionId;\n    readonly meta?: {\n        readonly cwd?: string;\n        readonly parentSession?: SessionId;\n        readonly seedLength?: number;\n    };\n    readonly seed?: readonly SessionEvent[];\n    readonly agentOptions?: AgentOptions;\n    readonly signal?: AbortSignal;\n    readonly setup?: (agentCtx: Context) => Promise<void> | void;\n}',
   },
   {
     name: 'CreateSessionOptions',
-    declaration: 'export interface CreateSessionOptions {\n    seed?: SessionEvent[];\n    meta?: {\n        cwd?: string;\n        parentSession?: SessionId;\n        createdAt?: number;\n        seedLength?: number;\n    };\n}',
+    declaration: 'export interface CreateSessionOptions {\n    readonly seed?: readonly SessionEvent[];\n    readonly meta?: {\n        readonly cwd?: string;\n        readonly parentSession?: SessionId;\n        readonly createdAt?: number;\n        readonly seedLength?: number;\n    };\n}',
   },
   {
     name: 'DiffCallView',
@@ -743,13 +746,9 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'PromptAssembly',
     declaration: 'export interface PromptAssembly {\n    sections: AssembledSection[];\n    tools: ToolSchema[];\n    variables: Record<string, string | undefined>;\n}',
   },
-  {
-    name: 'PromptProtection',
-    declaration: 'export interface PromptProtection {\n    sections?: readonly string[];\n    tools?: readonly string[];\n}',
-  },
   {
     name: 'PromptSection',
-    declaration: 'export interface PromptSection {\n    name: string;\n    order: number;\n    text: string | ((context: AssembleContext) => string);\n}',
+    declaration: 'export interface PromptSection {\n    readonly name: string;\n    readonly order: number;\n    readonly text: string | ((context: AssembleContext) => string);\n    readonly ownerFinal?: boolean;\n}',
   },
   {
     name: 'ReasoningBlock',
@@ -757,7 +756,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ResumeAgentOptions',
-    declaration: 'export interface ResumeAgentOptions {\n    agentId: AgentId;\n    resumeSessionId: SessionId;\n    agentOptions?: AgentOptions;\n    setup?: (agentCtx: Context) => Promise<void> | void;\n}',
+    declaration: 'export interface ResumeAgentOptions {\n    readonly agentId: AgentId;\n    readonly resumeSessionId: SessionId;\n    readonly agentOptions?: AgentOptions;\n    readonly signal?: AbortSignal;\n    readonly setup?: (agentCtx: Context) => Promise<void> | void;\n}',
   },
   {
     name: 'SandboxEnforcement',
@@ -797,7 +796,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'SessionHeader',
-    declaration: 'export interface SessionHeader {\n    version: number;\n    id: SessionId;\n    createdAt: number;\n    cwd?: string;\n    parentSession?: SessionId;\n    seedLength?: number;\n}',
+    declaration: 'export interface SessionHeader {\n    readonly version: number;\n    readonly id: SessionId;\n    readonly createdAt: number;\n    readonly cwd?: string;\n    readonly parentSession?: SessionId;\n    readonly seedLength?: number;\n}',
   },
   {
     name: 'SessionId',
@@ -805,27 +804,27 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'SkillCandidate',
-    declaration: 'export interface SkillCandidate extends SkillSummary {\n    rank: number;\n    locator: unknown;\n    path?: string;\n    metadata?: Record<string, unknown>;\n}',
+    declaration: 'export interface SkillCandidate extends SkillSummary {\n    readonly rank: number;\n    readonly locator: unknown;\n    readonly path?: string;\n    readonly metadata?: Readonly<Record<string, unknown>>;\n}',
   },
   {
     name: 'SkillDefinition',
-    declaration: 'export interface SkillDefinition extends SkillSummary {\n    content: string;\n    path?: string;\n    metadata?: Record<string, unknown>;\n}',
+    declaration: 'export interface SkillDefinition extends SkillSummary {\n    readonly content: string;\n    readonly path?: string;\n    readonly metadata?: Readonly<Record<string, unknown>>;\n}',
   },
   {
     name: 'SkillLookupOptions',
-    declaration: 'export interface SkillLookupOptions {\n    cwd?: string | undefined;\n    signal?: AbortSignal | undefined;\n}',
+    declaration: 'export interface SkillLookupOptions {\n    readonly cwd?: string | undefined;\n    readonly signal?: AbortSignal | undefined;\n}',
   },
   {
     name: 'SkillProvider',
-    declaration: 'export interface SkillProvider {\n    name: string;\n    list(options: SkillLookupOptions): Promise<SkillCandidate[]>;\n    get(candidate: SkillCandidate, options: SkillLookupOptions): Promise<SkillDefinition | undefined>;\n}',
+    declaration: 'export interface SkillProvider {\n    readonly name: string;\n    readonly list: (options: SkillLookupOptions) => Promise<readonly SkillCandidate[]>;\n    readonly get: (candidate: SkillCandidate, options: SkillLookupOptions) => Promise<SkillDefinition | undefined>;\n}',
   },
   {
     name: 'SkillRegistration',
-    declaration: 'export type SkillRegistration = Omit<SkillDefinition, \'provider\'> & {\n    provider?: string;\n};',
+    declaration: 'export type SkillRegistration = Omit<SkillDefinition, \'provider\'> & {\n    readonly provider?: string;\n};',
   },
   {
     name: 'SkillResourceBase',
-    declaration: 'export type SkillResourceBase = {\n    kind: \'directory\';\n    path: string;\n} | {\n    kind: \'url\';\n    url: string;\n} | {\n    kind: \'opaque\';\n    description: string;\n};',
+    declaration: 'export type SkillResourceBase = {\n    readonly kind: \'directory\';\n    readonly path: string;\n} | {\n    readonly kind: \'url\';\n    readonly url: string;\n} | {\n    readonly kind: \'opaque\';\n    readonly description: string;\n};',
   },
   {
     name: 'SkillSource',
@@ -833,7 +832,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'SkillSummary',
-    declaration: 'export interface SkillSummary {\n    name: string;\n    description: string;\n    whenToUse?: string;\n    disableModelInvocation?: boolean;\n    source: SkillSource;\n    provider: string;\n    resourceBase?: SkillResourceBase;\n}',
+    declaration: 'export interface SkillSummary {\n    readonly name: string;\n    readonly description: string;\n    readonly whenToUse?: string;\n    readonly disableModelInvocation?: boolean;\n    readonly source: SkillSource;\n    readonly provider: string;\n    readonly resourceBase?: SkillResourceBase;\n}',
   },
   {
     name: 'StreamChunk',
@@ -857,23 +856,23 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'SubagentCapabilities',
-    declaration: 'export interface SubagentCapabilities {\n    outputSchema: boolean;\n    depthLimit: boolean;\n    toolFilter: boolean;\n    persona: boolean;\n}',
+    declaration: 'export interface SubagentCapabilities {\n    readonly outputSchema: boolean;\n    readonly depthLimit: boolean;\n    readonly toolFilter: boolean;\n    readonly persona: boolean;\n}',
   },
   {
     name: 'SubagentProvider',
-    declaration: 'export interface SubagentProvider {\n    readonly name: string;\n    readonly capabilities: SubagentCapabilities;\n    readonly inheritsParentContext: boolean;\n    start(request: SubagentStartRequest): SubagentRun;\n}',
+    declaration: 'export interface SubagentProvider {\n    readonly name: string;\n    readonly capabilities: SubagentCapabilities;\n    readonly inheritsParentContext: boolean;\n    start(request: SubagentStartRequest): Promise<SubagentRun>;\n}',
   },
   {
     name: 'SubagentResult',
-    declaration: 'export interface SubagentResult {\n    output: ContentBlock[];\n    structured?: unknown;\n    stopReason: SubagentStopReason;\n}',
+    declaration: 'export interface SubagentResult {\n    readonly output: ContentBlock[];\n    readonly structured?: unknown;\n    readonly stopReason: SubagentStopReason;\n}',
   },
   {
     name: 'SubagentRun',
-    declaration: 'export interface SubagentRun {\n    readonly id: AgentId;\n    readonly started: Promise<void>;\n    readonly result: Promise<SubagentResult>;\n    cancel(reason?: string): void;\n    dispose(): Promise<void>;\n    sendMessage?(content: ContentBlock[]): void;\n    resume?(content: ContentBlock[]): SubagentRun;\n}',
+    declaration: 'export interface SubagentRun {\n    readonly id: AgentId;\n    readonly result: Promise<SubagentResult>;\n    dispose(): Promise<void>;\n    sendMessage?(content: ContentBlock[]): void;\n    resume?(content: ContentBlock[]): Promise<SubagentRun>;\n}',
   },
   {
     name: 'SubagentStartRequest',
-    declaration: 'export interface SubagentStartRequest {\n    prompt: ContentBlock[];\n    parent: Agent;\n    signal?: AbortSignal;\n    agentOptions?: AgentOptions;\n    outputSchema?: StructuredOutputSchema;\n    maxDepth?: number;\n    toolFilter?: {\n        allow?: string[];\n        deny?: string[];\n    };\n    persona?: string;\n}',
+    declaration: 'export interface SubagentStartRequest {\n    readonly prompt: ContentBlock[];\n    readonly parent: Agent;\n    readonly signal: AbortSignal;\n    readonly agentOptions?: AgentOptions;\n    readonly outputSchema?: StructuredOutputSchema;\n    readonly maxDepth?: number;\n    readonly toolFilter?: ToolRestriction;\n    readonly persona?: string;\n}',
   },
   {
     name: 'SubagentStopReason',
@@ -921,7 +920,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ToolDefinition',
-    declaration: 'export interface ToolDefinition extends ToolSchema {\n    execute(args: unknown, exec: ToolExecution): Promise<ToolExecuteReturn>;\n    timeoutMs?: number;\n    presentCall?(args: unknown): ToolCallView | undefined;\n    presentResult?(args: unknown, result: ToolResult): ToolResultView | undefined;\n}',
+    declaration: 'export interface ToolDefinition extends ToolSchema {\n    execute(args: unknown, exec: ToolExecution): Promise<ToolExecuteReturn>;\n    timeoutMs?: number;\n    readonly ownerFinal?: boolean;\n    presentCall?(args: unknown): ToolCallView | undefined;\n    presentResult?(args: unknown, result: ToolResult): ToolResultView | undefined;\n}',
   },
   {
     name: 'ToolErrorInfo',
@@ -945,7 +944,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ToolExecutionToken',
-    declaration: 'export interface ToolExecutionToken {\n    readonly [toolExecutionTokenBrand]: true;\n}',
+    declaration: 'export type ToolExecutionToken = symbol & {\n    readonly [toolExecutionTokenBrand]: true;\n};',
   },
   {
     name: 'ToolGuard',
@@ -953,11 +952,11 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ToolProviderResult',
-    declaration: 'export interface ToolProviderResult {\n    schemas: ToolSchema[];\n    knownNames?: readonly string[];\n}',
+    declaration: 'export interface ToolProviderResult {\n    readonly schemas: readonly ToolSchema[];\n    readonly knownNames?: readonly string[];\n    readonly ownerFinalNames?: readonly string[];\n}',
   },
   {
     name: 'ToolRestriction',
-    declaration: 'export interface ToolRestriction {\n    allow?: string[];\n    deny?: string[];\n}',
+    declaration: 'export interface ToolRestriction {\n    readonly allow?: readonly string[];\n    readonly deny?: readonly string[];\n}',
   },
   {
     name: 'ToolResult',
diff --git a/packages/cordis/tool-cordis/tests/cordis-lifecycle.spec.ts b/packages/cordis/tool-cordis/tests/cordis-lifecycle.spec.ts
new file mode 100644
index 0000000000..b290ae998e
--- /dev/null
+++ b/packages/cordis/tool-cordis/tests/cordis-lifecycle.spec.ts
@@ -0,0 +1,287 @@
+import { Context, CordisError, FiberState, type Fiber } from 'cordis'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * Direct regressions for the vendored Cordis ownership substrate used by
+ * tool-cordis's dynamic plugin tree and every other harness plugin.
+ */
+
+describe('Cordis effect ownership', () => {
+  it('makes an effect visible to a reentrant owner restart and awaits setup plus cleanup', async () => {
+    const ctx = new Context()
+    const setupGate = Promise.withResolvers<undefined>()
+    const cleanupGate = Promise.withResolvers<undefined>()
+    const cleanupStarted = Promise.withResolvers<undefined>()
+    let restarted!: Promise<void>
+    let setupFinished = false
+    let cleanupFinished = false
+
+    ctx.effect(async () => {
+      restarted = ctx.fiber.restart()
+      await setupGate.promise
+      setupFinished = true
+      return async () => {
+        cleanupStarted.resolve(undefined)
+        await cleanupGate.promise
+        cleanupFinished = true
+      }
+    }, 'reentrant-restart')
+
+    let settled = false
+    void restarted.then(() => { settled = true })
+    await Promise.resolve()
+    expect(settled).toBe(false)
+
+    setupGate.resolve(undefined)
+    await cleanupStarted.promise
+    expect(setupFinished).toBe(true)
+    await Promise.resolve()
+    expect(settled).toBe(false)
+
+    cleanupGate.resolve(undefined)
+    await restarted
+    expect(cleanupFinished).toBe(true)
+    expect(ctx.fiber.getEffects()).toEqual([])
+  })
+
+  it('rolls back collected cleanup and its owner-list entry when setup throws synchronously', () => {
+    const ctx = new Context()
+    let cleanups = 0
+
+    expect(() => ctx.effect(function* () {
+      yield () => { cleanups += 1 }
+      throw new Error('setup failed')
+    }, 'throwing-setup')).toThrow('setup failed')
+
+    expect(cleanups).toBe(1)
+    expect(ctx.fiber.getEffects()).toEqual([])
+  })
+
+  it('makes a reentrant owner restart await asynchronous rollback after synchronous setup failure', async () => {
+    const ctx = new Context()
+    const cleanupGate = Promise.withResolvers<undefined>()
+    const cleanupStarted = Promise.withResolvers<undefined>()
+    let restarted!: Promise<void>
+
+    expect(() => ctx.effect(function* () {
+      yield async () => {
+        cleanupStarted.resolve(undefined)
+        await cleanupGate.promise
+      }
+      restarted = ctx.fiber.restart()
+      throw new Error('setup failed after restart')
+    }, 'reentrant-throw')).toThrow('setup failed after restart')
+
+    await cleanupStarted.promise
+    let settled = false
+    void restarted.then(() => { settled = true })
+    await Promise.resolve()
+    expect(settled).toBe(false)
+
+    cleanupGate.resolve(undefined)
+    await restarted
+    expect(ctx.fiber.getEffects()).toEqual([])
+  })
+
+  it('keeps ordinary teardown synchronous and the public disposer single-shot', () => {
+    const ctx = new Context()
+    let cleanups = 0
+    const dispose = ctx.effect(() => () => { cleanups += 1 }, 'sync-effect')
+
+    expect(dispose()).toBeUndefined()
+    expect(cleanups).toBe(1)
+    expect(dispose()).toBeUndefined()
+    expect(cleanups).toBe(1)
+    expect(ctx.fiber.getEffects()).toEqual([])
+  })
+
+  it('rejects cleanup-time registration while a restart is unloading', async () => {
+    const ctx = new Context()
+    let registrationError: unknown
+
+    ctx.effect(() => () => {
+      try {
+        ctx.effect(() => () => {}, 'too-late')
+      } catch (error) {
+        registrationError = error
+      }
+    }, 'restart-cleanup')
+
+    await ctx.fiber.restart()
+    expect(registrationError).toBeInstanceOf(CordisError)
+    expect((registrationError as CordisError).code).toBe('INACTIVE_EFFECT')
+    expect(ctx.fiber.state).toBe(FiberState.ACTIVE)
+    expect(ctx.fiber.getEffects()).toEqual([])
+  })
+
+  it('keeps effect registration legal while child fibers are PENDING and LOADING', async () => {
+    const ctx = new Context()
+    let pendingCleanup = false
+    let loadingCleanup = false
+
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name !== 'state-probe' || fiber.uid === null) return
+      expect(fiber.state).toBe(FiberState.PENDING)
+      fiber.ctx.effect(() => () => { pendingCleanup = true }, 'pending-effect')
+    })
+
+    const fiber = await ctx.plugin({
+      name: 'state-probe',
+      apply(inner) {
+        expect(inner.fiber.state).toBe(FiberState.LOADING)
+        inner.effect(() => () => { loadingCleanup = true }, 'loading-effect')
+      },
+    })
+    await fiber.dispose()
+
+    expect(pendingCleanup).toBe(true)
+    expect(loadingCleanup).toBe(true)
+  })
+
+  it('resolves dependencies that internal/plugin adds before child activation', async () => {
+    const ctx = new Context()
+    ctx.provide('late-inject', {})
+    let applyCalls = 0
+
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name !== 'loader-shaped' || fiber.uid === null) return
+      fiber.inject['late-inject'] = {}
+    })
+
+    const fiber = await ctx.plugin({
+      name: 'loader-shaped',
+      apply() {
+        applyCalls += 1
+      },
+    })
+
+    expect(applyCalls).toBe(1)
+    expect(fiber.state).toBe(FiberState.ACTIVE)
+  })
+})
+
+describe('Cordis child publication ownership', () => {
+  it('rolls back parent and runtime ownership when internal/plugin publication throws', () => {
+    const ctx = new Context()
+    const plugin = { name: 'publication-failure', apply() {} }
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name === plugin.name) throw new Error('publication failed')
+    })
+
+    expect(() => ctx.plugin(plugin)).toThrow('publication failed')
+    expect(ctx.registry.has(plugin)).toBe(false)
+  })
+
+  it('contains teardown notification failures so ownership cleanup and peers complete', async () => {
+    const ctx = new Context()
+    const errors: unknown[] = []
+    ctx.logger.error = ((error: unknown) => { errors.push(error) }) as typeof ctx.logger.error
+    const observed: string[] = []
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name === 'contained-teardown' && fiber.uid === null) {
+        throw new Error('broken teardown observer')
+      }
+    })
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name === 'contained-teardown' && fiber.uid === null) observed.push('disposed')
+    })
+    const child = await ctx.plugin({ name: 'contained-teardown', apply() {} })
+
+    await expect(child.dispose()).resolves.toBeUndefined()
+    expect(observed).toEqual(['disposed'])
+    expect(errors).toHaveLength(1)
+    expect(errors[0]).toEqual(expect.objectContaining({ message: 'broken teardown observer' }))
+    expect(child.uid).toBeNull()
+  })
+
+  it('makes a LOADING parent join child cleanup started before its unload snapshot', async () => {
+    const ctx = new Context()
+    const cleanupGate = Promise.withResolvers<undefined>()
+    const cleanupStarted = Promise.withResolvers<undefined>()
+    let ownerFiber!: Fiber
+    let ownerDisposal!: Promise<void>
+    let childDisposal!: Promise<void>
+    let childFiber!: Fiber
+
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name !== 'loading-child' || fiber.uid === null) return
+      childFiber = fiber
+      fiber.ctx.effect(() => async () => {
+        cleanupStarted.resolve(undefined)
+        await cleanupGate.promise
+      }, 'loading-child-cleanup')
+      ownerDisposal = ownerFiber.dispose()
+      childDisposal = Promise.resolve(fiber.dispose())
+    })
+
+    const ownerMount = ctx.plugin({
+      name: 'loading-owner',
+      apply(inner) {
+        ownerFiber = inner.fiber
+        inner.plugin({ name: 'loading-child', apply() {} })
+      },
+    })
+
+    await cleanupStarted.promise
+    let ownerSettled = false
+    void ownerDisposal.then(() => { ownerSettled = true })
+    await Promise.resolve()
+    expect(ownerSettled).toBe(false)
+
+    cleanupGate.resolve(undefined)
+    await Promise.all([ownerDisposal, childDisposal, ownerMount])
+    expect(childFiber.uid).toBeNull()
+    expect(ownerFiber.uid).toBeNull()
+  })
+
+  it('lets parent disposal during internal/plugin await the unpublished child to quiescence', async () => {
+    const ctx = new Context()
+    let ownerCtx!: Context
+    const owner = await ctx.plugin({
+      name: 'owner',
+      apply(inner) {
+        ownerCtx = inner
+      },
+    })
+
+    const cleanupGate = Promise.withResolvers<undefined>()
+    const cleanupStarted = Promise.withResolvers<undefined>()
+    let cleanupFinished = false
+    let childApplyCalls = 0
+    let parentDisposal!: Promise<void>
+
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name !== 'child' || fiber.uid === null) return
+      expect(fiber.state).toBe(FiberState.PENDING)
+      fiber.ctx.effect(() => async () => {
+        cleanupStarted.resolve(undefined)
+        await cleanupGate.promise
+        cleanupFinished = true
+      }, 'pending-child-cleanup')
+    })
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name !== 'child' || fiber.uid === null) return
+      parentDisposal = owner.dispose()
+    })
+
+    const child = ownerCtx.plugin({
+      name: 'child',
+      apply() {
+        childApplyCalls += 1
+      },
+    })
+
+    await cleanupStarted.promise
+    let settled = false
+    void parentDisposal.then(() => { settled = true })
+    await Promise.resolve()
+    expect(settled).toBe(false)
+
+    cleanupGate.resolve(undefined)
+    await parentDisposal
+    expect(cleanupFinished).toBe(true)
+    expect(childApplyCalls).toBe(0)
+    expect(child.uid).toBeNull()
+    expect(child.state).toBe(FiberState.DISPOSED)
+  })
+})
diff --git a/packages/core/agent-loop/README.md b/packages/core/agent-loop/README.md
index 31bf9bf008..423127dd2c 100644
--- a/packages/core/agent-loop/README.md
+++ b/packages/core/agent-loop/README.md
@@ -8,16 +8,20 @@ This is the only package in the harness that contains concrete loop logic. Every
 
 ### Public API
 
-Lifecycle (scoped): programmatic creation and resume snapshot caller-owned identity/configuration data, reserve both IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. Resume installs an owner-liveness sentinel before persistence load, then hands ownership directly to the full lifecycle. After setup resolves, the factory checks its lifecycle flag, owner-fiber state, and owning agent status around one microtask checkpoint so a same-turn Cordis unload wins before publication. Successful setup inserts both session and agent before announcing either, enables driving immediately before `agent/session-start`, then starts the loop. Setup calls to `send`/`steer`/`inject`/`cancel` reject structurally; load/setup rejection or owner unload publishes nothing. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope. All `agent/*` dispatches go through `agentEvents(ctx, agent)`; per-step assembly through `assembleContextFor(agent)`; the turn-end durability checkpoint through `ctx.sessions.flush(session)`.
+Creation and resume are one rollback-covered transaction: construct a private session, concrete agent, and scoped context; await optional setup; enter both registries; announce `session/created` then `agent/created`; emit `agent/session-start`; and only then start the driver. Setup receives the full scoped `Context` as trusted same-process composition code and must not drive the unpublished agent. Ordinary typed identity and option inputs are borrowed under their readonly contract, while seed events and session metadata are validated and snapshotted because they cross the durable session boundary. An optional `AbortSignal` cancels only load/setup/publication and is detached before the returned handle becomes visible.
 
-- `ctx.agentLoop.create(id: string, options?: AgentOptions, meta?: { cwd?: string }): ReactLoopAgent` — config-driven create: an agent on a fresh per-run session id `${id}-session-<uuid>` with optional session metadata. Used for `cordis.yml`-configured agents. The per-run uuid avoids colliding with the on-disk log a prior run materialized once a durable persistence backend is loaded; each run is a new session (a deliberate demo simplification — a real resume-or-create policy is a TODO). Disposed with the calling fiber.
+The caller fiber and the AgentLoop provider are co-owners. `AgentFactory.createAgent(ownerCtx, options)` and `resume(ownerCtx, options)` receive caller ownership explicitly, while the factory keeps its own dependency context for `sessions`/`llm`/`tools`/`systemPrompt`; this lets a caller inject only `agents` without shrinking the new agent's service surface. Caller unload, handle disposal, or provider unload converge on one memoized quiescence boundary. Provider shutdown waits both resource teardown and the public create/resume wrapper that observed deactivation, so no continuation can publish after dependencies disappear.
+
+IDs are caller-chosen and assumed globally unique; accidental UUID collisions are outside the supported model. Two concurrent operations with the same agent or session id may both prepare, but the final `enter()` calls arbitrate publication and every loser rolls its private resources back. Each detach is bound to the exact entered object, so a stale disposer cannot remove a later same-id replacement. A detach requested during a synchronous creation notification waits for that dispatch to unwind, preserving created/disposed pairing. Teardown runs stop and drain (including outstanding idle-injection flushes) → detach agent → detach session → unwind scope; IDs become reusable at detach even if private scope cleanup is still finishing. Ordinary non-vetoing `agent/*` notifications go through `agentEvents(ctx, agent)`, per-step assembly goes through `assembleContextFor(agent)`, and turn-end durability checkpoints go through `ctx.sessions.flush(session)`.
+
+- `ctx.agentLoop.create(id: string, options?: AgentOptions, meta?: { cwd?: string }): ReactLoopAgent` — synchronous no-setup create, used directly by programs and by `cordis.yml`-configured agents. It creates a fresh per-run session id `${id}-session-<uuid>` with optional metadata; the uuid avoids colliding with a prior durable log. Each call is a new session (a deliberate demo simplification — a real resume-or-create policy is a TODO). Disposed with the calling fiber.
 
 `AgentLoop` also implements the `AgentFactory` seam and registers itself via `ctx.agents.setFactory(this)`, so plugins create/resume agents through `ctx.agents` (the interface):
 
-- `ctx.agents.create({ agentId, sessionId, meta?, seed?, agentOptions?, setup? }): Promise<AgentHandle>` — programmatic create on a caller-supplied `sessionId`, NOT `${id}-session`. It awaits the unpublished setup transaction before returning; `meta` carries cwd/lineage/seed-boundary metadata and `seed` reconstructs a forked child prefix. The resolved [`AgentHandle`](../agent/README.md) owns exact teardown.
-- `ctx.agents.resume({ agentId, resumeSessionId, agentOptions?, setup? }): Promise<AgentHandle>` — load a persisted session via `ctx.sessionPersistence` ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), reconstruct its history, then await setup against a fresh unpublished agent scope before rollback-covered publication. The live session id is the resumed id; turn numbering and derived history continue from the loaded log. Requires a session-persistence backend (NOT hard-injected — non-persistent demos still work; `resume` rejects with a clear error when persistence is absent). Returns an `AgentHandle`.
+- `ctx.agents.create({ agentId, sessionId, meta?, seed?, agentOptions?, setup?, signal? }): Promise<AgentHandle>` — programmatic create on a caller-supplied `sessionId`, NOT `${id}-session`. It awaits the unpublished setup transaction before returning; `meta` carries cwd/lineage/seed-boundary metadata and `seed` reconstructs a forked child prefix after the session boundary validates and snapshots the durable values. `signal` applies only until this promise settles. The resolved [`AgentHandle`](../agent/README.md) owns exact teardown.
+- `ctx.agents.resume({ agentId, resumeSessionId, agentOptions?, setup?, signal? }): Promise<AgentHandle>` — load a persisted session via `ctx.sessionPersistence` ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), reconstruct its history, then await setup against a fresh unpublished agent scope before rollback-covered publication. The live session id is the resumed id; turn numbering and derived history continue from the loaded log. Requires a session-persistence backend (NOT hard-injected — non-persistent demos still work; `resume` rejects with a clear error when persistence is absent). `signal` is creation-only. Returns an `AgentHandle`.
 
-The config-driven `ctx.agentLoop.create()` path keeps its agent owned by the loop fiber (it discards the handle) — only the programmatic factory callers (the ACP bridge and in-process subagent backends) hold a handle and own per-agent teardown.
+The config-driven `ctx.agentLoop.create()` path keeps its agent owned by the loop fiber (it discards the handle). For a programmatic agent, the handle holder is the only consumer-facing teardown capability; AgentLoop provider unload is the independent structural teardown edge, not another handle exposed to application code.
 
 ### Injected services
 
@@ -42,7 +46,7 @@ Agents listed in config are auto-created at startup. `cwd` applies only to fresh
 
 - `ReactLoopAgent` — the concrete `Agent` implementation. Its inbox is a JavaScript native-private field, and one prepared session can be claimed by only one concrete driver. Everything observable happens through session events and the `agent/*` event taxonomy.
 
-`Inbox`, `runLoop`, and the instance-bound enable/start controls are package-internal. The package root does not export them, and the package exports map exposes no `./src/*` escape hatch; lifecycle owners create agents through `ctx.agents` rather than constructing or starting the driver internals.
+`Inbox`, `runLoop`, and the instance-bound publication/start controls are package-internal. The package root does not export them, and the package exports map exposes no `./src/*` escape hatch; lifecycle owners create agents through `ctx.agents` rather than constructing or starting the driver internals. `ReactLoopAgent.send()` and running `steer()` materialize content plus resolved source once as detached, deeply frozen lossless JSON, then share that accepted record between `agent/queued` and the inbox; malformed data throws before either boundary.
 
 ### Loop lifecycle (`loop.ts`)
 
@@ -89,7 +93,7 @@ forever:
   idle unless more queued
 ```
 
-Error containment: a throwing plugin ends the **turn**, never the loop. A malformed or throwing `agent/turn-stop` policy likewise fails the turn closed. A successful terminal stop stays authoritative through `turn/end` and `session/flush`, preventing their listeners from resurrecting steering through the late fallback. Dispose mid-turn emits `agent/status('disposed')` and ends with reason `disposed`. A step that hits the model's output-token ceiling makes the turn end `max-tokens` (the rule: any `max-tokens` step in the turn surfaces as `max-tokens`; `disposed`/`aborted`/`error` still take precedence) — distinct from a clean `completed` stop.
+Error containment: a throwing plugin ends the **turn**, never the loop. A throwing `agent/turn-stop` policy likewise fails the turn closed. A successful terminal stop stays authoritative through `turn/end` and `session/flush`, preventing their listeners from resurrecting steering through the late fallback. Dispose mid-turn emits `agent/status('disposed')` and ends with reason `disposed`. A step that hits the model's output-token ceiling makes the turn end `max-tokens` (the rule: any `max-tokens` step in the turn surfaces as `max-tokens`; `disposed`/`aborted`/`error` still take precedence) — distinct from a clean `completed` stop.
 
 Cancellation: `agent.cancel()` is the single public stop primitive — it clears the queued + steering FIFOs, aborts the in-flight step, and drives a turn-scoped marker the driver checks at every point a turn could start or continue (right after the idle wait, after the `running` flip, before each step, and at the continuation gate) so a turn about to start is dropped. A cancelled turn ends `aborted`; a queued-but-not-started prompt never runs and cannot be batched into the cancelled turn. The marker is reset once per loop iteration, so a cancel governs exactly one turn and never leaks onto a later prompt. (The loop still aborts its own per-step `AbortController` directly on disposal and from `cancel()`; that controller is loop-internal, not a public verb.)
 
diff --git a/packages/core/agent-loop/src/agent.ts b/packages/core/agent-loop/src/agent.ts
index c4c35f34db..ff66f942be 100644
--- a/packages/core/agent-loop/src/agent.ts
+++ b/packages/core/agent-loop/src/agent.ts
@@ -7,43 +7,51 @@
  */
 
 import type { Context } from 'cordis'
-import { scopeTarget } from '@deepseek-ai/dsh-scope'
-import type { Scoped } from '@deepseek-ai/dsh-scope'
+import { agentEvents } from '@deepseek-ai/dsh-agent'
 import type { AgentId, AgentOptions, AgentStatus, SendOptions } from '@deepseek-ai/dsh-agent'
 import type { Agent } from '@deepseek-ai/dsh-agent'
+import { deepFreeze } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock, MessageSource } from '@deepseek-ai/dsh-llm'
-import type { Session } from '@deepseek-ai/dsh-session'
-import { Inbox } from './inbox.ts'
+import { snapshotJsonValue, type Session } from '@deepseek-ai/dsh-session'
+import { Inbox, type InboxMessage } from './inbox.ts'
 import { isTurnOpen, lastTurnNumber, runLoop } from './loop.ts'
 
-/** Agents whose rollback-covered publication enabled driving. */
-const driveEnabledAgents = new WeakSet<ReactLoopAgent>()
-
 /** Sessions already claimed by a concrete driver construction. */
 const claimedDriverSessions = new WeakSet<Session>()
 
 /** Module-private driver entry: its symbol is absent from the package surface. */
 const startDriver = Symbol('dsh.agent-loop.start-driver')
 
+/** Module-private quiescent stop, valid both before and after driver start. */
+const stopDriver = Symbol('dsh.agent-loop.stop-driver')
+
+/** Module-private context binding for the mutually referential agent scope. */
+const bindContext = Symbol('dsh.agent-loop.bind-context')
+
+/** Module-private publication marker. */
+const publishAgent = Symbol('dsh.agent-loop.publish-agent')
+
 /** Factory-owned controls that can operate only on the agent created with them. */
 export interface PreparedReactLoopAgent {
   /** The unpublished concrete agent. */
   agent: ReactLoopAgent
-  /** Open its driving verbs at the rollback-covered publication boundary. */
-  enableDrive(): void
+  /** Mark the agent public so teardown emits its status lifecycle. */
+  markPublished(): void
+  /** Stop the prepared instance even when publication has not started its loop. */
+  dispose(): Promise<void> | void
   /**
    * Start its driver after publication and session-start notification.
    * The returned disposer reaches quiescence for both the loop and every
    * fire-and-forget idle-injection flush the agent started.
    */
-  startDriver(): () => Promise<void>
+  startDriver(): () => Promise<void> | void
 }
 
 /**
  * Construct one concrete agent together with unforgeable, instance-bound
  * lifecycle controls. The package surface deliberately exposes neither source
  * subpaths nor this helper: setup code may identify the concrete class, but it
- * cannot enable or start the factory's unpublished instance.
+ * cannot publish or start the factory's unpublished instance.
  * @param ctx - the agent-loop service context used for driving and events.
  * @param id - the concrete agent identity.
  * @param options - loop options for the agent.
@@ -56,15 +64,32 @@ export function prepareReactLoopAgent(
   if (claimedDriverSessions.has(session)) {
     throw new Error(`session "${session.id}" already has a concrete agent driver`)
   }
-  claimedDriverSessions.add(session)
   const agent = new ReactLoopAgent(ctx, id, options, session)
+  claimedDriverSessions.add(session)
+  const dispose = () => agent[stopDriver]()
   return {
     agent,
-    enableDrive: () => { driveEnabledAgents.add(agent) },
-    startDriver: () => agent[startDriver](),
+    markPublished: () => { agent[publishAgent]() },
+    dispose,
+    startDriver: () => {
+      agent[startDriver]()
+      return dispose
+    },
   }
 }
 
+/**
+ * Install the concrete agent's scope context exactly once. Construction and
+ * scope minting are mutually referential (the scope key is the agent), so the
+ * factory performs this one post-construction binding before setup receives
+ * the unpublished agent. The module-private binding rejects a second bind.
+ * @param agent - the unpublished concrete agent to bind.
+ * @param ctx - its fully extended agent scope context.
+ */
+export function bindReactLoopAgentContext(agent: ReactLoopAgent, ctx: Context): void {
+  agent[bindContext](ctx)
+}
+
 /**
  * The concrete {@link Agent} implementation owned by the agent-loop plugin.
  *
@@ -73,7 +98,7 @@ export function prepareReactLoopAgent(
  * the agent/* event taxonomy — plugins never need this class.
  */
 export class ReactLoopAgent implements Agent {
-  /** Queued + steering FIFOs; native-private so setup cannot bypass driving verbs. */
+  /** Queued + steering FIFOs; native-private so callers cannot bypass the public driving verbs. */
   readonly #inbox = new Inbox()
 
   /**
@@ -84,21 +109,20 @@ export class ReactLoopAgent implements Agent {
    * context are mutually referential (the scope is keyed BY this agent), so
    * neither can exist strictly before the other.
    */
-  ctx!: Context
+  private boundContext: Context | undefined
 
-  /**
-   * The dispatch carrier for this agent's own emits (`agent/status`,
-   * `agent/queued`, `agent/error`): keyed by the agent, base = the agent
-   * (listener `this` is the agent). Built lazily because it is self-referential.
-   */
-  private get carrier(): Scoped<Agent> {
-    return (this.#carrier ??= scopeTarget(this, this))
+  /** The agent's scoped composition context, bound once by its factory. */
+  get ctx(): Context {
+    if (this.boundContext === undefined) throw new Error(`agent "${this.id}" context is not bound`)
+    return this.boundContext
   }
 
-  #carrier: Scoped<Agent> | undefined
-
   private _status: AgentStatus = 'idle'
   private currentAbort: AbortController | undefined
+  /** Whether runLoop has been installed into {@link done}. */
+  private driverStarted = false
+  /** Whether registry publication began and status disposal is externally visible. */
+  private published = false
   /**
    * Turn-scoped cancel marker, set by {@link cancel} and read/cleared by the
    * driver loop (via the LoopHandle) at every point a turn could start or
@@ -161,11 +185,7 @@ export class ReactLoopAgent implements Agent {
     // waiter (docs/defensive-patterns.md "contain callback exceptions" — a lifecycle await must
     // not hang on one bad listener).
     if (status !== 'running') this.settleIdleWaiters()
-    try {
-      this.loopCtx.emit(this.carrier, 'agent/status', this, status)
-    } catch (error: unknown) {
-      this.loopCtx.logger.warn(`agent "${this.id}": agent/status listener threw on ${status}: ${String(error)}`)
-    }
+    agentEvents(this.loopCtx, this).emit('agent/status', status)
   }
 
   /**
@@ -183,32 +203,45 @@ export class ReactLoopAgent implements Agent {
     return options?.source ?? { kind: 'user' }
   }
 
-  /** Reject every driving verb while creation setup still owns the agent. */
-  private assertDriveEnabled(action: string): void {
-    if (driveEnabledAgents.has(this)) return
-    throw new Error(`agent "${this.id}" cannot ${action} before creation setup completes`)
+  /**
+   * Accept one public send/steer payload as the exact detached record shared by
+   * the live notification and inbox. Lossless-JSON materialization reads every
+   * nested field once; deep freeze prevents an observer from rewriting queued
+   * work before the loop drains it.
+   */
+  private acceptInboxMessage(content: ContentBlock[], options?: SendOptions): InboxMessage {
+    const source = this.resolveSource(options)
+    const accepted = snapshotJsonValue({ content, source })
+    if (accepted === undefined) {
+      throw new TypeError('agent message content and source must be losslessly JSON-serializable')
+    }
+    return deepFreeze(accepted)
+  }
+
+  /** Reject a driving operation once teardown has synchronously closed the agent. */
+  private assertNotDisposed(): void {
+    if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`)
   }
 
   send(content: ContentBlock[], options?: SendOptions): void {
-    this.assertDriveEnabled('send')
-    if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`)
-    const source = this.resolveSource(options)
-    this.#inbox.enqueue({ content, source })
-    this.loopCtx.emit(this.carrier, 'agent/queued', this, content, { source, steering: false })
+    this.assertNotDisposed()
+    const accepted = this.acceptInboxMessage(content, options)
+    this.#inbox.enqueue(accepted)
+    const info = { source: accepted.source, steering: false } as const
+    agentEvents(this.loopCtx, this).emit('agent/queued', accepted.content, info)
   }
 
   steer(content: ContentBlock[], options?: SendOptions): void {
-    this.assertDriveEnabled('steer')
-    if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`)
+    this.assertNotDisposed()
     if (this._status !== 'running') { this.send(content, options); return }
-    const source = this.resolveSource(options)
-    this.#inbox.steer({ content, source })
-    this.loopCtx.emit(this.carrier, 'agent/queued', this, content, { source, steering: true })
+    const accepted = this.acceptInboxMessage(content, options)
+    this.#inbox.steer(accepted)
+    const info = { source: accepted.source, steering: true } as const
+    agentEvents(this.loopCtx, this).emit('agent/queued', accepted.content, info)
   }
 
   inject(content: ContentBlock[], options?: SendOptions): void {
-    this.assertDriveEnabled('inject')
-    if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`)
+    this.assertNotDisposed()
     const source = this.resolveSource(options)
     if (isTurnOpen(this.session)) {
       // A turn is open in the LOG (decided from the log, not agent status —
@@ -220,39 +253,21 @@ export class ReactLoopAgent implements Agent {
     // No turn open: wrap the injection in a one-shot turn so every event stays
     // turn-enclosed (the durability/replay boundary is the turn).
     const turn = lastTurnNumber(this.session) + 1
-    // Once turn/start enters the log, a turn/end is OWED no matter what — even
-    // if a throwing `session/event` listener escapes from the turn/start append
-    // (Session.append pushes the event BEFORE notifying listeners) or the
-    // context/message append throws (non-serializable content, throwing
-    // listener). The finally re-checks the log via isTurnOpen() and closes the
-    // turn if one was actually opened, so the log never carries a permanently
-    // open injection turn that would corrupt later turns/replay. (If the
-    // turn/start append throws BEFORE pushing — non-serializable trigger, which
-    // can't happen for our fixed trigger — no turn was opened and none is owed.)
+    // Once turn/start enters the log, a turn/end is owed even if the message
+    // append fails acceptance or pre-commit validation. The finally re-checks
+    // the log and closes only a turn that actually opened; post-commit observers
+    // are contained by Session and cannot create a false append failure.
     try {
       this.session.append('turn/start', { turn, trigger: { kind: 'injection', source } })
       this.session.append('context/message', { content, source }, { surfaceOp: 'append' })
     } finally {
-      // Close the turn if turn/start made it into the log. Contain a throwing
-      // turn/end listener: Session.append pushes before notifying, so a throw
-      // here still leaves turn/end in the log (the turn is balanced) — swallow
-      // it so it neither replaces the original exception nor skips the flush
-      // decision below. (It surfaces through the flush path is not needed; the
-      // turn-balance contract is what matters and it holds.)
+      // Close the turn if turn/start made it into the log. A pre-commit veto
+      // must escape rather than being mistaken for a committed turn/end.
       if (isTurnOpen(this.session)) {
-        try {
-          this.session.append('turn/end', { turn, reason: { kind: 'completed' } })
-        } catch {
-          // turn/end is already in the log (pushed before the listener threw),
-          // so the turn is balanced; the throw is the listener's bug.
-        }
+        this.session.append('turn/end', { turn, reason: { kind: 'completed' } })
       }
-      // Decide the durability checkpoint from the LOG, not a flag: a turn was
-      // recorded iff this turn's turn/start is logged (it may have been closed
-      // by a throwing-listener turn/end above, which still counts). A
-      // `turnRecorded` boolean set after append('turn/end') would be skipped by
-      // a throwing turn/end listener, losing the flush for a balanced in-memory
-      // turn (crash before the next turn/dispose would drop the idle injection).
+      // Decide the durability checkpoint from the log: an accepted one-shot
+      // turn must be flushed even when its message append was the failing step.
       const turnRecorded = this.session.events.some(e => e.type === 'turn/start' && e.data.turn === turn)
       // Checkpoint the one-shot turn for durability, exactly as the loop does at
       // every turn/end. The loop is NOT running (we are idle), so nothing else
@@ -269,14 +284,10 @@ export class ReactLoopAgent implements Agent {
       if (turnRecorded) {
         // Through the store's flush (the carrier owner), never a raw parallel.
         const flush = this.loopCtx.sessions.flush(this.session).catch((error: unknown) => {
-          const err = error instanceof Error ? error : new Error(String(error))
-          this.loopCtx.logger.warn(`agent "${this.id}": flush after idle injection failed: ${err.message}`)
-          try {
-            this.loopCtx.emit(this.carrier, 'agent/error', this, turn, 0, err)
-          } catch {
-            // contained: the failure is already logged; a throwing agent/error
-            // listener must not escape this fire-and-forget catch.
-          }
+          const rendered = renderThrown(error)
+          const err = error instanceof Error ? error : new Error(rendered)
+          this.loopCtx.logger.warn(`agent "${this.id}": flush after idle injection failed: ${rendered}`)
+          agentEvents(this.loopCtx, this).emit('agent/error', turn, 0, err)
         })
         this.pendingIdleFlushes.add(flush)
         // Attach the same retirement callback to both settlement arms so even a
@@ -290,7 +301,6 @@ export class ReactLoopAgent implements Agent {
   }
 
   cancel(reason?: string): void {
-    this.assertDriveEnabled('cancel')
     // Arm-gate: only mark a cancellation when there is actually work to cancel —
     // a running turn, an in-flight step, or queued/steering work. An idle cancel
     // with nothing pending is a true no-op; arming the marker then would wrongly
@@ -349,18 +359,25 @@ export class ReactLoopAgent implements Agent {
     })
   }
 
+  /** Bind the mutually referential scope context once. */
+  private [bindContext](ctx: Context): void {
+    if (this.boundContext !== undefined) throw new Error(`agent "${this.id}" context is already bound`)
+    this.boundContext = ctx
+  }
+
+  /** Mark that public lifecycle publication began. */
+  private [publishAgent](): void {
+    this.published = true
+  }
+
   /**
-   * Start the driver loop. Returns a disposer: calling it sets status to
-   * `disposed`, emits `agent/status('disposed')`, resolves the disposed
-   * promise (unblocking the idle wait), releases any `whenIdle` waiters, and
-   * aborts the current request if any. Its returned promise resolves only after
-   * the loop exits and every idle-injection flush started by this agent settles.
-   * @returns the disposer — idempotent, synchronously marks the agent disposed,
-   *   and asynchronously reaches loop + flush quiescence without rejecting (it
-   *   runs inside the fiber's LIFO disposal chain, where a rejection would skip
-   *   later disposers).
+   * Start the driver loop. The prepared controller already owns its stable
+   * disposer, so teardown can mark the agent disposed even in the narrow
+   * publication window before this method runs.
    */
-  [startDriver](): () => Promise<void> {
+  [startDriver](): void {
+    if (this._status === 'disposed') return
+    this.driverStarted = true
     this.done = runLoop(this.loopCtx, this, {
       inbox: this.#inbox,
       setStatus: (status) => { this.setStatus(status) },
@@ -378,39 +395,55 @@ export class ReactLoopAgent implements Agent {
       // that would resolve a freshly-queued prompt as cancelled.
       settleIdle: () => { this.settleIdleWaiters() },
     })
-    // The disposer must be infallible: it runs inside the fiber's LIFO
-    // disposal chain, where a throw would skip later disposers (e.g. the
-    // registry unregistration) and leave `done` pending forever.
-    return async () => {
-      if (this._status !== 'disposed') {
-        this._status = 'disposed'
-        this.resolveDisposed()
-        // Release whenIdle waiters BEFORE the (guarded) event emit — they are
-        // internal state that must settle even if a listener throws below. Each
-        // waiter chains `done`, so it resolves only once the loop actually exits.
-        this.settleIdleWaiters()
-        this.currentAbort?.abort('disposed')
-        // setStatus refuses transitions out of 'disposed', so emit directly —
-        // 'disposed' is part of the agent/status contract. Guarded: a throwing
-        // listener must not break the disposal chain.
-        try {
-          this.loopCtx.emit(this.carrier, 'agent/status', this, 'disposed')
-        } catch {
-          // listener error during disposal — nothing safe left to do with it
-        }
-      }
-      // An unexpected driver rejection must not skip registry/session/scope
-      // cleanup. The normal loop contains turn failures itself; allSettled is the
-      // final lifecycle backstop for anything outside those boundaries.
-      await Promise.allSettled([this.done])
-      // No new inject() can start after the synchronous disposed transition.
-      // Loop because settled tasks retire themselves in promise reactions that
-      // may run beside this continuation; either the set is empty or this waits
-      // the exact remaining quiescence boundary. allSettled keeps a failure in
-      // error reporting from skipping the registry/session/scope disposers.
-      while (this.pendingIdleFlushes.size > 0) {
-        await Promise.allSettled([...this.pendingIdleFlushes])
+  }
+
+  /**
+   * Quiescent stop shared by pre-start rollback and live teardown. It marks the
+   * agent disposed synchronously, contains an unexpected loop rejection, and
+   * drains every idle-injection flush before resolving.
+   */
+  private [stopDriver](): Promise<void> | void {
+    if (this._status !== 'disposed') {
+      this._status = 'disposed'
+      this.resolveDisposed()
+      // Release whenIdle waiters BEFORE the (guarded) event emit — they are
+      // internal state that must settle even if a listener throws below. Each
+      // waiter chains `done`, so it resolves only once the loop actually exits.
+      this.settleIdleWaiters()
+      this.currentAbort?.abort('disposed')
+      // An unpublished rollback has no public status lifecycle to announce.
+      // Once publication begins, disposed is part of the agent/status contract.
+      if (this.published) {
+        agentEvents(this.loopCtx, this).emit('agent/status', 'disposed')
       }
     }
+    // Before runLoop starts there is normally nothing asynchronous to drain;
+    // keep publication rollback synchronous so create() cannot throw while its
+    // session/agent entries are still briefly live. A session-start listener
+    // may have called inject(), however, so preserve
+    // its durability checkpoint as a real quiescence boundary.
+    if (!this.driverStarted && this.pendingIdleFlushes.size === 0) return
+    return this.drainDriver()
+  }
+
+  /** Await the loop (when started) and every outstanding idle flush. */
+  private async drainDriver(): Promise<void> {
+    // An unexpected driver rejection must not skip registry/session/scope
+    // cleanup. The normal loop contains turn failures itself; allSettled is the
+    // final lifecycle backstop for anything outside those boundaries.
+    await Promise.allSettled([this.done])
+    // No new inject() can start after the synchronous disposed transition.
+    // Loop because settled tasks retire themselves in promise reactions that
+    // may run beside this continuation; either the set is empty or this waits
+    // the exact remaining quiescence boundary. allSettled keeps a failure in
+    // error reporting from skipping registry/session/scope disposers.
+    while (this.pendingIdleFlushes.size > 0) {
+      await Promise.allSettled([...this.pendingIdleFlushes])
+    }
   }
 }
+
+/** Render an ordinary thrown value for the error event and log. */
+function renderThrown(value: unknown): string {
+  return value instanceof Error ? value.message : String(value)
+}
diff --git a/packages/core/agent-loop/src/index.ts b/packages/core/agent-loop/src/index.ts
index bd5b7e3188..4ad4779176 100644
--- a/packages/core/agent-loop/src/index.ts
+++ b/packages/core/agent-loop/src/index.ts
@@ -1,8 +1,6 @@
 /**
- * THE concrete agent plugin: creates ReactLoopAgents, runs their loops, and
- * registers them in ctx.agents. Deliberately thin — every behavior beyond
- * "call the model, run the tools, repeat" belongs to plugins on the event
- * taxonomy.
+ * Concrete agent-loop plugin: creates scoped ReactLoopAgents, publishes them
+ * through the agent/session registries, and owns their ordered teardown.
  *
  * @module @deepseek-ai/dsh-agent-loop
  */
@@ -13,73 +11,334 @@ import z from 'schemastery'
 import { createScope } from '@deepseek-ai/dsh-scope'
 import type { Scope } from '@deepseek-ai/dsh-scope'
 import { agentEvents } from '@deepseek-ai/dsh-agent'
-import type { AgentFactory, AgentHandle, AgentId, AgentOptions, CreateAgentOptions, ResumeAgentOptions, SessionStartSource } from '@deepseek-ai/dsh-agent'
+import type {
+  AgentFactory,
+  AgentHandle,
+  AgentId,
+  AgentOptions,
+  CreateAgentOptions,
+  ResumeAgentOptions,
+  SessionStartSource,
+} from '@deepseek-ai/dsh-agent'
 import type {} from '@deepseek-ai/dsh-llm'
-import { SessionId, type SessionHeader } from '@deepseek-ai/dsh-session'
-import type { Session } from '@deepseek-ai/dsh-session'
+import { SessionId } from '@deepseek-ai/dsh-session'
+import type { Session, SessionHeader } from '@deepseek-ai/dsh-session'
 import type {} from '@deepseek-ai/dsh-system-prompt'
 import type {} from '@deepseek-ai/dsh-tools'
 import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence'
-import { prepareReactLoopAgent, ReactLoopAgent } from './agent.ts'
+import {
+  bindReactLoopAgentContext,
+  prepareReactLoopAgent,
+  ReactLoopAgent,
+} from './agent.ts'
+import type { PreparedReactLoopAgent } from './agent.ts'
 
 export { ReactLoopAgent } from './agent.ts'
 
+/** Fiber states that cannot own or serve a new lifecycle. */
+const INACTIVE_STATES: ReadonlySet<FiberState> = new Set([
+  FiberState.UNLOADING,
+  FiberState.DISPOSED,
+  FiberState.FAILED,
+])
+
+/** Factory-level ownership of every preparing or live transaction. */
+class FactoryOwnership {
+  private accepting = true
+  private transactions = new Set<AgentCreationTransaction>()
+
+  constructor(private readonly fiber: Context['fiber']) {}
+
+  isActive(): boolean {
+    return this.accepting && !INACTIVE_STATES.has(this.fiber.state)
+  }
+
+  track(transaction: AgentCreationTransaction): () => void {
+    this.transactions.add(transaction)
+    return () => { this.transactions.delete(transaction) }
+  }
+
+  async dispose(): Promise<void> {
+    this.accepting = false
+    const reason = new Error('agent loop is not active')
+    await Promise.all(
+      [...this.transactions].map(transaction => transaction.disposeForFactory(reason)),
+    )
+  }
+}
+
+/** Build the public cancellation error while preserving a caller-supplied cause. */
+function signalAbortError(id: AgentId, signal: AbortSignal): Error {
+  if (signal.reason instanceof Error) return signal.reason
+  return new Error(`agent "${id}" creation aborted`, { cause: signal.reason })
+}
+
+/**
+ * One create/resume transaction from caller ownership through unpublished
+ * setup, rollback-covered publication, and final quiescent teardown.
+ *
+ * The class deliberately owns the state machine in one place. Registries only
+ * arbitrate identity at their final `enter()` calls; before that point every
+ * resource is private to this transaction.
+ */
+class AgentCreationTransaction {
+  private active = true
+  private failure: Error | undefined
+  private readonly deactivation = Promise.withResolvers<void>()
+  private readonly publication = Promise.withResolvers<void>()
+  private readonly torndown = Promise.withResolvers<void>()
+  private readonly wrapperCompletion = Promise.withResolvers<void>()
+  private preparing: Promise<void> | undefined
+  private driver: PreparedReactLoopAgent | undefined
+  private scope: Scope | undefined
+  private session: Session | undefined
+  private lifecycleDispose: (() => Promise<void> | void) | undefined
+  private detachSession: (() => void) | undefined
+  private detachAgent: (() => void) | undefined
+  private publishing = false
+  private cleanupTask: Promise<void> | undefined
+  private ownerFollowing = true
+  private readonly ownerDispose: () => Promise<void> | void
+  private readonly untrackFactory: () => void
+  private readonly abortListener: (() => void) | undefined
+  readonly ownerAgent: Context['agent']
+  readonly ownerFiber: Context['fiber']
+
+  constructor(
+    private readonly loopCtx: Context,
+    private readonly ownerCtx: Context,
+    private readonly ownership: FactoryOwnership,
+    readonly id: AgentId,
+    signal?: AbortSignal,
+  ) {
+    ownerCtx.fiber.assertActive()
+    this.ownerAgent = ownerCtx.agent
+    this.ownerFiber = ownerCtx.fiber
+    if (!ownership.isActive()) throw new Error('agent loop is not active')
+    this.ownerDispose = ownerCtx.effect(() => () => {
+      if (!this.ownerFollowing) return
+      return this.dispose(new Error(`agent "${id}" setup aborted: owner disposed during setup`))
+    }, `agentLoop.owner(${id})`)
+    this.untrackFactory = ownership.track(this)
+    if (signal === undefined) {
+      this.abortListener = undefined
+    } else {
+      this.abortListener = () => {
+        /* v8 ignore next 3 -- transaction teardown contains callback/driver failures; rejection is a future-drift backstop. */
+        void this.dispose(signalAbortError(id, signal)).catch((error: unknown) => {
+          this.loopCtx.logger.error(error)
+        })
+      }
+      signal.addEventListener('abort', this.abortListener, { once: true })
+      if (signal.aborted) this.deactivate(signalAbortError(id, signal))
+    }
+    this.signal = signal
+  }
+
+  private readonly signal: AbortSignal | undefined
+
+  /** Whether caller, provider, and optional parent-agent ownership remain live. */
+  isActive(): boolean {
+    return this.active
+      && this.ownership.isActive()
+      && this.ownerFiber.uid !== null
+      && !INACTIVE_STATES.has(this.ownerFiber.state)
+      && this.ownerAgent?.status !== 'disposed'
+  }
+
+  /** Fail synchronously at every real lifecycle boundary after deactivation. */
+  assertActive(): void {
+    if (this.isActive()) return
+    if (!this.ownership.isActive()) throw new Error('agent loop is not active')
+    throw this.failure ?? new Error(`agent "${this.id}" setup aborted: owner disposed during setup`)
+  }
+
+  /** Race an external async operation against structural/signal deactivation. */
+  async waitFor<T>(operation: PromiseLike<T> | T): Promise<T> {
+    this.assertActive()
+    return await Promise.race([
+      Promise.resolve(operation),
+      this.deactivation.promise.then(() => {
+        /* v8 ignore next -- deactivate() assigns failure before resolving deactivation. */
+        throw this.failure ?? new Error(`agent "${this.id}" creation deactivated`)
+      }),
+    ])
+  }
+
+  /** Construct the driver and scope, then install their complete ordered lifecycle. */
+  prepare(options: AgentOptions, session: Session): ReactLoopAgent {
+    this.assertActive()
+    const gate = Promise.withResolvers<void>()
+    this.preparing = gate.promise
+    try {
+      this.session = session
+      const driver = prepareReactLoopAgent(this.loopCtx, this.id, options, session)
+      this.driver = driver
+      const agent = driver.agent
+      const scope = createScope(this.loopCtx, agent)
+      this.scope = scope
+      bindReactLoopAgentContext(agent, scope.ctx.extend({ agent }))
+      this.installLifecycle(scope, driver)
+      this.assertActive()
+      return agent
+    } catch (error: unknown) {
+      if (!this.isActive() && error instanceof Error && /inactive context/.test(error.message)) {
+        throw this.failure ?? this.disposalReason()
+      }
+      throw error
+    } finally {
+      gate.resolve()
+      this.preparing = undefined
+    }
+  }
+
+  /** Register the exact scope disposer inside the ordered transaction effect. */
+  private installLifecycle(scope: Scope, driver: PreparedReactLoopAgent): void {
+    this.lifecycleDispose = this.ownerCtx.effect(function* (this: AgentCreationTransaction) {
+      // First yielded, disposed last.
+      yield () => { this.finish() }
+      yield scope.rawDispose
+      yield () => {
+        this.detachSession?.()
+        this.detachSession = undefined
+      }
+      yield () => {
+        this.detachAgent?.()
+        this.detachAgent = undefined
+      }
+      // Last yielded, disposed first.
+      yield () => {
+        this.deactivate(this.disposalReason())
+        if (this.publishing) {
+          return this.publication.promise.then(() => driver.dispose())
+        }
+        return driver.dispose()
+      }
+    }.bind(this), `agentLoop.lifecycle(${this.id})`)
+  }
+
+  /** Publish the exact prepared objects and start the driver. */
+  publish(source: SessionStartSource): AgentHandle {
+    this.assertActive()
+    const driver = this.driver
+    /* v8 ignore next -- publish() is private and every caller invokes prepare() first. */
+    if (driver === undefined) throw new Error(`agent "${this.id}" is not prepared`)
+    const agent = driver.agent
+    const session = this.session
+    /* v8 ignore next -- prepare() assigns the session before it can produce the driver above. */
+    if (session === undefined) throw new Error(`agent "${this.id}" has no prepared session`)
+    this.publishing = true
+    try {
+      this.detachSession = agent.ctx.sessions.enter(session)
+      this.detachAgent = this.loopCtx.agents.enter(agent)
+
+      agent.ctx.sessions.announce(session)
+      this.assertActive()
+      this.loopCtx.agents.announce(agent)
+      this.assertActive()
+
+      driver.markPublished()
+      agentEvents(this.loopCtx, agent).emit('agent/session-start', source)
+      this.assertActive()
+      driver.startDriver()
+      return { agent, dispose: () => this.dispose() }
+    } finally {
+      this.publishing = false
+      this.publication.resolve()
+    }
+  }
+
+  /** Mark the transaction inactive exactly once and wake load/setup races. */
+  private deactivate(reason: Error): void {
+    if (!this.active) return
+    this.active = false
+    this.failure = reason
+    this.deactivation.resolve()
+  }
+
+  /** Choose the structural cause when an owner/factory effect starts teardown first. */
+  private disposalReason(): Error {
+    if (this.failure !== undefined) return this.failure
+    if (!this.ownership.isActive()) return new Error('agent loop is not active')
+    if (this.ownerFiber.uid === null || INACTIVE_STATES.has(this.ownerFiber.state) || this.ownerAgent?.status === 'disposed') {
+      return new Error(`agent "${this.id}" setup aborted: owner disposed during setup`)
+    }
+    return new Error(`agent "${this.id}" lifecycle disposed`)
+  }
+
+  /** Complete ownership bookkeeping after every resource reached quiescence. */
+  private finish(): void {
+    this.untrackFactory()
+    this.ownerFollowing = false
+    void this.ownerDispose()
+    this.torndown.resolve()
+  }
+
+  /**
+   * Deactivate and quiesce this transaction. The promise is memoized because
+   * Cordis effect disposers are single-shot while handles promise shared
+   * quiescence to every racing owner.
+   */
+  dispose(reason = new Error(`agent "${this.id}" lifecycle disposed`)): Promise<void> {
+    this.deactivate(reason)
+    return (this.cleanupTask ??= (async () => {
+      if (this.preparing !== undefined) await this.preparing
+      if (this.lifecycleDispose !== undefined) {
+        await this.lifecycleDispose()
+        await this.torndown.promise
+        return
+      }
+      try {
+        await this.driver?.dispose()
+      } finally {
+        try {
+          await this.scope?.dispose()
+        } finally {
+          this.finish()
+        }
+      }
+    })())
+  }
+
+  /** Mark the public create/resume continuation settled and detach its creation-only signal. */
+  finishWrapper(): void {
+    if (this.signal !== undefined && this.abortListener !== undefined) {
+      this.signal.removeEventListener('abort', this.abortListener)
+    }
+    this.wrapperCompletion.resolve()
+  }
+
+  /** Factory shutdown joins both resource teardown and the public wrapper's deactivation continuation. */
+  async disposeForFactory(reason: Error): Promise<void> {
+    await this.dispose(reason)
+    await this.wrapperCompletion.promise
+  }
+}
+
 declare module 'cordis' {
   interface Context {
     agentLoop: AgentLoop
   }
 }
 
-/**
- * Plugin config: the agents to create — or resume, via `resumeSessionId` —
- * declaratively at startup, so a cordis.yml deployment needs no code.
- */
+/** Plugin configuration for declarative startup agents. */
 export interface Config {
-  /** Agents created from configuration at startup. */
+  /** Agents created or resumed at plugin startup. */
   agents: (AgentOptions & {
-    /** Agent id to register under; also seeds the fresh per-run session id (`${id}-session-<uuid>`). */
+    /** Registry identity for the live agent. */
     id: AgentId
-    /** Optional workspace cwd for the config-created fresh session. */
+    /** Optional workspace for a fresh session. */
     cwd?: string
-    /**
-     * If set, the config agent RESUMES this persisted session id instead of
-     * starting a fresh `${id}-session-<uuid>`. Sourced from an env var in
-     * cordis.yml (`resumeSessionId: !!js process.env.RESUME_SESSION_ID`), so a
-     * demo can continue a prior conversation without code changes. Requires a
-     * `dsh-session-persistence` backend; the resume is deferred until that
-     * service is available (via `ctx.inject`) and the loaded session's events
-     * seed the live session so history continues.
-     *
-     * The schema accepts a plain string at runtime (cordis.yml values are
-     * untyped); the brand is compile-time only — the config format is the
-     * boundary where an id enters, so the TYPE declares the brand here.
-     */
+    /** Persisted session to resume instead of creating a fresh session. */
     resumeSessionId?: SessionId
   })[]
 }
 
-/**
- * The agent-loop plugin (`ctx.agentLoop`): creates {@link ReactLoopAgent}s, runs
- * their loops, and registers them in `ctx.agents`. Also implements the
- * {@link AgentFactory} seam, so plugins create/resume agents through
- * `ctx.agents` (the interface) without depending on this concrete package.
- *
- * The loop itself is deliberately thin — every behavior beyond "call the
- * model, run the tools, repeat" belongs to plugins listening on the event
- * taxonomy declared in @deepseek-ai/dsh-agent.
- */
+/** Concrete ReactLoopAgent factory and driver service. */
 export class AgentLoop extends Service implements AgentFactory {
   static inject = ['agents', 'sessions', 'llm', 'tools', 'systemPrompt']
 
-  /** IDs held by unpublished async creation transactions. */
-  private pendingAgentIds = new Set<AgentId>()
-  private pendingSessionIds = new Set<SessionId>()
-
-  // The schema validates plain strings (cordis.yml config values are untyped at
-  // runtime); the {@link Config} TYPE declares the branded `id`/`resumeSessionId`
-  // because the config format is the boundary where an id enters. The brand is a
-  // zero-cost compile-time cast, so the runtime schema stays string-based and we
-  // assert the branded view once here — the single schema boundary.
+  /** Runtime schema for declarative agents. */
   static Config = z.object({
     agents: z.array(z.object({
       id: z.string().required(),
@@ -89,422 +348,143 @@ export class AgentLoop extends Service implements AgentFactory {
     })).default([]),
   }) as unknown as z<Config>
 
+  private readonly ownership: FactoryOwnership
+  /** Plain holder prevents Cordis from re-tracing the factory's dependency context through a caller shadow. */
+  private readonly runtime: { ctx: Context }
+
   constructor(ctx: Context, public config: Config) {
     super(ctx, 'agentLoop')
-    // Provide the agent-creation factory to the registry (effect-scoped: the
-    // slot is cleared on dispose).
-    ctx.effect(() => this.ctx.agents.setFactory(this), 'agentLoop.setFactory()')
-    // The prompt variables the shipped loop provides, registered once. The
-    // sections themselves (`harness:identity`, `deployment:persona`) belong to
-    // dsh-system-prompt — they must survive a swapped loop plugin — but
-    // `{{model}}`/`{{cwd}}` are runtime facts of the agents THIS loop drives:
-    // it assembles with `{ agent }` each step (loop.ts), and the variables
-    // project the agent's configured model and its session workspace from that
-    // context. A provider returns undefined when the fact is absent
-    // (renderPrompt then rejects a persona that claims it — fail loud).
+    this.ownership = new FactoryOwnership(ctx.fiber)
+    this.runtime = { ctx }
+    ctx.effect(() => () => this.ownership.dispose(), 'agentLoop.transactions()')
+    ctx.effect(() => ctx.agents.setFactory(this), 'agentLoop.setFactory()')
     ctx.systemPrompt.variable('model', context => context.agent?.options.model)
     ctx.systemPrompt.variable('cwd', context => context.agent?.session.header.cwd)
+
     for (const { id, cwd, resumeSessionId, ...options } of config.agents) {
-      if (resumeSessionId !== undefined && resumeSessionId !== '') {
-        // Resume a prior session instead of starting fresh. resume() needs
-        // `ctx.sessionPersistence`, which may load AFTER this plugin (cordis.yml
-        // lists the backend later). `ctx.inject(['sessionPersistence'], cb)`
-        // runs `cb` with a child ctx once the service exists; the child reads
-        // the persistence and hands it to resumeWith (which uses this.ctx — the
-        // parent — for sessions/registry, all in AgentLoop's static inject). A
-        // failed resume is contained + logged: startup must not crash.
-        ctx.effect(() => {
-          const fiber = this.ctx.inject(['sessionPersistence'], (childCtx: Context) => {
-            void this.resumeWith(childCtx.sessionPersistence, { agentId: id, resumeSessionId, agentOptions: options })
-              .catch((error: unknown) => {
-                this.ctx.logger.warn(`agent "${id}": config-driven resume of "${resumeSessionId}" failed: ${String(error)}`)
-              })
-          })
-          // Return the EXACT child-fiber disposer. Cordis moves a returned
-          // effect into this labeled owner's teardown tree by function
-          // identity; a wrapper would leave the child as a concurrent sibling
-          // and could discard its async quiescence promise.
-          return fiber.dispose
-        }, `agentLoop.resume(${id})`)
-      } else {
+      if (resumeSessionId === undefined || resumeSessionId === '') {
         this.create(id, options, cwd === undefined ? {} : { cwd })
+        continue
       }
+      ctx.effect(() => {
+        const fiber = ctx.inject(['sessionPersistence'], (childCtx: Context) => {
+          void this.resumeWith(ctx, childCtx.sessionPersistence, {
+            agentId: id,
+            resumeSessionId,
+            agentOptions: options,
+          }).catch((error: unknown) => {
+            ctx.logger.warn(`agent "${id}": config-driven resume of "${resumeSessionId}" failed: ${String(error)}`)
+          })
+        })
+        return fiber.dispose
+      }, `agentLoop.resume(${id})`)
     }
   }
 
   /**
-   * Config-driven create: an agent on a FRESH, non-colliding session id per run
-   * (`${id}-session-<uuid>`). Used for `cordis.yml`-configured agents and as
-   * the shared core for the programmatic factory {@link createAgent}.
-   *
-   * Why a per-run id, not a fixed `${id}-session`: once a durable persistence
-   * backend is loaded, a fixed id collides on the second run — the backend
-   * refuses to re-create an id whose log already exists on disk (the SessionId
-   * is the identity). A fresh id means each run is a new session.
-   *
-   * TODO(demo): each run starting a brand-new session is fine for demos but is
-   * NOT real conversation continuity. A production config-driven agent needs a
-   * deliberate resume-or-create policy (resume the prior session if one exists,
-   * else start fresh) or an explicit caller-chosen session id — revisit when the
-   * UI/ACP path owns session selection.
-   * @param id - the agent id; also seeds the generated session id.
-   * @param options - loop options (model, limits, …); defaults applied per option.
-   * @param meta - optional session metadata for the fresh session.
-   * @returns the running agent, owned by the calling fiber (no handle).
+   * Create an agent on a fresh per-run session, owned by the accessing fiber.
+   * Constructor-driven config calls use the loop fiber itself.
+   * @param id - agent registry id.
+   * @param options - concrete loop options.
+   * @param meta - optional fresh-session workspace metadata.
+   * @returns the published running agent.
    */
   create(id: AgentId, options: AgentOptions = {}, meta: Pick<SessionHeader, 'cwd'> = {}): ReactLoopAgent {
-    this.assertAgentIdFree(id)
-    // Config/programmatic path: prepare the session and let start() fold its
-    // lifecycle into the agent's composite effect (so a fiber unload tears the
-    // session + agent down as one ordered chain, capturing the loop's closing
-    // flush). The whole effect is owned by THIS fiber; no AgentHandle is needed.
-    const session = this.ctx.sessions.prepare(SessionId(`${id}-session-${randomUUID()}`), { meta })
-    const { agent } = this.start(id, options, session, 'startup')
-    return agent
-  }
-
-  /**
-   * Programmatic factory create ({@link AgentFactory}): an agent on a
-   * caller-supplied `sessionId` (NOT `${id}-session`), with optional session
-   * metadata (validated `cwd`, lineage) and an optional `seed` event prefix. The
-   * ACP bridge uses this so the client-generated session id becomes the
-   * live/persisted session id; the in-process FORK subagent backend passes a
-   * `seed` (a balanced completed-turn prefix of the parent's log) so the child
-   * starts with the parent's context. Returns an {@link AgentHandle} the owner
-   * disposes to tear down exactly this agent.
-   * @param options - agent id, caller-supplied session id, optional seed/meta,
-   *   and agent options.
-   * @returns the handle whose dispose tears down exactly this agent.
-   */
-  async createAgent(options: CreateAgentOptions): Promise<AgentHandle> {
-    // Snapshot every caller-owned field before the first async setup boundary.
-    // The callback itself is an identity capability; all data fields are
-    // detached so caller mutation cannot drift a reserved/published identity or
-    // the options the accepted agent observes.
-    const agentId = options.agentId
-    const sessionId = options.sessionId
-    const setup = options.setup
-    const agentOptions = structuredClone(options.agentOptions ?? {})
-    const seed = options.seed === undefined ? undefined : structuredClone(options.seed)
-    const meta = structuredClone(options.meta ?? {})
-    const release = this.reserve(agentId, sessionId)
+    const loopCtx = this.runtime.ctx
+    const transaction = new AgentCreationTransaction(loopCtx, this.ctx, this.ownership, id)
     try {
-      const session = this.ctx.sessions.prepare(sessionId, {
-        ...seed !== undefined ? { seed } : {},
-        meta,
-      })
-      // A seeded (forked) create is still a fresh start, NOT a resume.
-      return await this.startOwned(agentId, agentOptions, session, 'startup', setup)
+      const sessionId = SessionId(`${id}-session-${randomUUID()}`)
+      const session = loopCtx.sessions.prepare(sessionId, { meta })
+      const agent = transaction.prepare(options, session)
+      transaction.publish('startup')
+      return agent
+    } catch (error: unknown) {
+      void transaction.dispose(error instanceof Error ? error : new Error(String(error)))
+      throw error
     } finally {
-      release()
+      transaction.finishWrapper()
     }
   }
 
   /**
-   * Resume an agent on a persisted session ({@link AgentFactory}). Loads the
-   * session log + metadata via `ctx.sessionPersistence`, reconstructs the live
-   * session with the loaded events (so `lastTurnNumber`/`deriveMessages`
-   * continue), and starts a fresh agent on it. The live session id is the
-   * resumed id, NOT `${agentId}-session`.
-   *
-   * Requires `ctx.sessionPersistence`; rejects with a clear error if it is not
-   * configured. NOT hard-injected (that would make non-persistent demos pend
-   * forever) — callers that need resume (ACP) inject `sessionPersistence`, so
-   * by the time this runs the service exists.
-   * @param options - the persisted session id to reload, plus agent id/options.
-   * @returns the handle for the agent resumed on the reconstructed session.
+   * Create an owned agent on a caller-supplied session id.
+   * @param ownerCtx - caller context that structurally owns the transaction.
+   * @param options - identities, session seed/metadata, loop options, setup, and cancellation.
+   * @returns the published handle.
    */
-  async resume(options: ResumeAgentOptions): Promise<AgentHandle> {
-    // Read the service through `ctx.get('sessionPersistence')` — a direct
-    // global-store lookup keyed by the isolate symbol — NOT
-    // `this.ctx.sessionPersistence`. AgentLoop deliberately does NOT inject
-    // `sessionPersistence` (injecting it would pend non-persistent demos
-    // forever). The `ctx.<name>` property proxy resolves a service by an
-    // ancestor-only walk of the current fiber's parent chain; from AgentLoop's
-    // own fiber (which lacks the inject) that walk never reaches the sibling
-    // backend fiber and throws "cannot get property … without inject". Worse,
-    // when the call arrives via a traceable shadow (e.g. the ACP bridge child
-    // fiber → `ctx.agents.resume()` → `this.factory.resume()`), the walk starts
-    // at the shadow's origin fiber and fails the same way. `ctx.get(name)`
-    // sidesteps the fiber walk entirely (a store lookup by the global isolate
-    // key), so resume works from any caller fiber. It is strict by default: a
-    // backend that is not ACTIVE (absent, or mid-teardown) reads as undefined
-    // and we reject below, rather than handing back an unusable handle.
-    const persistence = this.ctx.get('sessionPersistence')
+  async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise<AgentHandle> {
+    const transaction = new AgentCreationTransaction(
+      this.runtime.ctx,
+      ownerCtx,
+      this.ownership,
+      options.agentId,
+      options.signal,
+    )
+    try {
+      const session = this.runtime.ctx.sessions.prepare(options.sessionId, {
+        ...options.seed === undefined ? {} : { seed: options.seed },
+        ...options.meta === undefined ? {} : { meta: options.meta },
+      })
+      const agent = transaction.prepare(options.agentOptions ?? {}, session)
+      await transaction.waitFor(options.setup?.(agent.ctx))
+      transaction.assertActive()
+      return transaction.publish('startup')
+    } catch (error: unknown) {
+      await transaction.dispose(error instanceof Error ? error : new Error(String(error)))
+      throw error
+    } finally {
+      transaction.finishWrapper()
+    }
+  }
+
+  /**
+   * Resume an owned agent from the configured persistence service.
+   * @param ownerCtx - caller context that owns load, setup, and the live lifecycle.
+   * @param options - persisted identity, loop options, setup, and cancellation.
+   * @returns the published handle.
+   */
+  async resume(ownerCtx: Context, options: ResumeAgentOptions): Promise<AgentHandle> {
+    const persistence = this.runtime.ctx.get('sessionPersistence')
     if (persistence === undefined) {
       throw new Error('cannot resume: session persistence is not configured (load a dsh-session-persistence backend)')
     }
-    return this.resumeWith(persistence, options)
+    return this.resumeWith(ownerCtx, persistence, options)
   }
 
-  /**
-   * Resume against an EXPLICIT persistence handle. Factored out of {@link resume}
-   * so the config-driven path can pass the handle it obtained from a
-   * `ctx.inject(['sessionPersistence'], …)` child context: `this.ctx` (the
-   * service's own fiber) did not inject `sessionPersistence`, so reading it
-   * there from inside the inject child trips the cordis inject guard. The
-   * sessions store + registry are still read through `this.ctx` (both are in
-   * AgentLoop's static inject, so they resolve fine).
-   */
-  private async resumeWith(persistence: SessionPersistence, options: ResumeAgentOptions): Promise<AgentHandle> {
-    // Persistence is an async trust boundary. Reserve, load, reconstruct, and
-    // publish only the identities/options accepted at entry—never fields
-    // reread from a caller-owned object after the await.
-    const agentId = options.agentId
-    const sessionId = options.resumeSessionId
-    const agentOptions = structuredClone(options.agentOptions ?? {})
-    const setup = options.setup
-    const { promise: ownerDisposed, resolve: markOwnerDisposed } = Promise.withResolvers<void>()
-    const { promise: transactionSettled, resolve: markTransactionSettled } = Promise.withResolvers<void>()
-    let observingOwner = true
-    // Resume must observe its caller from BEFORE persistence I/O begins. The
-    // full agent lifecycle does not exist until load returns, so without this
-    // sentinel a never-settling backend outlives owner disposal and holds both
-    // public identities forever. `this.ctx.effect` retains the traceable caller
-    // ownership used by startOwned's lifecycle effect. Install it before even
-    // reserving the ids: an inactive owner cannot leak a reservation if effect
-    // registration fails.
-    const disposeLoadSentinel = this.ctx.effect(() => () => {
-      if (!observingOwner) return
-      markOwnerDisposed()
-      // Owner-triggered teardown does not reach quiescence until the resume
-      // transaction has observed disposal and released both reservations.
-      return transactionSettled
-    }, `agentLoop.resumeLoad(${agentId})`)
-    try {
-      const release = this.reserve(agentId, sessionId)
-      try {
-        const loadTask = persistence.load(sessionId)
-        const { meta, events } = await Promise.race([
-          loadTask,
-          ownerDisposed.then(() => {
-            throw new Error(`agent "${agentId}" resume aborted: owner disposed during persistence load`)
-          }),
-        ])
-        // An out-of-band direct registry/session insertion can still race this
-        // service's reservation, so the public enter primitives re-check exact
-        // liveness at publication.
-        const session = this.ctx.sessions.prepare(sessionId, {
-          seed: events,
-          meta: {
-            createdAt: meta.createdAt,
-            ...meta.cwd !== undefined ? { cwd: meta.cwd } : {},
-            ...meta.parentSession !== undefined ? { parentSession: meta.parentSession } : {},
-            ...meta.seedLength !== undefined ? { seedLength: meta.seedLength } : {},
-          },
-        })
-        // Calling startOwned synchronously installs the complete lifecycle
-        // effect before it reaches its first setup await. Only then disarm the
-        // load sentinel: ownership passes directly from one effect to the other
-        // with no disposal gap.
-        const starting = this.startOwned(agentId, agentOptions, session, 'resume', setup)
-        observingOwner = false
-        await disposeLoadSentinel()
-        return await starting
-      } finally {
-        release()
-      }
-    } finally {
-      try {
-        // Manual handoff/removal must not return transactionSettled: awaiting
-        // that promise from inside this transaction would deadlock it. If the
-        // owner already triggered cleanup, this idempotent second disposal is a
-        // no-op and the owner's first cleanup remains parked on the shared
-        // settlement promise.
-        observingOwner = false
-        await disposeLoadSentinel()
-      } finally {
-        markTransactionSettled()
-      }
-    }
-  }
-
-  /**
-   * Reject a duplicate agent id BEFORE the session is entered into the store, so
-   * a failed factory call never leaves an orphaned live session (and lazy
-   * persistence state) behind. `register()` enforces the same uniqueness, but
-   * only after the session has already entered the store.
-   */
-  private assertAgentIdFree(id: AgentId): void {
-    if (this.ctx.agents.get(id) !== undefined || this.pendingAgentIds.has(id)) {
-      throw new Error(`agent "${id}" is already registered`)
-    }
-  }
-
-  /** Reserve both public identities for one unpublished async transaction. */
-  private reserve(agentId: AgentId, sessionId: SessionId): () => void {
-    this.assertAgentIdFree(agentId)
-    if (this.ctx.sessions.get(sessionId) !== undefined || this.pendingSessionIds.has(sessionId)) {
-      throw new Error(`session "${sessionId}" already exists`)
-    }
-    this.pendingAgentIds.add(agentId)
-    this.pendingSessionIds.add(sessionId)
-    return () => {
-      this.pendingAgentIds.delete(agentId)
-      this.pendingSessionIds.delete(sessionId)
-    }
-  }
-
-  /**
-   * Construct an unpublished agent and synchronously install its complete
-   * teardown skeleton before any setup await. The closures are assigned their
-   * session/registry/loop disposers only at publication, while the exact scope
-   * disposer is nested immediately. Therefore owner unload during setup flips
-   * `active`, unwinds the scope, and wins the race without any late Cordis
-   * effect collection.
-   */
-  private prepareLifecycle(id: AgentId, options: AgentOptions, session: Session): {
-    agent: ReactLoopAgent
-    active: () => boolean
-    deactivated: Promise<void>
-    publish: (source: SessionStartSource) => void
-    disposeAgent: () => Promise<void>
-  } {
-    // When creation is invoked through an agent scope (subagents), the owner
-    // agent's disposed status flips synchronously at handle teardown—earlier
-    // than Cordis reaches nested scope effects. Include that signal in the
-    // pre-publication liveness check so a same-turn parent dispose cannot race
-    // an already-fulfilled setup promise into briefly publishing a child.
-    const ownerAgent = this.ctx.agent
-    const ownerFiber = this.ctx.fiber
-    const driver = prepareReactLoopAgent(this.ctx, id, options, session)
-    const { agent } = driver
-    const scope: Scope = createScope(this.ctx, agent)
-    agent.ctx = scope.ctx.extend({ agent })
-
-    let active = true
-    let detachSession: (() => void) | undefined
-    let detachAgent: (() => void) | undefined
-    let stop: (() => Promise<void>) | undefined
-    const { promise: deactivated, resolve: markDeactivated } = Promise.withResolvers<void>()
-    const { promise: torndown, resolve: markTorndown } = Promise.withResolvers<void>()
-
-    const dispose = this.ctx.effect(function* () {
-      // First yielded, disposed last: every preceding teardown stage settled.
-      yield () => { markTorndown() }
-      // Exact identity moves the scope fiber out of the owner's concurrent
-      // sibling list and into this ordered transaction.
-      yield scope.rawDispose
-      yield () => {
-        detachSession?.()
-        detachSession = undefined
-      }
-      yield () => {
-        detachAgent?.()
-        detachAgent = undefined
-      }
-      // Last yielded, disposed first. Keep the pre-publication path
-      // synchronous: returning a Promise only after the loop actually began
-      // lets a failed announcement roll back registry/store before create's
-      // rejection is observed.
-      yield () => {
-        active = false
-        markDeactivated()
-        if (stop === undefined) return
-        return stop()
-      }
-    }, 'agentLoop.lifecycle()')
-
-    let disposing: Promise<void> | undefined
-    const disposeAgent = (): Promise<void> => (disposing ??= (async () => {
-      await dispose()
-      await torndown
-    })())
-
-    const publish = (source: SessionStartSource): void => {
-      // Publication is one synchronous, rollback-covered sequence. Setup has
-      // already completed, so its scoped listeners observe both announcements.
-      detachSession = agent.ctx.sessions.enter(session)
-      detachAgent = this.ctx.agents.enter(agent)
-      this.ctx.sessions.announce(session)
-      this.ctx.agents.announce(agent)
-      // Setup is over and both entries are live. Open the driving surface just
-      // before session-start so its listeners retain their supported ability to
-      // inject/queue, while setup itself can never drive an unpublished agent.
-      driver.enableDrive()
-      try {
-        agentEvents(this.ctx, agent).emit('agent/session-start', source)
-      } catch (error: unknown) {
-        this.ctx.logger.warn(`agent "${id}": agent/session-start listener threw: ${String(error)}`)
-      }
-      stop = driver.startDriver()
-    }
-
-    return {
-      agent,
-      active: () => active
-        && ownerFiber.state !== FiberState.UNLOADING
-        && ownerFiber.state !== FiberState.DISPOSED
-        && ownerFiber.state !== FiberState.FAILED
-        && ownerAgent?.status !== 'disposed',
-      deactivated,
-      publish,
-      disposeAgent,
-    }
-  }
-
-  /** Publish a no-setup config agent synchronously. */
-  private start(
-    id: AgentId, options: AgentOptions, session: Session, source: SessionStartSource,
-  ): { agent: ReactLoopAgent; disposeAgent: () => Promise<void> } {
-    const lifecycle = this.prepareLifecycle(id, options, session)
-    try {
-      lifecycle.publish(source)
-      return { agent: lifecycle.agent, disposeAgent: lifecycle.disposeAgent }
-    } catch (error: unknown) {
-      void lifecycle.disposeAgent()
-      throw error
-    }
-  }
-
-  /**
-   * Build an {@link AgentHandle} for a PREPARED session + a fresh agent. The
-   * handle's `dispose()` runs the composite effect's disposer (see
-   * {@link start}) — which stops the loop, awaits its exit and outstanding
-   * idle-injection flushes, unregisters the agent, and detaches the session, in
-   * that order.
-   * The same composite effect is what a fiber unload disposes, so both teardown
-   * triggers honor the ordering identically.
-   *
-   * `dispose()` is MEMOIZED: the underlying cordis effect disposer is
-   * single-shot (a second call returns immediately because the effect's epoch is
-   * already cleared, NOT awaiting the in-flight teardown), so concurrent/repeated
-   * `dispose()` calls would otherwise resolve before the first call's
-   * loop + flush quiescence boundary completed. Memoizing the promise makes
-   * every caller observe that SAME boundary, honoring the
-   * `AgentHandle.dispose(): Promise<void>` contract (mirrors the ACP `quiesce()`
-   * helper).
-   */
-  private async startOwned(
-    id: AgentId, options: AgentOptions, session: Session, source: SessionStartSource,
-    setup?: (agentCtx: Context) => Promise<void> | void,
+  /** Resume through an explicit persistence handle used by the deferred config path. */
+  private async resumeWith(
+    ownerCtx: Context,
+    persistence: SessionPersistence,
+    options: ResumeAgentOptions,
   ): Promise<AgentHandle> {
-    const lifecycle = this.prepareLifecycle(id, options, session)
+    const transaction = new AgentCreationTransaction(
+      this.runtime.ctx,
+      ownerCtx,
+      this.ownership,
+      options.agentId,
+      options.signal,
+    )
     try {
-      // The owner-disposal branch makes a never-settling setup unable to hold
-      // the transaction or its ID reservations forever. Promise.race installs
-      // rejection observation on setup even if owner disposal wins first.
-      const setupTask = Promise.resolve(setup?.(lifecycle.agent.ctx))
-      await Promise.race([
-        setupTask,
-        lifecycle.deactivated.then(() => {
-          throw new Error(`agent "${id}" setup aborted: owner disposed during setup`)
-        }),
-      ])
-      // Cordis begins a fiber unload synchronously but invokes nested effect
-      // disposers from its next microtask. Give that already-started unload one
-      // checkpoint to deactivate this lifecycle before publication; otherwise
-      // an immediately fulfilled setup continuation can outrun its owner's
-      // same-turn dispose and briefly publish an already-doomed child.
-      await Promise.resolve()
-      if (!lifecycle.active()) {
-        throw new Error(`agent "${id}" setup aborted: owner disposed during setup`)
-      }
-      lifecycle.publish(source)
-      return { agent: lifecycle.agent, dispose: lifecycle.disposeAgent }
+      const loaded = await transaction.waitFor(persistence.load(options.resumeSessionId))
+      transaction.assertActive()
+      const session = this.runtime.ctx.sessions.prepare(options.resumeSessionId, {
+        seed: loaded.events,
+        meta: {
+          createdAt: loaded.meta.createdAt,
+          ...loaded.meta.cwd === undefined ? {} : { cwd: loaded.meta.cwd },
+          ...loaded.meta.parentSession === undefined ? {} : { parentSession: loaded.meta.parentSession },
+          ...loaded.meta.seedLength === undefined ? {} : { seedLength: loaded.meta.seedLength },
+        },
+      })
+      const agent = transaction.prepare(options.agentOptions ?? {}, session)
+      await transaction.waitFor(options.setup?.(agent.ctx))
+      transaction.assertActive()
+      return transaction.publish('resume')
     } catch (error: unknown) {
-      await lifecycle.disposeAgent()
+      await transaction.dispose(error instanceof Error ? error : new Error(String(error)))
       throw error
+    } finally {
+      transaction.finishWrapper()
     }
   }
 }
diff --git a/packages/core/agent-loop/src/loop.ts b/packages/core/agent-loop/src/loop.ts
index 8c30e42257..7a7ca2e28c 100644
--- a/packages/core/agent-loop/src/loop.ts
+++ b/packages/core/agent-loop/src/loop.ts
@@ -11,7 +11,7 @@ import type { Context } from 'cordis'
 import type { FinishReason, GenerateOptions, LlmCallConfig, Message } from '@deepseek-ai/dsh-llm'
 import { BlockAssembler, HarnessError, deepFreeze } from '@deepseek-ai/dsh-llm'
 import { agentEvents, assembleContextFor } from '@deepseek-ai/dsh-agent'
-import type { AgentEventDispatch, ContinuationDecision, ContinuationStop, HookContext, PromptDecision } from '@deepseek-ai/dsh-agent'
+import type { AgentEventDispatch, ContinuationDecision, HookContext, PromptDecision } from '@deepseek-ai/dsh-agent'
 import { canonicalHeader } from '@deepseek-ai/dsh-session'
 import type { Session, TurnEndReason, TurnTrigger } from '@deepseek-ai/dsh-session'
 import { createTransmissionLog, recordRequestHeader } from './request-log.ts'
@@ -36,20 +36,6 @@ function toError(error: unknown): CodedError {
   return error instanceof Error ? error : new HarnessError(String(error), 'UNKNOWN', { cause: error })
 }
 
-/**
- * Validate the runtime result of the terminal-stop serial event. Event types
- * protect TypeScript listeners, but JavaScript and casts can still return an
- * arbitrary bail value; accepting one as an implicit stop would hide a broken
- * policy plugin.
- */
-function assertContinuationStop(value: unknown): asserts value is ContinuationStop | undefined {
-  if (value === undefined) return
-  const candidate = Object(value) as { action?: unknown }
-  if (candidate.action !== 'stop') {
-    throw new Error('agent/turn-stop returned an invalid result; expected { action: \'stop\' } or undefined')
-  }
-}
-
 /**
  * Map a model-call {@link FinishReason} to the step error it should raise, or
  * `undefined` when the step completed normally.
@@ -291,6 +277,9 @@ export async function runLoop(ctx: Context, agent: ReactLoopAgent, handle: LoopH
       // the previous turn/end), where the persistence backend drops it as a
       // crash tail (the turn-enclosure RFC). Report via agent/error + the logger only; the
       // driver survives and moves on.
+      // Acceptance and internal dispatch validation can reject before
+      // turn/start commits. Report that supported pre-turn failure without
+      // inventing a turn/end for a turn that never opened.
       const err = toError(error)
       ctx.logger.warn(`agent "${agent.id}": turn ${turn} failed before it started: ${err.message}`)
       try {
@@ -342,34 +331,14 @@ async function runTurn(
   let errorReported = false
   let terminalStopped = false
 
-  // Close the open step exactly once (idempotent via stepOpen). Step boundaries
-  // are durable session events only — there is no agent/* step emit to mirror
-  // them (see the agent event-domain rule). A throwing step/end session-event
-  // listener must not abort finalization and strand the turn open (turn/end
-  // balance > notifying one bad listener); it is contained and surfaced as a
-  // turn error below.
-  const closeStep = (): boolean => {
-    if (!stepOpen) return false
+  // Close the open step exactly once (idempotent via stepOpen). Post-commit
+  // session/event observers are contained by Session; a pre-commit validator
+  // failure still escapes so the outer recovery path may retry the boundary or
+  // fail loudly without pretending an uncommitted step/end exists.
+  const closeStep = (): void => {
+    if (!stepOpen) return
+    session.append('step/end', { turn, step })
     stepOpen = false
-    // Session.append pushes step/end BEFORE notifying session/event listeners,
-    // so a throwing listener leaves step/end in the log (balance holds) but
-    // would otherwise abort finalization. Contain it and surface it as a turn
-    // error below.
-    let failure: unknown
-    try {
-      session.append('step/end', { turn, step })
-    } catch (error: unknown) {
-      failure = error
-    }
-    // A throwing step/end session-event listener surfaces as a turn error via
-    // failTurn (idempotent). This prevents a throwing listener from producing a
-    // silent "completed" turn when the step itself succeeded, AND keeps
-    // finalization going when closeStep runs from the outer catch.
-    if (failure !== undefined) {
-      failTurn(toError(failure))
-      return true
-    }
-    return false
   }
 
   // Record a step/turn failure exactly once: set the error reason (carrying the
@@ -381,12 +350,9 @@ async function runTurn(
   const failTurn = (err: CodedError): void => {
     if (errorReported) return
     errorReported = true
-    // The turn is always still open here: the only failure that can reach
-    // failTurn once turn/end is appended would be a throwing turn-boundary
-    // listener, and turn boundaries are durable session events with no agent/*
-    // mirror to throw. A throwing `turn/end` session-event listener is already
-    // contained inside closeTurn (append pushes before notifying, so the
-    // boundary is durable). So set the error reason for closeTurn to append.
+    // The turn is still open here. Post-commit observers cannot escape append,
+    // and a pre-commit turn/end veto leaves no closing boundary to overwrite.
+    // Set the reason that the next successful closeTurn will append.
     reason = { kind: 'error', step, ...errorData(err) }
     try {
       events.emit('agent/error', turn, step, err)
@@ -396,30 +362,17 @@ async function runTurn(
     }
   }
 
-  // Close the turn. Called exactly once per turn — the normal loop exit and the
-  // outer catch are mutually exclusive paths, and this never throws (the append
-  // is contained below), so there is no re-entry to guard against (unlike
-  // closeStep, which the cancel branches and the outer catch can both reach).
-  // Turn boundaries are durable session events only — there is no agent/* turn
-  // emit to mirror them (see the agent event-domain rule).
+  // Close the turn. Post-commit observer failures are contained by Session;
+  // pre-commit validation failures escape to recovery instead of being mistaken
+  // for a committed boundary. Turn boundaries are durable session events only.
   const closeTurn = (): void => {
-    // Session.append pushes turn/end BEFORE notifying session/event listeners,
-    // so a throwing listener leaves turn/end in the log (the turn is balanced)
-    // but would otherwise escape — from the outer catch it would propagate to
-    // the runLoop backstop. Contain it: the boundary is durable either way, and
-    // finalization must not abort on a bad listener.
-    try {
-      session.append('turn/end', { turn, reason })
-    } catch (error: unknown) {
-      ctx.logger.warn(`agent "${agent.id}": session/event listener threw on turn/end at turn ${turn}: ${toError(error).message}`)
-    }
+    session.append('turn/end', { turn, reason })
   }
 
   try {
     // --- Turn boundary. Once turn/start is appended, a turn/end is owed no
-    // matter what throws below; the catch + closeTurn guarantee it (the catch
-    // decides "owed" from the log via isTurnOpen, so even a throwing turn/start
-    // listener — append pushes before notifying — still gets its turn/end).
+    // matter what throws below; the catch + closeTurn guarantee it. A pre-commit
+    // veto leaves no turn/start in the log and therefore owes no turn/end.
     session.append('turn/start', { turn, trigger })
     // Each drained queued message runs the `agent/prompt-submit` waterfall before
     // it becomes a `user/message` — a hook can rewrite the prompt or block it.
@@ -577,20 +530,19 @@ async function runTurn(
       // messages are snapshotted HERE, in the same synchronous frame as the
       // step/start append directly below — so the snapshot is exactly the
       // derivation over the log prefix strictly before step/start's seq.
-      // Anything appended later — by a step/start session/event listener, an
-      // agent/request-window inject(), any concurrent task — lands after the
-      // boundary and joins the NEXT request. An external reconstructor
+      // Anything appended later by the request-window inject seam or a
+      // concurrent task lands after the boundary and joins the NEXT request.
+      // session/event itself is observe-only: append reentrancy is rejected
+      // until the current callback list drains. An external reconstructor
       // recovers these exact messages by folding the surface over
       // events[0..stepStartSeq).
       const boundaryMessages = session.deriveMessages()
 
-      // Mark the step open BEFORE the append: Session.append pushes the event
-      // to the log before notifying session/event listeners, so a THROWING
-      // step/start listener leaves step/start in the log. Setting stepOpen first
-      // means the outer catch's closeStep() then appends the balancing step/end
-      // (turn stays enclosed) instead of stranding an open step under turn/end.
-      stepOpen = true
       session.append('step/start', { turn, step })
+      // Only a committed step/start creates a balancing obligation. A
+      // pre-commit veto throws before this assignment; post-commit observers
+      // are contained inside Session.append().
+      stepOpen = true
 
       // Cancel landing in the step-start window: a synchronous `session/event`
       // step/start listener can cancel after the step is already open. Check
@@ -643,7 +595,7 @@ async function runTurn(
       // Steering that arrived during streaming/tool execution.
       const steered = drainSteering(agent, handle.inbox, turn)
 
-      if (closeStep()) break
+      closeStep()
 
       const defaultDecision: ContinuationDecision = { action: stepOutcome.hadToolCalls || steered ? 'continue' : 'stop' }
       let decision: ContinuationDecision
@@ -678,8 +630,7 @@ async function runTurn(
       // no later listener or steering override can resurrect the turn.
       let terminalStop = false
       try {
-        const stop = await events.strictSerial('agent/turn-stop', turn)
-        assertContinuationStop(stop)
+        const stop = await events.serial('agent/turn-stop', turn)
         terminalStop = stop !== undefined
       } catch (error: unknown) {
         // A broken terminal policy is an ordinary continuation failure: fail
@@ -717,21 +668,10 @@ async function runTurn(
     // Normal / inline-error loop exit: close the turn.
     closeTurn()
   } catch (error: unknown) {
-    // Decide whether this turn was ever opened from the LOG, not a flag.
-    // Session.append pushes the event BEFORE notifying session/event listeners,
-    // so a throwing listener on the `turn/start` append leaves turn/start in the
-    // log even though execution never reached the lines after that append.
-    // Gating on a "turn started" boolean would skip turn/end and leave a
-    // permanently OPEN turn that poisons the next turn/replay (the turn-enclosure RFC). We
-    // check the log for THIS turn's turn/start: present means a turn/end is owed
-    // and the normal-exit `closeTurn()` did NOT run (we are here because a throw
-    // preceded it — the two `closeTurn()` sites are on mutually exclusive paths),
-    // so this catch appends turn/end with the disposed/error reason chosen below.
-    // `closeStep()` IS idempotent (guarded by `stepOpen`) — it may have run
-    // already in a step branch, so running it again is a safe no-op. Absent
-    // turn/start means the append threw BEFORE its push (a non-serializable
-    // trigger — impossible for our fixed trigger); nothing was opened, so rethrow
-    // to the runLoop backstop.
+    // Decide whether this turn opened from the LOG, not a speculative flag. A
+    // pre-commit validator or acceptance failure leaves no turn/start and owes
+    // no turn/end, so it propagates to runLoop's backstop. Once turn/start is
+    // present, this path balances any committed step and records the failure.
     const turnStartLogged = session.events.some(e => e.type === 'turn/start' && e.data.turn === turn)
     if (!turnStartLogged) throw error
     closeStep()
diff --git a/packages/core/agent-loop/tests/agent.spec.ts b/packages/core/agent-loop/tests/agent.spec.ts
index ab3494d991..7f65bbc5f3 100644
--- a/packages/core/agent-loop/tests/agent.spec.ts
+++ b/packages/core/agent-loop/tests/agent.spec.ts
@@ -7,7 +7,7 @@ import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
 import AgentRegistry from '@deepseek-ai/dsh-agent'
 import AgentLoop, { ReactLoopAgent } from '@deepseek-ai/dsh-agent-loop'
-import { prepareReactLoopAgent } from '../src/agent.ts'
+import { bindReactLoopAgentContext, prepareReactLoopAgent } from '../src/agent.ts'
 import { MockAdapter, textResponse } from './mock-adapter.ts'
 
 async function harness(adapter: MockAdapter) {
@@ -49,6 +49,33 @@ function send(agent: ReactLoopAgent, text: string) {
 }
 
 describe('ReactLoopAgent', () => {
+  it('rejects access before context binding and a second driver for one session', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const session = ctx.sessions.create(SessionId('exclusive-driver'))
+    const prepared = prepareReactLoopAgent(ctx, AgentId('first-driver'), { model: 'mock' }, session)
+
+    expect(() => prepared.agent.ctx).toThrow('context is not bound')
+    expect(() => prepareReactLoopAgent(ctx, AgentId('second-driver'), { model: 'mock' }, session))
+      .toThrow('already has a concrete agent driver')
+
+    await prepared.dispose()
+    await ctx.fiber.dispose()
+  })
+
+  it('borrows caller options and binds its scoped context exactly once', async () => {
+    const ctx = await harness(new MockAdapter([textResponse('unused')]))
+    const options = { model: 'mock' }
+    const agent = ctx.agentLoop.create(AgentId('owned-bindings'), options)
+
+    expect(agent.options).toBe(options)
+    expect(agent.id).toBe('owned-bindings')
+    expect(agent.session.id).toMatch(/^owned-bindings-session-/)
+    expect(() => { bindReactLoopAgentContext(agent, new Context()) }).toThrow(/context is already bound/)
+
+    await ctx.fiber.dispose()
+  })
+
   it('send() throws after disposal', async () => {
     const adapter = new MockAdapter(['hang'])
     const ctx = await harness(adapter)
@@ -159,10 +186,8 @@ describe('ReactLoopAgent', () => {
     const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' })
     let flushes = 0
     ctx.on('session/flush', () => { flushes += 1 })
-    // A session/event listener that throws on the synthetic turn/end. Append
-    // pushes before notifying, so turn/end is in the log (turn balanced) but the
-    // throw must NOT skip the durability checkpoint — the flush decision is made
-    // from the log, not a flag set after the (throwing) append.
+    // Session contains a throwing post-commit turn/end observer. The accepted
+    // boundary still triggers the idle injection's durability checkpoint.
     let threw = false
     ctx.on('session/event', (_s, event) => {
       if (!threw && event.type === 'turn/end') { threw = true; throw new Error('boom turn/end') }
@@ -238,7 +263,7 @@ describe('ReactLoopAgent', () => {
 
     // Start the loop to get the disposer; the agent waits for messages
     // (idle, never-resolving cancel), so it will stay idle.
-    prepared.enableDrive()
+    prepared.markPublished()
     const dispose = prepared.startDriver()
 
     // First dispose
@@ -251,6 +276,21 @@ describe('ReactLoopAgent', () => {
     expect(agent.status).toBe('disposed')
   })
 
+  it('a pre-start disposal makes a later driver-start attempt inert', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const session = ctx.sessions.create(SessionId('pre-start-dispose'))
+    const prepared = prepareReactLoopAgent(ctx, AgentId('pre-start-dispose'), { model: 'mock' }, session)
+
+    await prepared.dispose()
+    expect(prepared.agent.status).toBe('disposed')
+    const dispose = prepared.startDriver()
+    await dispose()
+    await expect(prepared.agent.done).resolves.toBeUndefined()
+    expect(prepared.agent.session.events).toEqual([])
+    await ctx.fiber.dispose()
+  })
+
   it('setting the same status does not emit agent/status again', async () => {
     const adapter = new MockAdapter([textResponse('ok')])
     const ctx = await harness(adapter)
@@ -341,7 +381,7 @@ describe('ReactLoopAgent', () => {
     const session = ctx.sessions.create(SessionId('bare'))
     const prepared = prepareReactLoopAgent(ctx, AgentId('bare'), { model: 'mock' }, session)
     const { agent } = prepared
-    prepared.enableDrive()
+    prepared.markPublished()
     const dispose = prepared.startDriver()
     agent.send([{ type: 'text', text: 'go' }])
     await new Promise(r => setTimeout(r, 30))
@@ -416,7 +456,7 @@ describe('ReactLoopAgent', () => {
 
     expect(adapter.requests).toHaveLength(1)
     expect(agent.status).toBe('idle')
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('agent/status listener threw on running'))
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('agent event "agent/status" listener threw'))
     warn.mockRestore()
   })
 
@@ -434,7 +474,7 @@ describe('ReactLoopAgent', () => {
 
     expect(adapter.requests).toHaveLength(1)
     expect(agent.status).toBe('idle')
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('agent/status listener threw on idle'))
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('agent event "agent/status" listener threw'))
     warn.mockRestore()
   })
 })
diff --git a/packages/core/agent-loop/tests/coverage-edges.spec.ts b/packages/core/agent-loop/tests/coverage-edges.spec.ts
index 7a044bfb57..23e5670f85 100644
--- a/packages/core/agent-loop/tests/coverage-edges.spec.ts
+++ b/packages/core/agent-loop/tests/coverage-edges.spec.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
 import LlmService, { CallId, LlmError, StreamChunk } from '@deepseek-ai/dsh-llm'
 import SessionStore, { TurnEndReason } from '@deepseek-ai/dsh-session'
+import type { SessionEvent } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { AgentId } from '@deepseek-ai/dsh-agent'
@@ -35,31 +36,24 @@ function send(agent: ReactLoopAgent, text: string) {
   agent.send([{ type: 'text', text }])
 }
 
-describe('turn boundary listener throws (handled in-turn, loop survives)', () => {
-  it('a pre-push turn/start failure (non-serializable source) is rethrown to the runLoop backstop', async () => {
-    // A non-serializable message source makes the turn/start append throw BEFORE
-    // the event is pushed (Session.append validates before push), so turn/start
-    // never enters the log. runTurn sees no logged turn/start and rethrows; the
-    // runLoop backstop reports via agent/error (step 0) + the logger and the
-    // driver survives. This is the ONLY path that reaches the backstop.
-    const adapter = new MockAdapter([textResponse('turn 2')])
+describe('inbox acceptance', () => {
+  it('rejects non-serializable content or source synchronously before notification or enqueue', async () => {
+    const adapter = new MockAdapter([textResponse('turn 1')])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' })
+    let queued = 0
+    ctx.on('agent/queued', () => { queued += 1 })
 
-    const errors: { turn: number; step: number; message: string }[] = []
-    ctx.on('agent/error', (_a, turn, step, error) => void errors.push({ turn, step, message: error.message }))
+    expect(() => {
+      agent.send([{ type: 'text', text: 'first', bad: 1n } as never])
+    }).toThrow(/losslessly JSON-serializable/)
+    expect(() => {
+      agent.send([{ type: 'text', text: 'first' }], { source: { kind: 'plugin', plugin: 'p', bad: 1n } as never })
+    }).toThrow(/losslessly JSON-serializable/)
+    expect(queued).toBe(0)
+    expect(agent.session.events).toHaveLength(0)
 
-    // A non-serializable source (BigInt) on the queued message.
-    agent.send([{ type: 'text', text: 'first' }], { source: { kind: 'plugin', plugin: 'p', bad: 1n } as never })
-    await waitForIdle(ctx, agent)
-
-    expect(errors).toHaveLength(1)
-    expect(errors[0]!.step).toBe(0)
-    expect(errors[0]!.message).toMatch(/non-JSON-serializable/)
-    // No turn boundary was written (the turn/start append threw before push).
-    expect(agent.session.events.some(e => e.type === 'turn/start')).toBe(false)
-
-    // loop survives: a well-formed second turn runs normally.
+    // The rejected value never woke or poisoned the loop; a valid message runs.
     send(agent, 'second')
     await waitForIdle(ctx, agent)
     expect(adapter.requests).toHaveLength(1)
@@ -129,13 +123,15 @@ describe('tool JSON parse', () => {
 })
 
 describe('toError normalization', () => {
-  it('normalizes non-Error throws from a turn/start session-event listener via toError', async () => {
+  it('normalizes non-Error throws from pre-commit dispatch validation via the runLoop backstop', async () => {
     const adapter = new MockAdapter([textResponse('ok')])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' })
 
     let threwOnce = false
-    ctx.on('session/event', (_session, event) => {
+    ctx.on('internal/dispatch', (_mode, name, args) => {
+      if (name !== 'session/event') return
+      const event = args[1] as SessionEvent
       if (event.type === 'turn/start' && !threwOnce) {
         threwOnce = true
         throw 'naked string error' // non-Error throw, normalized via toError
@@ -148,11 +144,9 @@ describe('toError normalization', () => {
     send(agent, 'go')
     await waitForIdle(ctx, agent)
     expect(errors).toHaveLength(1)
-    expect(errors[0]!.message).toBe('naked string error')
-    // A non-Error throw is wrapped in a HarnessError with code UNKNOWN, so the
-    // turn-end error reason carries a routable code instead of degrading.
-    const turnEnd = agent.session.events.find(e => e.type === 'turn/end')
-    expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason.kind === 'error' && turnEnd.data.reason.code).toBe('UNKNOWN')
+    expect(errors[0]).toMatchObject({ message: 'naked string error', code: 'UNKNOWN' })
+    expect(adapter.requests).toEqual([])
+    expect(agent.session.events.some(event => event.type === 'turn/start' || event.type === 'turn/end')).toBe(false)
   })
 
   it('normalizes non-Error throws from agent/request waterfall via inline toError in runStep catch', async () => {
diff --git a/packages/core/agent-loop/tests/loop.spec.ts b/packages/core/agent-loop/tests/loop.spec.ts
index 5815217fc4..71be5b339e 100644
--- a/packages/core/agent-loop/tests/loop.spec.ts
+++ b/packages/core/agent-loop/tests/loop.spec.ts
@@ -272,7 +272,7 @@ describe('agent loop', () => {
       expect(result.data.meta).toBeUndefined()
       expect(result.data.content).toEqual([{
         type: 'text',
-        text: 'Error: tools/execute must return a losslessly JSON-serializable ToolExecutionResult',
+        text: 'Error: tool result must be losslessly JSON-serializable',
       }])
     }
     // The normalized failure was durably logged and fed back to the model; the
@@ -810,10 +810,10 @@ describe('agent loop', () => {
     ])
   })
 
-  it('stops the turn when a step/end session-event listener failure has recorded an error', async () => {
+  it('contains a step/end observer failure without changing continuation', async () => {
     const adapter = new MockAdapter([
       toolCallResponse('c1', 'echo', { text: 'x' }),
-      textResponse('should not run'),
+      textResponse('continued after tool call'),
     ])
     const ctx = await harness(adapter)
     ctx.tools.register(defineTool({
@@ -826,9 +826,8 @@ describe('agent loop', () => {
     }))
     const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' })
     let threw = false
-    // A throwing step/end session-event listener is the surviving boundary-listener
-    // failure path (step boundaries have no agent/* mirror): closeStep contains it
-    // and surfaces it as a turn error rather than stranding the turn open.
+    // Post-commit session observers cannot control the loop. The tool call still
+    // drives the second model request, and the turn completes normally.
     ctx.on('session/event', (_session, event) => {
       if (event.type === 'step/end' && !threw) { threw = true; throw new Error('bad step/end listener') }
     })
@@ -836,9 +835,9 @@ describe('agent loop', () => {
     send(agent, 'go')
     await waitForIdle(ctx, agent)
 
-    expect(adapter.requests).toHaveLength(1)
+    expect(adapter.requests).toHaveLength(2)
     const turnEnd = agent.session.events.findLast(e => e.type === 'turn/end')
-    expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason.kind).toBe('error')
+    expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason.kind).toBe('completed')
   })
 
   it('chains queued messages into consecutive turns', async () => {
diff --git a/packages/core/agent-loop/tests/resume.spec.ts b/packages/core/agent-loop/tests/resume.spec.ts
index 2a4ba7e904..93605008ec 100644
--- a/packages/core/agent-loop/tests/resume.spec.ts
+++ b/packages/core/agent-loop/tests/resume.spec.ts
@@ -69,7 +69,29 @@ async function promptly<T>(task: Promise<T>): Promise<T> {
   }
 }
 
+/** Throw an arbitrary callback value to exercise the public unknown-error boundary. */
+function throwUnknown(value: unknown): never {
+  throw value
+}
+
 describe('the session-persistence RFC: AgentLoop factory create/resume', () => {
+  it('normalizes a non-Error resume publication failure for rollback and rethrows it', async () => {
+    const sessionId = SessionId('unknown-resume-failure-s')
+    const root = await persistSession(sessionId)
+    const ctx = await mountPersistentHarness(root, new MockAdapter([textResponse('next')]))
+    const failure = { source: 'resume' }
+    ctx.on('session/created', () => throwUnknown(failure))
+
+    await expect(ctx.agents.resume({
+      agentId: AgentId('unknown-resume-failure'),
+      resumeSessionId: sessionId,
+    })).rejects.toBe(failure)
+
+    expect(ctx.agents.get(AgentId('unknown-resume-failure'))).toBeUndefined()
+    expect(ctx.sessions.get(sessionId)).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
   it('createAgent uses the caller-supplied sessionId (not ${id}-session)', async () => {
     const adapter = new MockAdapter([textResponse('hi')])
     const { ctx } = await persistentHarness(adapter)
@@ -168,7 +190,7 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => {
       order.push('session/created')
     })
     ctx.on('agent/created', (agent) => {
-      expect(() => { agent.cancel('too early') }).toThrow(/cannot cancel before creation setup completes/)
+      expect(agent.status).toBe('idle')
       order.push('agent/created')
     })
     ctx.on('agent/session-start', (agent) => {
@@ -212,6 +234,27 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => {
     await ctx.fiber.dispose()
   })
 
+  it('successful resume disposal retires its caller-owned transaction effects', async () => {
+    const sessionId = SessionId('resume-retired-effects-s')
+    const agentId = AgentId('resume-retired-effects')
+    const root = await persistSession(sessionId)
+    const ctx = await mountPersistentHarness(root, new MockAdapter([textResponse('next')]))
+    const handle = await ctx.agents.resume({
+      agentId,
+      resumeSessionId: sessionId,
+      agentOptions: { model: 'mock' },
+    })
+    const transactionLabels = [
+      `agentLoop.owner(${agentId})`,
+      `agentLoop.lifecycle(${agentId})`,
+    ]
+
+    expect(ctx.fiber.getEffects().map(effect => effect.label)).toEqual(expect.arrayContaining(transactionLabels))
+    await handle.dispose()
+    expect(ctx.fiber.getEffects().filter(effect => transactionLabels.includes(effect.label))).toEqual([])
+    await ctx.fiber.dispose()
+  })
+
   it('resume setup rejection publishes nothing, unwinds, and releases both identities', async () => {
     const sessionId = SessionId('resume-setup-reject')
     const root = await persistSession(sessionId)
@@ -309,14 +352,14 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => {
     }, { inject: ['agents'] }))
     await loadStarted.promise
 
-    const rejection = expect(promptly(resuming)).rejects.toThrow(/owner disposed during persistence load/)
+    const rejection = expect(promptly(resuming)).rejects.toThrow(/owner disposed during setup/)
     await promptly(owner.dispose())
     expect(published).toEqual([])
     expect(ctx.agents.get(agentId)).toBeUndefined()
     expect(ctx.sessions.get(sessionId)).toBeUndefined()
 
-    // owner.dispose() itself awaited transaction settlement and reservation
-    // release: reuse the same identities BEFORE awaiting the resume rejection.
+    // owner.dispose() awaited transaction settlement, so the same identities
+    // can be reused before awaiting the public rejection.
     const retry = await promptly(ctx.agents.resume({ agentId, resumeSessionId: sessionId, agentOptions: { model: 'mock' } }))
     await rejection
     expect(loads).toBe(2)
@@ -335,40 +378,45 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => {
     await ctx.fiber.dispose()
   })
 
-  it('snapshots resume identities and agent options before persistence load', async () => {
-    const sessionId = SessionId('resume-snapshot-source')
+  it('AgentLoop unload aborts persistence load and awaits wrapper settlement', async () => {
+    const sessionId = SessionId('resume-load-factory-unload')
+    const agentId = AgentId('resume-load-factory-race')
     const root = await persistSession(sessionId)
-    const ctx = await mountPersistentHarness(root, new MockAdapter([textResponse('next')]))
-    const loaded = await ctx.sessionPersistence.load(sessionId)
-    const loadGate = Promise.withResolvers<typeof loaded>()
-    ctx.sessionPersistence.load = () => loadGate.promise
+    const ctx = new Context()
+    await ctx.plugin(LlmService)
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(SystemPrompt)
+    await ctx.plugin(ToolRegistry)
+    await ctx.plugin(AgentRegistry)
+    const loopFiber = await ctx.plugin(AgentLoop, { agents: [] })
+    await ctx.plugin(SessionPersistenceJsonl, { root })
+    ctx.llm.registerAdapter(['mock'], new MockAdapter([textResponse('next')]))
 
-    const occupied = await ctx.agents.create({
-      agentId: AgentId('occupied-agent'),
-      sessionId: SessionId('occupied-session'),
-      agentOptions: { model: 'mock' },
-    })
-    const options = {
-      agentId: AgentId('accepted-agent'),
-      resumeSessionId: sessionId,
-      agentOptions: { model: 'mock' },
+    const snapshot = await ctx.sessionPersistence.load(sessionId)
+    const lateLoad = Promise.withResolvers<typeof snapshot>()
+    const loadStarted = Promise.withResolvers<undefined>()
+    ctx.sessionPersistence.load = (id) => {
+      expect(id).toBe(sessionId)
+      loadStarted.resolve(undefined)
+      return lateLoad.promise
     }
-    const resuming = ctx.agents.resume(options)
+    const published: string[] = []
+    ctx.on('session/created', () => void published.push('session/created'))
+    ctx.on('agent/created', () => void published.push('agent/created'))
 
-    options.agentId = AgentId('occupied-agent')
-    options.resumeSessionId = SessionId('occupied-session')
-    options.agentOptions.model = 'mutated-model'
-    loadGate.resolve(structuredClone(loaded))
+    const resuming = ctx.agents.resume({ agentId, resumeSessionId: sessionId, agentOptions: { model: 'mock' } })
+    await loadStarted.promise
+    const rejection = expect(promptly(resuming)).rejects.toThrow(/agent loop is not active/)
+    await promptly(loopFiber.dispose())
+    await rejection
 
-    const resumed = await resuming
-    expect(resumed.agent.id).toBe(AgentId('accepted-agent'))
-    expect(resumed.agent.session.id).toBe(sessionId)
-    expect(resumed.agent.options.model).toBe('mock')
-    expect(ctx.agents.get(AgentId('occupied-agent'))).toBe(occupied.agent)
-    expect(ctx.sessions.get(SessionId('occupied-session'))).toBe(occupied.agent.session)
-
-    await resumed.dispose()
-    await occupied.dispose()
+    expect(published).toEqual([])
+    expect(ctx.agents.get(agentId)).toBeUndefined()
+    expect(ctx.sessions.get(sessionId)).toBeUndefined()
+    lateLoad.resolve(structuredClone(snapshot))
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(published).toEqual([])
     await ctx.fiber.dispose()
   })
 
diff --git a/packages/core/agent-loop/tests/review-fixes.spec.ts b/packages/core/agent-loop/tests/review-fixes.spec.ts
index e527099a88..5898a82ee2 100644
--- a/packages/core/agent-loop/tests/review-fixes.spec.ts
+++ b/packages/core/agent-loop/tests/review-fixes.spec.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { Context } from 'cordis'
-import LlmService, { CallId, MessageSource, StreamChunk } from '@deepseek-ai/dsh-llm'
+import LlmService, { CallId, ContentBlock, MessageSource, StreamChunk } from '@deepseek-ai/dsh-llm'
 import SessionStore, { Session, SessionEvent, SessionId, TurnEndReason } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools'
@@ -10,10 +10,7 @@ import { prepareReactLoopAgent } from '../src/agent.ts'
 import * as Invariants from '@deepseek-ai/dsh-invariants'
 import { MockAdapter, textResponse, toolCallResponse } from './mock-adapter.ts'
 
-/**
- * Regression tests for the findings of the first architecture review
- * (Codex + sub-agent, post phase-1). Each describe block names the finding.
- */
+/** Regression tests for agent-loop boundary, identity, and lifecycle contracts. */
 
 async function harness(adapter: MockAdapter) {
   const ctx = new Context()
@@ -437,6 +434,94 @@ describe('MEDIUM: misc registry and config fixes', () => {
     const steeringSources = agent.session.events.flatMap(e => e.type === 'steering/message' ? [e.data.source] : [])
     expect(steeringSources).toEqual([{ kind: 'plugin', plugin: 'goal' }])
   })
+
+  it('send() owns content and source before notification and delivery', async () => {
+    const adapter = new MockAdapter([textResponse('done')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create(AgentId('owned-send'), { model: 'mock' })
+    const content = [{ type: 'text' as const, text: 'accepted-send' }]
+    const source = { kind: 'plugin' as const, plugin: 'accepted-source' }
+    let notifiedContent: ContentBlock[] | undefined
+    let notifiedSource: MessageSource | undefined
+    ctx.on('agent/queued', (subject, acceptedContent, info) => {
+      if (subject !== agent || info.steering) return
+      // Retain the exact notification references: cloning here would test the
+      // listener's copy rather than the event/inbox ownership boundary.
+      notifiedContent = acceptedContent
+      notifiedSource = info.source
+    })
+
+    agent.send(content, { source })
+    content[0]!.text = 'caller-mutated-send'
+    source.plugin = 'caller-mutated-source'
+    await waitForIdle(ctx, agent)
+
+    expect(notifiedContent).toEqual([{ type: 'text', text: 'accepted-send' }])
+    expect(notifiedSource).toEqual({ kind: 'plugin', plugin: 'accepted-source' })
+    expect(Object.isFrozen(notifiedContent)).toBe(true)
+    expect(Object.isFrozen(notifiedContent?.[0])).toBe(true)
+    expect(Object.isFrozen(notifiedSource)).toBe(true)
+    const recorded = agent.session.events.flatMap(event => event.type === 'user/message' ? [event.data] : [])
+    expect(recorded).toContainEqual({
+      content: [{ type: 'text', text: 'accepted-send' }],
+      source: { kind: 'plugin', plugin: 'accepted-source' },
+    })
+    const request = JSON.stringify(adapter.requests[0]!.messages)
+    expect(request).toContain('accepted-send')
+    expect(request).not.toContain('caller-mutated-send')
+  })
+
+  it('running steer() owns content and source before notification and delivery', async () => {
+    const adapter = new MockAdapter([toolCallResponse('c1', 'gate', {}), textResponse('done')])
+    const ctx = await harness(adapter)
+    const agent = ctx.agentLoop.create(AgentId('owned-steer'), { model: 'mock' })
+    const entered = Promise.withResolvers<undefined>()
+    const release = Promise.withResolvers<undefined>()
+    ctx.tools.register(defineTool({
+      name: 'gate',
+      description: '',
+      parameters: {},
+      async execute() {
+        entered.resolve(undefined)
+        await release.promise
+        return [{ type: 'text', text: 'tool done' }]
+      },
+    }))
+    let notifiedContent: ContentBlock[] | undefined
+    let notifiedSource: MessageSource | undefined
+    ctx.on('agent/queued', (subject, acceptedContent, info) => {
+      if (subject !== agent || !info.steering) return
+      notifiedContent = acceptedContent
+      notifiedSource = info.source
+    })
+
+    agent.send([{ type: 'text', text: 'start' }])
+    await entered.promise
+    expect(agent.status).toBe('running')
+    const content = [{ type: 'text' as const, text: 'accepted-steer' }]
+    const source = { kind: 'plugin' as const, plugin: 'accepted-source' }
+    agent.steer(content, { source })
+    content[0]!.text = 'caller-mutated-steer'
+    source.plugin = 'caller-mutated-source'
+    const idle = waitForIdle(ctx, agent)
+    release.resolve(undefined)
+    await idle
+
+    expect(notifiedContent).toEqual([{ type: 'text', text: 'accepted-steer' }])
+    expect(notifiedSource).toEqual({ kind: 'plugin', plugin: 'accepted-source' })
+    expect(Object.isFrozen(notifiedContent)).toBe(true)
+    expect(Object.isFrozen(notifiedContent?.[0])).toBe(true)
+    expect(Object.isFrozen(notifiedSource)).toBe(true)
+    const recorded = agent.session.events.flatMap(event => event.type === 'steering/message' ? [event.data] : [])
+    expect(recorded).toContainEqual({
+      turn: 1,
+      content: [{ type: 'text', text: 'accepted-steer' }],
+      source: { kind: 'plugin', plugin: 'accepted-source' },
+    })
+    const request = JSON.stringify(adapter.requests[1]!.messages)
+    expect(request).toContain('accepted-steer')
+    expect(request).not.toContain('caller-mutated-steer')
+  })
 })
 
 describe('MEDIUM: turn numbering continues across seeded (forked) sessions', () => {
@@ -461,7 +546,7 @@ describe('MEDIUM: turn numbering continues across seeded (forked) sessions', ()
     const seeded = ctx2.sessions.create(SessionId('forked'), { seed: [...agent.session.events] })
     const prepared = prepareReactLoopAgent(ctx2, AgentId('forked-agent'), { model: 'mock' }, seeded)
     const forked = prepared.agent
-    prepared.enableDrive()
+    prepared.markPublished()
     ctx2.effect(() => prepared.startDriver())
 
     const turns: number[] = []
@@ -561,7 +646,7 @@ describe('HIGH: a finish-error stream chunk ends the turn as error, not complete
   })
 })
 
-describe('P1-6: a step/start session-event listener sees the event already in the log', () => {
+describe('step boundary publication order', () => {
   it('the step/start event is in session.events when its session/event listener fires', async () => {
     const adapter = new MockAdapter([textResponse('done')])
     const ctx = await harness(adapter)
@@ -592,7 +677,7 @@ describe('P1-6: a step/start session-event listener sees the event already in th
   })
 })
 
-describe('P1-5: a started turn (and any open step) is always closed on a boundary throw', () => {
+describe('turn and step boundary recovery', () => {
   // Harness with the invariants plugin loaded as an oracle: it throws on
   // append if the log goes unbalanced (turn/end while a step is open,
   // turn/start while a turn is open, etc.), so a regression surfaces as an
@@ -605,7 +690,7 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
     return ctx
   }
@@ -623,19 +708,13 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     }
   }
 
-  it('a throwing step/start session-event listener closes the open step then the turn (step/end before turn/end)', async () => {
-    const adapter = new MockAdapter([textResponse('never reached')])
+  it('a throwing step/start observer cannot change a successful turn', async () => {
+    const adapter = new MockAdapter([textResponse('request completed')])
     const ctx = await balancedHarness(adapter)
     const agent = ctx.agentLoop.create(AgentId('a-stepstart'), { model: 'mock' })
 
-    // Step boundaries have no agent/* mirror; a throwing step/start session-event
-    // listener is the surviving step-boundary-listener failure. The loop marks
-    // the step open BEFORE appending step/start (Session.append pushes before
-    // notifying, so a post-push listener throw still leaves stepOpen=true), so
-    // the outer catch's closeStep() appends the balancing step/end — the turn
-    // stays enclosed. The invariants oracle (balancedHarness) rejects any
-    // imbalance, so a green run proves turn/start → step/start → step/end →
-    // turn/end nesting holds.
+    // Session owns post-commit containment. The loop sees a successful append,
+    // runs the request, and balances the ordinary step and turn boundaries.
     let threw = false
     ctx.on('session/event', (_s, event) => {
       if (event.type === 'step/start' && !threw) { threw = true; throw new Error('boom step-start') }
@@ -648,8 +727,8 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
 
     const e = [...agent.session.events]
     const c = boundaryCounts(agent)
-    expect(c).toMatchObject({ turnStart: 1, turnEnd: 1, stepStart: 1, stepEnd: 1, errors: 1 })
-    expect(errors.map(x => x.message)).toEqual(['boom step-start'])
+    expect(c).toMatchObject({ turnStart: 1, turnEnd: 1, stepStart: 1, stepEnd: 1, errors: 0 })
+    expect(errors).toEqual([])
     // step/end precedes turn/end (the invariants oracle would reject
     // turn/end-while-step-open, but assert the order explicitly too).
     const stepEndIdx = e.findIndex(x => x.type === 'step/end')
@@ -658,6 +737,101 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     expect(stepEndIdx).toBeLessThan(turnEndIdx)
   })
 
+  it('a pre-commit step/start validation failure does not invent a step boundary', async () => {
+    const adapter = new MockAdapter([textResponse('never reached')])
+    const ctx = await balancedHarness(adapter)
+    const agent = ctx.agentLoop.create(AgentId('a-stepstart-veto'), { model: 'mock' })
+    let rejected = false
+    ctx.on('internal/dispatch', (_mode, name, args) => {
+      if (name !== 'session/event') return
+      const event = args[1] as SessionEvent
+      if (event.type === 'step/start' && !rejected) {
+        rejected = true
+        throw new Error('reject step-start before commit')
+      }
+    })
+    const errors: Error[] = []
+    ctx.on('agent/error', (_agent, _turn, _step, error) => { errors.push(error) })
+
+    send(agent, 'go')
+    await waitForIdle(ctx, agent)
+
+    expect(adapter.requests).toEqual([])
+    expect(boundaryCounts(agent)).toMatchObject({
+      turnStart: 1,
+      turnEnd: 1,
+      stepStart: 0,
+      stepEnd: 0,
+      errors: 1,
+    })
+    expect(errors.map(error => error.message)).toEqual(['reject step-start before commit'])
+  })
+
+  it('a one-shot turn/end validation failure preserves the earlier turn error on retry', async () => {
+    const errorStream: StreamChunk[] = [{ type: 'finish', reason: { kind: 'error', message: 'provider failed' } }]
+    const adapter = new MockAdapter([errorStream])
+    const ctx = await balancedHarness(adapter)
+    const agent = ctx.agentLoop.create(AgentId('a-turnend-veto'), { model: 'mock' })
+    let rejected = false
+    ctx.on('internal/dispatch', (_mode, name, args) => {
+      if (name !== 'session/event') return
+      const event = args[1] as SessionEvent
+      if (event.type === 'turn/end' && !rejected) {
+        rejected = true
+        throw new Error('reject first turn-end')
+      }
+    })
+    const errors: Error[] = []
+    ctx.on('agent/error', (_agent, _turn, _step, error) => { errors.push(error) })
+
+    send(agent, 'go')
+    await waitForIdle(ctx, agent)
+
+    expect(errors.map(error => error.message)).toEqual(['provider failed'])
+    expect(boundaryCounts(agent)).toMatchObject({
+      turnStart: 1,
+      turnEnd: 1,
+      stepStart: 1,
+      stepEnd: 1,
+      errors: 1,
+    })
+    const turnEnd = agent.session.events.findLast(event => event.type === 'turn/end')
+    expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason).toMatchObject({
+      kind: 'error',
+      message: 'provider failed',
+    })
+  })
+
+  it('a one-shot step/end validation failure keeps the step open until retry succeeds', async () => {
+    const adapter = new MockAdapter([textResponse('completed before close validation')])
+    const ctx = await balancedHarness(adapter)
+    const agent = ctx.agentLoop.create(AgentId('a-stepend-veto'), { model: 'mock' })
+    let rejected = false
+    ctx.on('internal/dispatch', (_mode, name, args) => {
+      if (name !== 'session/event') return
+      const event = args[1] as SessionEvent
+      if (event.type === 'step/end' && !rejected) {
+        rejected = true
+        throw new Error('reject first step-end')
+      }
+    })
+    const errors: Error[] = []
+    ctx.on('agent/error', (_agent, _turn, _step, error) => { errors.push(error) })
+
+    send(agent, 'go')
+    await waitForIdle(ctx, agent)
+
+    expect(adapter.requests).toHaveLength(1)
+    expect(errors.map(error => error.message)).toEqual(['reject first step-end'])
+    expect(boundaryCounts(agent)).toMatchObject({
+      turnStart: 1,
+      turnEnd: 1,
+      stepStart: 1,
+      stepEnd: 1,
+      errors: 1,
+    })
+  })
+
   it('a throwing agent/error listener during a step-error path still balances the turn, loop survives', async () => {
     // First turn: model stream ends with a finish-error → step error path →
     // failTurn emits agent/error, whose listener throws. The turn must still
@@ -720,13 +894,9 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
   })
 
   it('preserves reason disposed when a pre-step listener disposes then throws (outer-catch disposed branch)', async () => {
-    // Reach the OUTER catch while disposed: an `agent/pre-step` listener requests
-    // disposal AND throws. The throw escapes the pre-step `await` (line ~419) to
-    // the loop's outer catch — BEFORE the post-pre-step disposal check at ~422
-    // gets to run — so the catch sees `isDisposed() && !errorReported` and must
-    // PRESERVE reason=disposed rather than overwrite it with the listener's throw
-    // (disposal is not a failure). This is the surviving path to that sub-branch
-    // now that there is no turn-boundary emit to throw from.
+    // A pre-step listener requests disposal and then throws before the ordinary
+    // post-listener disposal check. The outer catch sees disposal already won
+    // and must preserve reason=disposed rather than rewrite it as a plugin error.
     const adapter = new MockAdapter([textResponse('never reached')])
     const ctx = await balancedHarness(adapter)
     let agent!: ReactLoopAgent
@@ -762,16 +932,8 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     expect(errorEmits).toHaveLength(0)
   })
 
-  it('a throwing session/event listener on the turn/start append still balances the turn', async () => {
-    // Session.append pushes the event BEFORE notifying session/event listeners,
-    // so a listener throwing on turn/start leaves turn/start IN THE LOG. The
-    // loop must therefore still owe (and append) a turn/end — deciding "owed"
-    // from the log via isTurnOpen, not a "turn started" flag that the throw
-    // skipped. Otherwise the turn stays permanently open and poisons the next
-    // turn/replay (the turn-enclosure RFC). (Uses the plain harness — NOT the invariants
-    // oracle — because the throwing listener is itself a session/event
-    // subscriber.)
-    const adapter = new MockAdapter([textResponse('turn 2')])
+  it('a throwing turn/start observer cannot starve the loop or later turns', async () => {
+    const adapter = new MockAdapter([textResponse('turn 1'), textResponse('turn 2')])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(AgentId('a-preturn'), { model: 'mock' })
 
@@ -785,12 +947,9 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     send(agent, 'go')
     await waitForIdle(ctx, agent)
 
-    // The error was surfaced exactly once via agent/error.
-    expect(errors.map(e => e.message)).toEqual(['boom turn/start append'])
-    // The turn is BALANCED: turn/start is in the log (it was pushed before the
-    // listener threw), so a turn/end was owed and appended — no open turn. The
-    // last turn-boundary event being turn/end is exactly the loop's isTurnOpen
-    // check (no open turn remains).
+    expect(errors).toEqual([])
+    // Session contains the observer failure per listener, so the committed turn
+    // remains visible to later observers and executes normally.
     const types = [...agent.session.events].map(e => e.type)
     expect(types.filter(t => t === 'turn/start')).toHaveLength(1)
     expect(types.filter(t => t === 'turn/end')).toHaveLength(1)
@@ -801,15 +960,10 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     // loop survives: a second turn runs normally.
     send(agent, 'second')
     await waitForIdle(ctx, agent)
-    expect(adapter.requests).toHaveLength(1)
+    expect(adapter.requests).toHaveLength(2)
   })
 
-  it('a throwing step/end session-event listener during a successful step ends the turn as error, not completed', async () => {
-    // closeStep() must surface a throwing step/end listener via failTurn so the
-    // turn ends with reason error, not a silent "completed" with the throw
-    // swallowed. Regression test for the closeStep() catch that previously
-    // swallowed the throw in the normal (no-tool, no-steering) path. (Step
-    // boundaries have no agent/* mirror; the session-event listener is the path.)
+  it('a throwing step/end observer cannot rewrite the turn outcome', async () => {
     const adapter = new MockAdapter([textResponse('all good'), textResponse('turn 2 ok')])
     const ctx = await balancedHarness(adapter)
     const agent = ctx.agentLoop.create(AgentId('a-stepend-throw'), { model: 'mock' })
@@ -825,11 +979,10 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     await waitForIdle(ctx, agent)
 
     const c = boundaryCounts(agent)
-    // step opened and closed; exactly one error turn-end; turn balanced.
-    expect(c).toMatchObject({ turnStart: 1, turnEnd: 1, stepStart: 1, stepEnd: 1, errors: 1 })
-    expect(errors.map(e => e.message)).toEqual(['boom step-end'])
+    expect(c).toMatchObject({ turnStart: 1, turnEnd: 1, stepStart: 1, stepEnd: 1, errors: 0 })
+    expect(errors).toEqual([])
     expect(c.lastTurnEnd?.type === 'turn/end' && c.lastTurnEnd.data.reason)
-      .toEqual({ kind: 'error', step: 1, message: 'boom step-end' })
+      .toEqual({ kind: 'completed' })
 
     // step/end precedes turn/end (ordering contract)
     const e = [...agent.session.events]
@@ -847,14 +1000,11 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     expect(c2.stepStart).toBe(c2.stepEnd)
   })
 
-  it('a throwing session/event listener on step/end during finalization still appends turn/end', async () => {
+  it('a throwing step/end observer cannot interrupt error finalization', async () => {
     // A finish-error stream opens a step then fails it, driving finalization
-    // through closeStep() with the step open. closeStep appends step/end; a
-    // session/event listener throwing on THAT must not abort the catch before
-    // closeTurn — step/end is already logged (balance holds) and the throw is
-    // contained + surfaced via failTurn, so turn/end is still appended. (The
-    // failed step itself also routes through failTurn; the step/end-listener
-    // throw is the second, contained, failure.)
+    // through closeStep() with the step open. Session contains the observer
+    // failure after committing step/end, so closeTurn still records the model
+    // failure and balances the turn.
     const errorStream: StreamChunk[] = [{ type: 'finish', reason: { kind: 'error', message: 'provider 500' } }]
     const adapter = new MockAdapter([errorStream, textResponse('turn 2 ok')])
     const ctx = await harness(adapter)
@@ -875,7 +1025,7 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
     expect(e.some(x => x.type === 'step/end')).toBe(true)
     expect(e.some(x => x.type === 'turn/end')).toBe(true)
     expect(e.at(-1)?.type).toBe('turn/end')
-    expect(errors.length).toBeGreaterThanOrEqual(1) // surfaced via agent/error
+    expect(errors.map(error => error.message)).toEqual(['provider 500'])
 
     // loop survives.
     send(agent, 'again')
@@ -884,12 +1034,8 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
   })
 
   it('a throwing session/event listener on turn/end is contained (turn still balanced, loop survives)', async () => {
-    // closeTurn appends turn/end; Session.append pushes it BEFORE notifying
-    // session/event listeners, so a throwing listener leaves turn/end in the log
-    // (the turn is balanced) but must not escape — from the normal-path closeTurn
-    // it would otherwise propagate; the append is contained so the loop continues.
-    // Turn boundaries are durable session events only (no agent/* mirror), so this
-    // session/event append-notify throw is the sole turn-end-listener failure path.
+    // Session contains the observer failure after committing turn/end, so the
+    // boundary stays authoritative and the loop continues normally.
     const adapter = new MockAdapter([textResponse('turn 1'), textResponse('turn 2')])
     const ctx = await harness(adapter)
     const agent = ctx.agentLoop.create(AgentId('a-turnendappend'), { model: 'mock' })
@@ -915,7 +1061,7 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar
   })
 })
 
-describe('P1-7: tool/result is logged under the originating call.id, not result.callId', () => {
+describe('tool result call identity', () => {
   it('the loop records tool/result under the model call.id even when a post-execute listener replaces content', async () => {
     // Model emits a tool-call with id "c1", then a final text turn.
     const adapter = new MockAdapter([
@@ -995,7 +1141,7 @@ describe('surface: assistant/message omits sourceEventSeqs when no chunks stream
 
 
 
-describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
+describe('disposal and cancellation during pre-step assembly', () => {
   it('disposal during system-prompt assembly drops the about-to-start step as disposed', { timeout: 30000 }, async () => {
     // Block `system-prompt/assemble` on a promise. Start disposal (which
     // calls stop() synchronously, setting status=disposed), then release the
@@ -1014,7 +1160,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     // Blocking listener on the parent context (survives fiber disposal).
@@ -1071,7 +1217,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     const unlisten = ctx.on('system-prompt/assemble', async function (_assembly, _context, next) {
@@ -1127,7 +1273,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     ctx.on('agent/pre-step', async () => {
@@ -1179,7 +1325,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     ctx.on('agent/pre-step', async () => {
@@ -1228,7 +1374,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => {
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(AgentRegistry)
     await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     ctx.llm.registerAdapter(['mock'], adapter)
 
     ctx.on('system-prompt/assemble', async function (_assembly, _context, next) {
diff --git a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts
index 2bf58be832..2c478ad1f0 100644
--- a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts
+++ b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts
@@ -1,27 +1,30 @@
 import { describe, expect, it } from 'vitest'
-import { Context } from 'cordis'
+import { Context, symbols, type EffectMeta, type Fiber } from 'cordis'
 import LlmService from '@deepseek-ai/dsh-llm'
-import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
+import SessionStore, { SessionId, type SessionEvent } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { AgentId, agentEvents, assembleContextFor } from '@deepseek-ai/dsh-agent'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import { scopeOf } from '@deepseek-ai/dsh-scope'
 import AgentLoop, { ReactLoopAgent } from '@deepseek-ai/dsh-agent-loop'
-import * as concreteAgentModule from '../src/agent.ts'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
 import { MockAdapter, textResponse } from './mock-adapter.ts'
 
-async function harness(adapter: MockAdapter = new MockAdapter([textResponse('ok')])) {
+async function harnessWithLoop(adapter: MockAdapter = new MockAdapter([textResponse('ok')])): Promise<{ ctx: Context; loopFiber: Fiber }> {
   const ctx = new Context()
   await ctx.plugin(LlmService)
   await ctx.plugin(SessionStore)
   await ctx.plugin(SystemPrompt, { persona: 'You are the deployment.' })
   await ctx.plugin(ToolRegistry)
   await ctx.plugin(AgentRegistry)
-  await ctx.plugin(AgentLoop, { agents: [] })
+  const loopFiber = await ctx.plugin(AgentLoop, { agents: [] })
   ctx.llm.registerAdapter(['mock'], adapter)
-  return ctx
+  return { ctx, loopFiber }
+}
+
+async function harness(adapter: MockAdapter = new MockAdapter([textResponse('ok')])): Promise<Context> {
+  return (await harnessWithLoop(adapter)).ctx
 }
 
 function waitForIdle(ctx: Context, agent: ReactLoopAgent): Promise<void> {
@@ -37,7 +40,108 @@ function waitForIdle(ctx: Context, agent: ReactLoopAgent): Promise<void> {
 
 const text = (t: string): ContentBlock[] => [{ type: 'text', text: t }]
 
+/** Throw an arbitrary callback value to exercise the public unknown-error boundary. */
+function throwUnknown(value: unknown): never {
+  throw value
+}
+
+/** Invoke the exact lifecycle effect to exercise same-stack reentrant teardown. */
+function disposeCurrentLifecycle(ownerCtx: Context): void {
+  const lifecycle = [...ownerCtx.fiber._disposables]
+    .find((dispose) => {
+      const effect = (dispose as typeof dispose & { [symbols.effect]?: EffectMeta })[symbols.effect]
+      return effect?.label.startsWith('agentLoop.lifecycle(') === true
+    })
+  if (lifecycle === undefined) throw new Error('agent lifecycle effect not found')
+  void lifecycle()
+}
+
 describe('agent scope lifecycle', () => {
+  it('rejects an already-aborted creation signal before publishing either identity', async () => {
+    const ctx = await harness()
+    const reason = new Error('cancelled before creation')
+    const controller = new AbortController()
+    controller.abort(reason)
+
+    await expect(ctx.agents.create({
+      agentId: AgentId('pre-aborted'),
+      sessionId: SessionId('pre-aborted-s'),
+      signal: controller.signal,
+    })).rejects.toBe(reason)
+
+    expect(ctx.agents.get(AgentId('pre-aborted'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('pre-aborted-s'))).toBeUndefined()
+
+    const valueController = new AbortController()
+    valueController.abort('plain cancellation reason')
+    await expect(ctx.agents.create({
+      agentId: AgentId('pre-aborted-value'),
+      sessionId: SessionId('pre-aborted-value-s'),
+      signal: valueController.signal,
+    })).rejects.toMatchObject({
+      message: 'agent "pre-aborted-value" creation aborted',
+      cause: 'plain cancellation reason',
+    })
+
+    expect(ctx.agents.get(AgentId('pre-aborted-value'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('pre-aborted-value-s'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
+  it('joins cleanup when an abort lands reentrantly during scope preparation', async () => {
+    const ctx = await harness()
+    const reason = new Error('cancelled while preparing')
+    const controller = new AbortController()
+    let aborted = false
+    ctx.on('internal/plugin', (fiber) => {
+      if (aborted || fiber.name !== 'scope') return
+      aborted = true
+      controller.abort(reason)
+    })
+
+    await expect(ctx.agents.create({
+      agentId: AgentId('prepare-abort'),
+      sessionId: SessionId('prepare-abort-s'),
+      signal: controller.signal,
+    })).rejects.toBe(reason)
+
+    expect(ctx.agents.get(AgentId('prepare-abort'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('prepare-abort-s'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
+  it('normalizes non-Error create failures for rollback while rethrowing the original value', async () => {
+    const ctx = await harness()
+    let thrown: unknown
+    ctx.on('session/created', () => {
+      if (thrown === undefined) return
+      const value = thrown
+      thrown = undefined
+      throwUnknown(value)
+    })
+
+    const createFailure = { source: 'create' }
+    thrown = createFailure
+    let createCaught: unknown
+    try {
+      ctx.agentLoop.create(AgentId('unknown-create'))
+    } catch (error: unknown) {
+      createCaught = error
+    }
+    expect(createCaught).toBe(createFailure)
+
+    const ownedFailure = { source: 'createAgent' }
+    thrown = ownedFailure
+    await expect(ctx.agents.create({
+      agentId: AgentId('unknown-owned-create'),
+      sessionId: SessionId('unknown-owned-create-s'),
+    })).rejects.toBe(ownedFailure)
+
+    expect(ctx.agents.get(AgentId('unknown-create'))).toBeUndefined()
+    expect(ctx.agents.get(AgentId('unknown-owned-create'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
   it('wires agent.ctx: tagged with the agent, DX field set, ctx.agent safe elsewhere', async () => {
     const ctx = await harness()
     const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' })
@@ -152,11 +256,9 @@ describe('agent scope lifecycle', () => {
     expect(ctx.agents.get(AgentId('atomic'))).toBeUndefined()
     expect(ctx.sessions.get(SessionId('atomic-s'))).toBeUndefined()
     expect(order).toEqual(['setup:start'])
-    acceptedOptions.model = 'mutated while setup was pending'
-
     gate.resolve(undefined)
     const handle = await creating
-    expect(handle.agent.options.model).toBe('mock')
+    expect(handle.agent.options).toBe(acceptedOptions)
     expect(order).toEqual([
       'setup:start',
       'setup:end',
@@ -169,61 +271,80 @@ describe('agent scope lifecycle', () => {
     await handle.dispose()
   })
 
-  it('reserves agent and session ids across concurrent async setup', async () => {
+  it('lets the final enter arbitrate unsupported concurrent same-id creation and rolls the loser back', async () => {
     const ctx = await harness()
     const gate = Promise.withResolvers<undefined>()
+    const bothStarted = Promise.withResolvers<undefined>()
+    let started = 0
+    const setup = async (): Promise<void> => {
+      started += 1
+      if (started === 2) bothStarted.resolve(undefined)
+      await gate.promise
+    }
+    const agentId = AgentId('concurrent-final-enter')
     const first = ctx.agents.create({
-      agentId: AgentId('reserved'),
-      sessionId: SessionId('reserved-s'),
+      agentId,
+      sessionId: SessionId('concurrent-final-enter-a'),
       agentOptions: { model: 'mock' },
-      setup: () => gate.promise,
+      setup,
     })
-
-    await expect(ctx.agents.create({
-      agentId: AgentId('reserved'),
-      sessionId: SessionId('other-s'),
+    const second = ctx.agents.create({
+      agentId,
+      sessionId: SessionId('concurrent-final-enter-b'),
       agentOptions: { model: 'mock' },
-    })).rejects.toThrow(/already registered/)
-    await expect(ctx.agents.create({
-      agentId: AgentId('other'),
-      sessionId: SessionId('reserved-s'),
-      agentOptions: { model: 'mock' },
-    })).rejects.toThrow(/already exists/)
+      setup,
+    })
+    await bothStarted.promise
     expect(ctx.agents.list()).toEqual([])
     expect(ctx.sessions.list()).toEqual([])
 
     gate.resolve(undefined)
-    const handle = await first
-    await handle.dispose()
+    const outcomes = await Promise.allSettled([first, second])
+    const fulfilled = outcomes.filter((outcome): outcome is PromiseFulfilledResult<Awaited<typeof first>> => outcome.status === 'fulfilled')
+    const rejected = outcomes.filter((outcome): outcome is PromiseRejectedResult => outcome.status === 'rejected')
+    expect(fulfilled).toHaveLength(1)
+    expect(rejected).toHaveLength(1)
+    expect(String(rejected[0]!.reason)).toMatch(/already registered/)
+    expect(ctx.agents.list()).toEqual([fulfilled[0]!.value.agent])
+    expect(ctx.sessions.list()).toEqual([fulfilled[0]!.value.agent.session])
+
+    await fulfilled[0]!.value.dispose()
+    expect(ctx.agents.list()).toEqual([])
+    expect(ctx.sessions.list()).toEqual([])
   })
 
-  it('structurally rejects every driving verb during setup', async () => {
+  it('uses signal only for creation: aborts pending setup but not a returned live handle', async () => {
     const ctx = await harness()
-    const handle = await ctx.agents.create({
-      agentId: AgentId('no-drive'),
-      sessionId: SessionId('no-drive-s'),
+    const pendingController = new AbortController()
+    const setupStarted = Promise.withResolvers<undefined>()
+    const pending = ctx.agents.create({
+      agentId: AgentId('signal-pending'),
+      sessionId: SessionId('signal-pending-s'),
       agentOptions: { model: 'mock' },
-      setup: (agentCtx) => {
-        const agent = agentCtx.agent!
-        // Even JavaScript or a cast to the exported concrete class cannot name
-        // a public start method. Driver startup is behind a module-private
-        // symbol used only by AgentLoop after rollback-covered publication.
-        expect(Reflect.get(agent as ReactLoopAgent, 'start')).toBeUndefined()
-        expect(Reflect.get(concreteAgentModule, 'enableAgentDrive')).toBeUndefined()
-        expect(Reflect.get(concreteAgentModule, 'startAgentDriver')).toBeUndefined()
-        expect(() => concreteAgentModule.prepareReactLoopAgent(
-          agentCtx, agent.id, agent.options, agent.session,
-        )).toThrow(/already has a concrete agent driver/)
-        expect(Reflect.get(agent as ReactLoopAgent, 'inbox')).toBeUndefined()
-        expect(() => { agent.send(text('queued too soon')) }).toThrow(/cannot send before creation setup completes/)
-        expect(() => { agent.steer(text('steered too soon')) }).toThrow(/cannot steer before creation setup completes/)
-        expect(() => { agent.inject(text('injected too soon')) }).toThrow(/cannot inject before creation setup completes/)
-        expect(() => { agent.cancel('cancel too soon') }).toThrow(/cannot cancel before creation setup completes/)
-        expect(agent.session.events).toEqual([])
+      signal: pendingController.signal,
+      setup: async () => {
+        setupStarted.resolve(undefined)
+        await new Promise<never>(() => {})
       },
     })
-    expect(handle.agent.session.events).toEqual([])
-    await handle.dispose()
+    await setupStarted.promise
+    pendingController.abort(new Error('cancel pending creation'))
+    await expect(pending).rejects.toThrow('cancel pending creation')
+    expect(ctx.agents.get(AgentId('signal-pending'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('signal-pending-s'))).toBeUndefined()
+
+    const liveController = new AbortController()
+    const live = await ctx.agents.create({
+      agentId: AgentId('signal-live'),
+      sessionId: SessionId('signal-live-s'),
+      agentOptions: { model: 'mock' },
+      signal: liveController.signal,
+    })
+    liveController.abort(new Error('too late'))
+    await Promise.resolve()
+    expect(ctx.agents.get(live.agent.id)).toBe(live.agent)
+    expect(live.agent.status).toBe('idle')
+    await live.dispose()
   })
 
   it('owner unload aborts a pending setup and publishes nothing', async () => {
@@ -283,6 +404,382 @@ describe('agent scope lifecycle', () => {
     expect(ctx.sessions.get(SessionId('owner-race-s-2'))).toBeUndefined()
   })
 
+  it('an AgentLoop unload aborts pending setup, awaits cleanup, and releases both ids', async () => {
+    const { ctx, loopFiber } = await harnessWithLoop()
+    const gate = Promise.withResolvers<undefined>()
+    const setupStarted = Promise.withResolvers<undefined>()
+    const published: string[] = []
+    ctx.on('session/created', () => void published.push('session/created'))
+    ctx.on('agent/created', () => void published.push('agent/created'))
+
+    const creating = ctx.agents.create({
+      agentId: AgentId('factory-setup-race'),
+      sessionId: SessionId('factory-setup-race-s'),
+      agentOptions: { model: 'mock' },
+      setup: async () => {
+        setupStarted.resolve(undefined)
+        await gate.promise
+      },
+    })
+    await setupStarted.promise
+
+    await loopFiber.dispose()
+    await expect(creating).rejects.toThrow(/agent loop is not active/)
+    expect(published).toEqual([])
+    expect(ctx.agents.get(AgentId('factory-setup-race'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('factory-setup-race-s'))).toBeUndefined()
+
+    gate.resolve(undefined)
+    await ctx.fiber.dispose()
+  })
+
+  it('factory unload during scope minting skips setup and awaits provisional cleanup', async () => {
+    const { ctx, loopFiber } = await harnessWithLoop()
+    let unloaded = false
+    let setupCalls = 0
+    ctx.on('internal/plugin', (fiber) => {
+      if (unloaded || fiber.name !== 'scope') return
+      unloaded = true
+      void loopFiber.dispose()
+    })
+
+    const creating = ctx.agents.create({
+      agentId: AgentId('factory-scope-race'),
+      sessionId: SessionId('factory-scope-race-s'),
+      agentOptions: { model: 'mock' },
+      setup: () => { setupCalls += 1 },
+    })
+    await expect(creating).rejects.toThrow(/agent loop is not active/)
+    await loopFiber.dispose()
+    expect(setupCalls).toBe(0)
+    expect(ctx.agents.get(AgentId('factory-scope-race'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('factory-scope-race-s'))).toBeUndefined()
+
+    await ctx.fiber.dispose()
+  })
+
+  it('caller unload during scope minting owns and drains the half-built child', async () => {
+    const ctx = await harness()
+    const gate = Promise.withResolvers<undefined>()
+    const cleanupStarted = Promise.withResolvers<undefined>()
+    let ownerFiber!: Fiber
+    let ownerDisposal!: Promise<void>
+    let scopeFiber: Fiber | undefined
+    let creating!: ReturnType<typeof ctx.agents.create>
+    ctx.on('internal/plugin', (fiber) => {
+      if (fiber.name !== 'scope' || scopeFiber !== undefined) return
+      scopeFiber = fiber
+      fiber.ctx.effect(() => async () => {
+        cleanupStarted.resolve(undefined)
+        await gate.promise
+      })
+      ownerDisposal = ownerFiber.dispose()
+    })
+
+    const owner = ctx.plugin(Object.assign((inner: Context) => {
+      ownerFiber = inner.fiber
+      creating = inner.agents.create({
+        agentId: AgentId('caller-scope-race'),
+        sessionId: SessionId('caller-scope-race-s'),
+        agentOptions: { model: 'mock' },
+      })
+    }, { inject: ['agents'] }))
+
+    await cleanupStarted.promise
+    let ownerSettled = false
+    void ownerDisposal.then(() => { ownerSettled = true })
+    await Promise.resolve()
+    expect(ownerSettled).toBe(false)
+    gate.resolve(undefined)
+    await expect(creating).rejects.toThrow(/owner disposed during setup/)
+    await ownerDisposal
+    await owner
+    expect(scopeFiber?.uid).toBeNull()
+    expect(ctx.agents.get(AgentId('caller-scope-race'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('caller-scope-race-s'))).toBeUndefined()
+    await owner.dispose()
+    await ctx.fiber.dispose()
+  })
+
+  it('synchronous create rechecks provider liveness before its first publication edge', async () => {
+    const { ctx, loopFiber } = await harnessWithLoop()
+    const sessionsBefore = ctx.sessions.list().length
+    let unloaded = false
+    ctx.on('internal/plugin', (fiber) => {
+      if (unloaded || fiber.name !== 'scope') return
+      unloaded = true
+      void loopFiber.dispose()
+    })
+
+    expect(() => ctx.agentLoop.create(AgentId('config-scope-race'), { model: 'mock' }))
+      .toThrow(/agent loop is not active/)
+    await loopFiber.dispose()
+    expect(ctx.agents.get(AgentId('config-scope-race'))).toBeUndefined()
+    expect(ctx.sessions.list()).toHaveLength(sessionsBefore)
+    await ctx.fiber.dispose()
+  })
+
+  it('synchronous create leaves no lifecycle state when session preparation fails', async () => {
+    const ctx = await harness()
+    const id = AgentId('config-prepare-failure')
+
+    expect(() => ctx.agentLoop.create(id, { model: 'mock' }, { cwd: 'relative' }))
+      .toThrow(/absolute path/)
+    const replacement = ctx.agentLoop.create(id, { model: 'mock' }, { cwd: '/recovered' })
+    expect(ctx.agents.get(id)).toBe(replacement)
+    await replacement.whenIdle()
+    await ctx.fiber.dispose()
+  })
+
+  it('factory unload awaits provisional cleanup when scope preparation throws', async () => {
+    const { ctx, loopFiber } = await harnessWithLoop()
+    let triggered = false
+    ctx.on('internal/plugin', (fiber) => {
+      if (triggered || fiber.name !== 'scope') return
+      triggered = true
+      void loopFiber.dispose()
+      throw new Error('scope preparation failed')
+    })
+
+    await expect(ctx.agents.create({
+      agentId: AgentId('factory-scope-throw'),
+      sessionId: SessionId('factory-scope-throw-s'),
+      agentOptions: { model: 'mock' },
+    })).rejects.toThrow('scope preparation failed')
+    await loopFiber.dispose()
+    expect(ctx.agents.get(AgentId('factory-scope-throw'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('factory-scope-throw-s'))).toBeUndefined()
+
+    await ctx.fiber.dispose()
+  })
+
+  it('AgentLoop unload is a structural co-owner of every live programmatic agent', async () => {
+    const { ctx, loopFiber } = await harnessWithLoop()
+    const loop = ctx.agentLoop
+    const agentId = AgentId('factory-live')
+    const handle = await ctx.agents.create({
+      agentId,
+      sessionId: SessionId('factory-live-s'),
+      agentOptions: { model: 'mock' },
+    })
+
+    await loopFiber.dispose()
+    expect(handle.agent.status).toBe('disposed')
+    expect(ctx.agents.get(agentId)).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('factory-live-s'))).toBeUndefined()
+    expect(ctx.fiber.getEffects().filter(effect => effect.label === `agentLoop.owner(${agentId})`)).toEqual([])
+    // The consumer handle shares the provider's completed quiescence boundary.
+    await handle.dispose()
+
+    await expect(loop.createAgent(ctx, {
+      agentId: AgentId('factory-inactive'),
+      sessionId: SessionId('factory-inactive-s'),
+    })).rejects.toThrow('agent loop is not active')
+    await ctx.fiber.dispose()
+  })
+
+  it('keeps AgentLoop dependencies available when the caller injects only agents', async () => {
+    const ctx = await harness()
+    let creating!: ReturnType<typeof ctx.agents.create>
+    const owner = await ctx.plugin(Object.assign((inner: Context) => {
+      creating = inner.agents.create({
+        agentId: AgentId('dependency-origin'),
+        sessionId: SessionId('dependency-origin-s'),
+        agentOptions: { model: 'mock' },
+        setup: (agentCtx) => {
+          agentCtx.tools.register({
+            name: 'dependency-origin-tool',
+            description: 'proves AgentLoop dependency origin',
+            parameters: {},
+            execute: () => Promise.resolve(text('ok')),
+          })
+          agentCtx.systemPrompt.section({
+            name: 'dependency-origin-section',
+            order: 1,
+            text: 'factory dependency surface',
+          })
+        },
+      })
+    }, { inject: ['agents'] }))
+
+    const handle = await creating
+    const assembly = await ctx.systemPrompt.assemble(assembleContextFor(handle.agent))
+    expect(assembly.tools.map(tool => tool.name)).toContain('dependency-origin-tool')
+    expect(assembly.sections.map(section => section.name)).toContain('dependency-origin-section')
+    await handle.dispose()
+    await owner.dispose()
+    await ctx.fiber.dispose()
+  })
+
+  it('keeps both entries and the scope live through a reentrant session/created teardown', async () => {
+    const ctx = await harness()
+    let ownerCtx!: Context
+    let creating!: ReturnType<typeof ctx.agents.create>
+    const lifecycle: string[] = []
+    ctx.on('session/created', (session) => {
+      if (session.id !== SessionId('session-created-barrier-s')) return
+      lifecycle.push('session-created:dispose')
+      disposeCurrentLifecycle(ownerCtx)
+    })
+    ctx.on('session/created', (session) => {
+      if (session.id !== SessionId('session-created-barrier-s')) return
+      const agent = ctx.agents.get(AgentId('session-created-barrier'))!
+      expect(ctx.sessions.get(session.id)).toBe(session)
+      expect(agent.session).toBe(session)
+      agent.ctx.effect(() => () => { lifecycle.push('scope-disposed') })
+      lifecycle.push('session-created:observer')
+    })
+    ctx.on('agent/created', () => void lifecycle.push('agent-created'))
+    ctx.on('agent/disposed', () => void lifecycle.push('agent-disposed'))
+    ctx.on('session/disposed', (session) => {
+      if (session.id === SessionId('session-created-barrier-s')) lifecycle.push('session-disposed')
+    })
+
+    const owner = await ctx.plugin(Object.assign((inner: Context) => {
+      ownerCtx = inner
+      creating = inner.agents.create({
+        agentId: AgentId('session-created-barrier'),
+        sessionId: SessionId('session-created-barrier-s'),
+        agentOptions: { model: 'mock' },
+      })
+    }, { inject: ['agents'] }))
+
+    await expect(creating).rejects.toThrow(/lifecycle disposed/)
+    await owner.dispose()
+    expect(lifecycle).toEqual([
+      'session-created:dispose',
+      'session-created:observer',
+      'session-disposed',
+      'scope-disposed',
+    ])
+    expect(ctx.agents.get(AgentId('session-created-barrier'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('session-created-barrier-s'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
+  it('keeps both entries and the scope live through a reentrant agent/created teardown', async () => {
+    const ctx = await harness()
+    let ownerCtx!: Context
+    let creating!: ReturnType<typeof ctx.agents.create>
+    const lifecycle: string[] = []
+    ctx.on('session/created', (session) => {
+      if (session.id === SessionId('agent-created-barrier-s')) lifecycle.push('session-created')
+    })
+    ctx.on('agent/created', (agent) => {
+      if (agent.id !== AgentId('agent-created-barrier')) return
+      lifecycle.push('agent-created:dispose')
+      disposeCurrentLifecycle(ownerCtx)
+    })
+    ctx.on('agent/created', (agent) => {
+      if (agent.id !== AgentId('agent-created-barrier')) return
+      expect(ctx.agents.get(agent.id)).toBe(agent)
+      expect(ctx.sessions.get(agent.session.id)).toBe(agent.session)
+      agent.ctx.effect(() => () => { lifecycle.push('scope-disposed') })
+      lifecycle.push('agent-created:observer')
+    })
+    ctx.on('agent/disposed', (agent) => {
+      if (agent.id === AgentId('agent-created-barrier')) lifecycle.push('agent-disposed')
+    })
+    ctx.on('session/disposed', (session) => {
+      if (session.id === SessionId('agent-created-barrier-s')) lifecycle.push('session-disposed')
+    })
+
+    const owner = await ctx.plugin(Object.assign((inner: Context) => {
+      ownerCtx = inner
+      creating = inner.agents.create({
+        agentId: AgentId('agent-created-barrier'),
+        sessionId: SessionId('agent-created-barrier-s'),
+        agentOptions: { model: 'mock' },
+      })
+    }, { inject: ['agents'] }))
+
+    await expect(creating).rejects.toThrow(/lifecycle disposed/)
+    await owner.dispose()
+    expect(lifecycle).toEqual([
+      'session-created',
+      'agent-created:dispose',
+      'agent-created:observer',
+      'agent-disposed',
+      'session-disposed',
+      'scope-disposed',
+    ])
+    expect(ctx.agents.get(AgentId('agent-created-barrier'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('agent-created-barrier-s'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
+  it('rechecks caller liveness after creation listeners before unlocking the driver', async () => {
+    const ctx = await harness()
+    const starts: string[] = []
+    let ownerCtx!: Context
+    let creating!: ReturnType<typeof ctx.agents.create>
+    ctx.on('agent/session-start', agent => void starts.push(agent.id))
+    ctx.on('agent/created', (agent) => {
+      if (agent.id === AgentId('listener-dispose')) void ownerCtx.fiber.dispose()
+    })
+
+    const owner = await ctx.plugin(Object.assign((inner: Context) => {
+      ownerCtx = inner
+      creating = inner.agents.create({
+        agentId: AgentId('listener-dispose'),
+        sessionId: SessionId('listener-dispose-s'),
+        agentOptions: { model: 'mock' },
+      })
+    }, { inject: ['agents'] }))
+
+    await expect(creating).rejects.toThrow(/owner disposed during setup/)
+    await owner.dispose()
+    expect(starts).toEqual([])
+    expect(ctx.agents.get(AgentId('listener-dispose'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('listener-dispose-s'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
+  it('rechecks caller liveness after session-start before starting the driver', async () => {
+    const ctx = await harness()
+    let ownerCtx!: Context
+    let creating!: ReturnType<typeof ctx.agents.create>
+    let announced!: ReactLoopAgent
+    const statuses: string[] = []
+    let scopeDisposed = false
+    let observerSawLive = false
+    ctx.on('agent/status', (agent, status) => {
+      if (agent.id === AgentId('session-start-dispose')) statuses.push(status)
+    })
+    ctx.on('agent/session-start', (agent) => {
+      if (agent.id !== AgentId('session-start-dispose')) return
+      announced = agent as ReactLoopAgent
+      disposeCurrentLifecycle(ownerCtx)
+    })
+    ctx.on('agent/session-start', (agent) => {
+      if (agent.id !== AgentId('session-start-dispose')) return
+      expect(ctx.agents.get(agent.id)).toBe(agent)
+      expect(ctx.sessions.get(agent.session.id)).toBe(agent.session)
+      agent.ctx.effect(() => () => { scopeDisposed = true })
+      observerSawLive = true
+    })
+
+    const owner = await ctx.plugin(Object.assign((inner: Context) => {
+      ownerCtx = inner
+      creating = inner.agents.create({
+        agentId: AgentId('session-start-dispose'),
+        sessionId: SessionId('session-start-dispose-s'),
+        agentOptions: { model: 'mock' },
+      })
+    }, { inject: ['agents'] }))
+
+    await expect(creating).rejects.toThrow(/lifecycle disposed/)
+    await owner.dispose()
+    expect(announced.status).toBe('disposed')
+    expect(statuses).toEqual(['disposed'])
+    expect(observerSawLive).toBe(true)
+    expect(scopeDisposed).toBe(true)
+    expect(announced.session.events).toEqual([])
+    expect(ctx.agents.get(AgentId('session-start-dispose'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('session-start-dispose-s'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
   it('a rejecting setup publishes nothing and unwinds the unpublished scope', async () => {
     const ctx = await harness()
     const published: string[] = []
@@ -307,6 +804,36 @@ describe('agent scope lifecycle', () => {
     await retry.dispose()
   })
 
+  it('rejects an exotic durable seed before publishing either identity', async () => {
+    const ctx = await harness()
+    const published: string[] = []
+    ctx.on('session/created', () => { published.push('session') })
+    ctx.on('agent/created', () => { published.push('agent') })
+    class ExoticData { readonly value = 'not durable JSON' }
+    const seed = [{
+      seq: 0,
+      type: 'test/exotic-seed',
+      data: new ExoticData(),
+    }] as unknown as SessionEvent[]
+
+    await expect(ctx.agents.create({
+      agentId: AgentId('exotic-seed'),
+      sessionId: SessionId('exotic-seed-session'),
+      agentOptions: { model: 'mock' },
+      seed,
+    })).rejects.toThrow(/seed event at index 0 is not losslessly JSON-serializable/)
+
+    expect(published).toEqual([])
+    expect(ctx.agents.get(AgentId('exotic-seed'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('exotic-seed-session'))).toBeUndefined()
+    const retry = await ctx.agents.create({
+      agentId: AgentId('exotic-seed'),
+      sessionId: SessionId('exotic-seed-session'),
+      agentOptions: { model: 'mock' },
+    })
+    await retry.dispose()
+  })
+
   it('a throwing session/created listener disposes the scope (pre-nesting rollback window)', async () => {
     const ctx = await harness()
     let boom = true
@@ -327,6 +854,33 @@ describe('agent scope lifecycle', () => {
     await retry.dispose()
   })
 
+  it('pairs session and agent announcements when agent creation aborts publication', async () => {
+    const ctx = await harness()
+    const lifecycle: string[] = []
+    ctx.on('session/created', (session) => { lifecycle.push(`session-created:${session.id}`) })
+    ctx.on('session/disposed', (session) => { lifecycle.push(`session-disposed:${session.id}`) })
+    ctx.on('agent/created', (agent) => {
+      lifecycle.push(`agent-created:${agent.id}`)
+      throw new Error('agent observer failed')
+    })
+    ctx.on('agent/disposed', (agent) => { lifecycle.push(`agent-disposed:${agent.id}`) })
+
+    await expect(ctx.agents.create({
+      agentId: AgentId('partial-agent'),
+      sessionId: SessionId('partial-session'),
+      agentOptions: { model: 'mock' },
+    })).rejects.toThrow('agent observer failed')
+
+    expect(lifecycle).toEqual([
+      'session-created:partial-session',
+      'agent-created:partial-agent',
+      'agent-disposed:partial-agent',
+      'session-disposed:partial-session',
+    ])
+    expect(ctx.agents.get(AgentId('partial-agent'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('partial-session'))).toBeUndefined()
+  })
+
   it('the synchronous config helper rolls back when publication throws', async () => {
     const ctx = await harness()
     const sessionsBefore = ctx.sessions.list().length
@@ -363,29 +917,6 @@ describe('agent scope lifecycle', () => {
     expect(heard).toEqual(['a1:2'])
   })
 
-  it('a listener may drive the agent through its declared `this` (the carrier is method-transparent)', async () => {
-    // ds-review-bot regression: agent/* listeners are typed
-    // `this: Scoped<Agent>`, and ReactLoopAgent's send/steer/cancel read the
-    // native-private #carrier — a proxy-receiver carrier made
-    // `this.send(...)` throw TypeError. The carrier binds methods to the real
-    // agent, so driving through the event `this` is a working supported shape.
-    const adapter = new MockAdapter([textResponse('first'), textResponse('second')])
-    const ctx = await harness(adapter)
-    const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' })
-    let followUpSent = false
-    ctx.on('agent/session-start', function (this: Agent) {
-      // Deliberately through `this`, not the args subject.
-      this.send(text('driven through this'))
-      followUpSent = true
-    })
-    const second = ctx.agentLoop.create(AgentId('a2'), { model: 'mock' })
-    expect(followUpSent).toBe(true)
-    await second.whenIdle()
-    // The send actually reached the loop: the prompt ran a turn.
-    expect(second.session.events.some(e => e.type === 'turn/start')).toBe(true)
-    await agent.whenIdle()
-  })
-
   it('owner unload honors the documented teardown order: unregistration AFTER the drain, before detach', async () => {
     const ctx = await harness()
     let handle!: Awaited<ReturnType<typeof ctx.agents.create>>
@@ -441,6 +972,89 @@ describe('agent scope lifecycle', () => {
     await unload
   })
 
+  it('successful handle disposal retires its caller ownership effect', async () => {
+    const ctx = await harness()
+    const agentId = AgentId('retired-owner-effect')
+    const handle = await ctx.agents.create({
+      agentId,
+      sessionId: SessionId('retired-owner-effect-s'),
+      agentOptions: { model: 'mock' },
+    })
+
+    expect(ctx.fiber.getEffects().map(effect => effect.label)).toContain(`agentLoop.owner(${agentId})`)
+    await handle.dispose()
+    expect(ctx.fiber.getEffects().filter(effect => effect.label === `agentLoop.owner(${agentId})`)).toEqual([])
+    await ctx.fiber.dispose()
+  })
+
+  it('owner unload after handle-first teardown follows the same in-flight boundary', async () => {
+    const ctx = await harness()
+    const gate = Promise.withResolvers<undefined>()
+    const cleanupStarted = Promise.withResolvers<undefined>()
+    let handle!: Awaited<ReturnType<typeof ctx.agents.create>>
+    const owner = await ctx.plugin(Object.assign(async (inner: Context) => {
+      handle = await inner.agents.create({
+        agentId: AgentId('manual-first'),
+        sessionId: SessionId('manual-first-s'),
+        agentOptions: { model: 'mock' },
+        setup(agentCtx) {
+          agentCtx.effect(() => async () => {
+            cleanupStarted.resolve(undefined)
+            await gate.promise
+          })
+        },
+      })
+    }, { inject: ['agents'] }))
+
+    const disposing = handle.dispose()
+    await cleanupStarted.promise
+    let ownerSettled = false
+    const unloading = owner.dispose().then(() => { ownerSettled = true })
+    await Promise.resolve()
+    expect(ownerSettled).toBe(false)
+    gate.resolve(undefined)
+    await Promise.all([disposing, unloading])
+    expect(ctx.agents.get(AgentId('manual-first'))).toBeUndefined()
+    expect(ctx.sessions.get(SessionId('manual-first-s'))).toBeUndefined()
+    await ctx.fiber.dispose()
+  })
+
+  it('reopens ids after detach while the prior private scope finishes quiescing', async () => {
+    const ctx = await harness()
+    const gate = Promise.withResolvers<undefined>()
+    const cleanupStarted = Promise.withResolvers<undefined>()
+    const sessionDisposed = Promise.withResolvers<undefined>()
+    const agentId = AgentId('quiescent-reuse')
+    const sessionId = SessionId('quiescent-reuse-s')
+    ctx.on('session/disposed', (session) => {
+      if (session.id === sessionId) sessionDisposed.resolve(undefined)
+    })
+    const first = await ctx.agents.create({
+      agentId,
+      sessionId,
+      agentOptions: { model: 'mock' },
+      setup(agentCtx) {
+        agentCtx.effect(() => async () => {
+          cleanupStarted.resolve(undefined)
+          await gate.promise
+        })
+      },
+    })
+
+    const disposing = first.dispose()
+    await Promise.all([sessionDisposed.promise, cleanupStarted.promise])
+    expect(ctx.agents.get(agentId)).toBeUndefined()
+    expect(ctx.sessions.get(sessionId)).toBeUndefined()
+    const replacement = await ctx.agents.create({ agentId, sessionId, agentOptions: { model: 'mock' } })
+    expect(ctx.agents.get(agentId)).toBe(replacement.agent)
+    expect(ctx.sessions.get(sessionId)).toBe(replacement.agent.session)
+
+    gate.resolve(undefined)
+    await disposing
+    await replacement.dispose()
+    await ctx.fiber.dispose()
+  })
+
   it('handle.dispose() awaits an idle-injection flush before unregistering or detaching', async () => {
     const ctx = await harness()
     const handle = await ctx.agents.create({
diff --git a/packages/core/agent-loop/tests/turn-stop.spec.ts b/packages/core/agent-loop/tests/turn-stop.spec.ts
index c4ead42040..c275fee88c 100644
--- a/packages/core/agent-loop/tests/turn-stop.spec.ts
+++ b/packages/core/agent-loop/tests/turn-stop.spec.ts
@@ -156,12 +156,9 @@ describe('agent/turn-stop', () => {
     expect(adapter.requests).toHaveLength(3)
   })
 
-  it('fails throwing and malformed terminal policies closed while the driver survives', async () => {
+  it('fails a throwing terminal policy closed while the driver survives', async () => {
     const adapter = new MockAdapter([
       textResponse('throwing policy'),
-      textResponse('malformed continue policy'),
-      textResponse('malformed false policy'),
-      textResponse('malformed null policy'),
       textResponse('healthy later turn'),
     ])
     const ctx = await harness(adapter)
@@ -179,21 +176,10 @@ describe('agent/turn-stop', () => {
     await send(agent, 'first')
     disposeThrowing()
 
-    for (const [index, malformed] of [
-      { action: 'continue' },
-      false,
-      null,
-    ].entries()) {
-      const disposeMalformed = agent.ctx.on('agent/turn-stop', () => malformed as unknown as ContinuationStop)
-      await send(agent, `malformed ${index}`)
-      disposeMalformed()
-    }
-
     await send(agent, 'healthy')
 
-    expect(reasons.map(reason => reason.kind)).toEqual(['error', 'error', 'error', 'error', 'completed'])
+    expect(reasons.map(reason => reason.kind)).toEqual(['error', 'completed'])
     expect(errors).toContain('terminal policy exploded')
-    expect(errors).toContain("agent/turn-stop returned an invalid result; expected { action: 'stop' } or undefined")
-    expect(adapter.requests).toHaveLength(5)
+    expect(adapter.requests).toHaveLength(2)
   })
 })
diff --git a/packages/core/agent/README.md b/packages/core/agent/README.md
index c75ce874fb..a23ee7844c 100644
--- a/packages/core/agent/README.md
+++ b/packages/core/agent/README.md
@@ -8,30 +8,30 @@ Tracks live agents so UI, hook, and orchestrator plugins can find them without i
 
 ### Public API
 
-The scoped-registration surface: `Agent.ctx` is the agent's scope context (`dsh-scope`, key = the agent) — register tools/sections/variables/listeners through it for that agent alone, all unwound on disposal. `agentEvents(ctx, agent)` is the fused dispatcher every agent-subject event goes through (carrier + injected subject in one move); `assembleContextFor(agent)` builds the per-agent assembly context (`agent` + `scope` together). `CreateAgentOptions.setup(agentCtx)` and `ResumeAgentOptions.setup(agentCtx)` compose a fresh or resumed agent's scoped world while the factory keeps the agent and session unpublished; creation awaits setup and a same-turn owner-unload checkpoint before either creation notification or the first assembly. Setup composes, it never drives: the concrete loop rejects driving verbs until the `agent/session-start` boundary.
+The scoped-registration surface: `Agent.ctx` is the agent's scope context (`dsh-scope`, key = the agent) — register tools/sections/variables/listeners through it for that agent alone, all unwound on disposal. `agentEvents(ctx, agent)` is the fused dispatcher for ordinary agent-subject operations (carrier + injected subject in one move); its notification mode invokes every listener and contains both synchronous throws and returned-promise rejections. The registry lifecycle pair reuses one stable routing carrier. `assembleContextFor(agent)` builds the per-agent assembly context (`agent` + `scope` together). `CreateAgentOptions.setup(agentCtx)` and `ResumeAgentOptions.setup(agentCtx)` compose a fresh or resumed agent's scoped world while both objects remain unpublished. Setup is trusted, composition-only same-process code: drive the agent only after creation resolves.
 
 - `ctx.agents.register(agent: Agent): () => Promise<void> | void` — record an **already-constructed** agent. Disposed with the calling fiber.
-- Advanced ordered lifecycle: `enter(agent): () => void` inserts without announcing, and `announce(agent)` emits `agent/created` only for that exact live entry. The async factory uses this split after setup; ordinary plugins use `register()`.
+- Advanced ordered lifecycle: `enter(agent): () => void` performs the authoritative ID collision check and inserts without announcing; `announce(agent)` emits `agent/created` exactly once. A detach requested synchronously by a creation listener is deferred until that dispatch unwinds, and every detach checks the captured entry object, so a stale capability cannot delete a later same-ID replacement. The async factory uses this split; ordinary plugins use `register()`.
 - `ctx.agents.get(id: AgentId): Agent | undefined`
 - `ctx.agents.list(): Agent[]`
 
 #### Factory seam (creation)
 
-Agent *creation* is provided by the plugin implementing `AgentFactory` (`dsh-agent-loop`), registered via `setFactory`. This keeps creation on the `dsh-agent` interface so consumers (UI, the ACP bridge) program against `ctx.agents` without depending on the concrete loop package.
+Agent *creation* is provided by the plugin implementing `AgentFactory` (`dsh-agent-loop`), registered via `setFactory`. This keeps creation on the `dsh-agent` interface so consumers (UI, the ACP bridge) program against `ctx.agents` without depending on the concrete loop package. The registry canonicalizes an already traced Service to its concrete target and re-traces each call through the caller's context; this avoids nested Cordis shadows while passing an explicit caller-bound `ownerCtx` to plain factories.
 
 - `ctx.agents.setFactory(factory: AgentFactory): () => Promise<void> | void` — register the creation factory (the loop calls this on construction). Throws on a second factory; the slot clears on dispose.
-- `ctx.agents.create(options: CreateAgentOptions): Promise<AgentHandle>` — snapshot caller-owned IDs/options/metadata/seed, construct and await optional setup while unpublished, insert and announce both session and agent, open the `agent/session-start` driving boundary, then start a new loop on the caller-supplied `sessionId`. Agent/session IDs are reserved across setup; setup rejection or owner unload publishes nothing. Publication is rollback-covered: if a creation listener throws, entries and scope unwind but effects of already-delivered notifications remain observable; an agent whose announcement began emits `agent/disposed` during that rollback. Rejects if no factory is registered.
-- `ctx.agents.resume(options: ResumeAgentOptions): Promise<AgentHandle>` — snapshot caller-owned IDs/options, load a persisted session ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), mint a fresh agent scope, await optional setup while unpublished, then follow the same insert → announce → session-start → loop-start boundary. The IDs are reserved across persistence load and setup; load/setup rejection or owner unload publishes nothing. Rejects if no factory is registered or session persistence is unconfigured.
+- `ctx.agents.create(options: CreateAgentOptions): Promise<AgentHandle>` — create a session and agent, await optional setup while unpublished, then publish through final `SessionStore.enter()` and `AgentRegistry.enter()` checks. Concurrent same-ID creation is unsupported: more than one operation may prepare, but only one can enter; every loser rolls its private scope/session/driver back. An optional creation-only `signal` cancels unpublished setup and is detached before the handle is returned; later cancellation uses `handle.dispose()` or `agent.cancel()`. Publication is rollback-covered and every delivered creation edge is paired during rollback. Rejects if no factory is registered.
+- `ctx.agents.resume(options: ResumeAgentOptions): Promise<AgentHandle>` — load a persisted session ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), mint a fresh unpublished agent scope, await optional setup, and use the same final-entry publication sequence. Its optional `signal` is likewise creation-only. Rejects if no factory is registered or session persistence is unconfigured.
 
-`AgentHandle = { agent: Agent; dispose(): Promise<void> }`. The disposer is a **capability** — only the holder can tear this agent down. `dispose()` stops the loop, `await`s its exit plus every outstanding idle-injection flush (quiescence — NOT just the `disposed` status flip), unregisters the agent, removes its session from the store, and finally unwinds its scoped world. This order captures every agent-started `session/flush` before the session is detached and keeps scoped listeners alive through those checkpoints. `ctx.agents.get(id)` still returns a bare `Agent` — the handle is only for the OWNER that created it. The ACP bridge and in-process subagent backends are production consumers; config-created agents are owned by the loop fiber and never need a handle.
+`AgentHandle = { agent: Agent; dispose(): Promise<void> }`. The disposer is a **consumer capability** — no observer holding the bare registry entry can tear the agent down. The caller fiber and the registered factory provider are structural co-owners: caller unload enforces structured ownership, while factory unload must stop old instances because their scoped dependency surface belongs to that provider. `dispose()` from any owner reaches one memoized quiescence boundary: it stops the loop, `await`s its exit plus every outstanding idle-injection flush (not just the `disposed` status flip), unregisters the agent, removes its session from the store, and finally unwinds its scoped world. This order captures every agent-started `session/flush` before the session is detached and keeps scoped listeners alive through those checkpoints. `ctx.agents.get(id)` still returns a bare `Agent`; the ACP bridge and in-process subagent backends hold consumer handles, while config-created agents are already owned by the loop fiber.
 
 ### Live events
 
 `dsh-agent` declares the live `agent/*` coordination vocabulary so plugins do not depend on the concrete loop. Exact signatures, dispatch modes, scope-filtering rules, and payload contracts live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md); the [architecture turn flow](../../../docs/architecture.md#turn-flow) shows their order relative to durable session events.
 
-The lifecycle edges have two important local caveats. `agent/created` runs after scoped setup and after both session and agent registry entries exist, but concrete driving remains locked until the immediately following `agent/session-start`; that non-vetoing notification is the first supported startup injection point. `agent/disposed` runs after the driver is quiescent and the agent leaves the registry, while ordered teardown may still be detaching its session and unwinding its scope.
+The lifecycle edges have two important local caveats. `agent/created` runs after scoped setup and after both session and agent registry entries exist. Setup is trusted composition-only code; the immediately following non-vetoing `agent/session-start` notification is the first supported startup injection point. `agent/disposed` always means the exact agent has left the registry. AgentLoop emits it after its driver is quiescent, while ordered teardown may still be detaching the session and unwinding the scope; custom agents registered directly own any stronger driver-ordering contract themselves.
 
-Most interception points are cooperative waterfalls returning seam-specific decisions. `agent/pre-step` is a serial surface-mutation checkpoint, while `agent/turn-stop` is the owner-final exception: it runs after ordinary continuation and steering folding, and its terminal state remains through turn close and flush so steering from those later listeners cannot create an extra step or turn. Ordinary queued prompts remain intact. The full rationale is in [the agent-scope RFC](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#owner-final-policy-boundaries).
+Most interception points are cooperative waterfalls returning seam-specific decisions. `agent/pre-step` is a serial surface-mutation checkpoint, while `agent/turn-stop` is the owner-final exception: it runs after ordinary continuation and steering folding, and its terminal state remains through turn close and flush so steering from those later listeners cannot create an extra step or turn. Ordinary queued prompts remain intact. The full rationale is in the [agent-scope runtime-design RFC](../../../docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md#owner-final-policy-four-narrow-boundaries).
 
 Turn and step boundaries and the model token stream are durable `session/event` facts rather than mirrored `agent/*` notifications. Consumers read `turn/*`, `step/*`, and `assistant/chunk` from the session feed; tool policy and outcome observation belong to the complete pipeline documented by [`dsh-tools`](../tools/README.md).
 
@@ -39,8 +39,8 @@ Turn and step boundaries and the model token stream are durable `session/event`
 
 The handle every plugin programs against:
 
-- `agent.send(content, options?)` — queue a message; starts a turn when idle
-- `agent.steer(content, options?)` — steer a running turn (inject between steps); behaves like `send` when idle
+- `agent.send(content, options?)` — queue a message; starts a turn when idle. Content and resolved source become one detached, deeply frozen lossless-JSON record before `agent/queued` and enqueue; invalid data throws synchronously, and caller or notification-listener in-place mutation cannot change the log or model input (`agent/prompt-submit` still rewrites by returning replacement content).
+- `agent.steer(content, options?)` — steer a running turn (inject between steps); uses the same owned acceptance boundary and behaves like `send` when idle
 - `agent.inject(content, options?)` — inject in-session context (context/message event); the next request sees it. Does not run the model. While a turn is open it joins that turn; while idle it is wrapped in a one-shot `injection` turn so every event stays turn-enclosed ([the turn-enclosure invariant](../../../docs/rfc/implemented/architecture/2026-06-15-turn-enclosure-invariant.md))
 - `agent.cancel(reason?)` — cancel ALL pending work: clears the queued + steering FIFOs, aborts the in-flight step, and drops a turn about to start (the pre-step window) so a queued-but-not-started prompt never runs. A UI/ACP `session/cancel` maps to this. The single public stop primitive. Idle with nothing pending → a safe no-op.
 - `agent.whenIdle()` — resolve once the agent reaches quiescence after settling out of `running` (idle → immediately; disposed → awaits the loop exit). A non-owner's quiescence-observation hook: it observes the work settling WITHOUT tearing the agent down. Teardown is separate — a lifecycle owner stops and unregisters via `AgentHandle.dispose()`, which awaits the loop exit directly.
diff --git a/packages/core/agent/src/dispatch.ts b/packages/core/agent/src/dispatch.ts
index b02dfeab57..cbb641d271 100644
--- a/packages/core/agent/src/dispatch.ts
+++ b/packages/core/agent/src/dispatch.ts
@@ -1,12 +1,13 @@
 /**
- * Fused scope-carrier dispatch for agent-subject events, plus the assembly
- * context builder. The ONE sanctioned spelling for dispatching `agent/*`
- * events: `agentEvents(ctx, agent).waterfall('agent/request', …)` builds the
- * scope carrier ({@link scopeTarget} keyed by the agent) AND injects the
- * subject as the first event argument in one move, so the correct dispatch is
- * also the shortest — a dispatch site cannot pass a carrier keyed to one
- * agent while naming another as the subject, which is the invariant the
- * dev-mode scoped-dispatch check asserts at runtime.
+ * Fused scope-carrier dispatch for agent-subject operations, plus the assembly
+ * context builder. The sanctioned ordinary spelling is
+ * `agentEvents(ctx, agent).waterfall('agent/request', …)`: it builds the scope
+ * carrier ({@link scopeTarget} keyed by the agent) AND injects the subject as
+ * the first argument in one move, so a site cannot name a different subject.
+ * The registry lifecycle pair is the deliberate exception: `enter()` captures
+ * one stable carrier before commit and `announce()`/detach dispatch through it
+ * directly, so both lifecycle edges use the same routing identity. The dev
+ * scoped-dispatch invariant checks both shapes.
  *
  * @module @deepseek-ai/dsh-agent/dispatch
  */
@@ -45,7 +46,10 @@ type Tail<K extends AgentSubjectEvent> = Params<Events[K]> extends [Agent, ...in
  */
 export interface AgentEventDispatch {
   /**
-   * Fire-and-forget notification (Cordis `emit`) in the agent's scope.
+   * Fire-and-forget notification in the agent's scope. Every listener is
+   * invoked; synchronous throws and returned-promise rejections are logged and
+   * contained per listener, so a notification cannot veto lifecycle progress
+   * or starve a later observer.
    * @param name - the agent-subject event to emit.
    * @param rest - the event's arguments after the injected agent.
    */
@@ -57,16 +61,6 @@ export interface AgentEventDispatch {
    * @returns the serial chain's result (the first bail value, if any).
    */
   serial<K extends AgentSubjectEvent>(name: K, ...rest: Tail<K>): Promise<Awaited<Return<Events[K]>>>
-  /**
-   * Await listeners in order and return the first value other than `undefined`.
-   * Unlike Cordis `serial`, this does not silently treat `null` or `false` as
-   * abstentions. Use it for a runtime-validated public boundary whose declared
-   * abstention is exactly `undefined` (currently `agent/turn-stop`).
-   * @param name - the agent-subject event to dispatch.
-   * @param rest - the event's arguments after the injected agent.
-   * @returns the first non-undefined listener result, or undefined.
-   */
-  strictSerial<K extends AgentSubjectEvent>(name: K, ...rest: Tail<K>): Promise<Awaited<Return<Events[K]>>>
   /**
    * Around-middleware dispatch (Cordis `waterfall`) in the agent's scope. The
    * declared event parameters already end with the `next` callback, so `rest`
@@ -96,31 +90,28 @@ export function agentEvents(ctx: Context, agent: Agent): AgentEventDispatch {
   // tuple — hence one contained, shape-preserving cast per method.
   return {
     emit(name, ...rest) {
-      // eslint-disable-next-line @typescript-eslint/unbound-method -- the events mixin accessor returns a pre-bound function
-      const emit = ctx.emit as (thisArg: Scoped<Agent>, name: string, ...args: unknown[]) => void
-      emit(carrier, name, agent, ...rest)
+      // Cordis emit invokes callbacks through Array.map: one synchronous throw
+      // starves later listeners, and returned promises are discarded. Agent
+      // notifications are non-vetoing, so resolve the same filtered callback
+      // set ourselves and contain both failure modes independently.
+      const args: unknown[] = [carrier, name, agent, ...rest]
+      const callbacks = ctx.events.dispatch('emit', args)
+      for (const callback of callbacks) {
+        try {
+          const returned: unknown = callback(...args)
+          void Promise.resolve(returned).catch((error: unknown) => {
+            ctx.logger.warn(`agent event "${name}" listener rejected: ${String(error)}`)
+          })
+        } catch (error: unknown) {
+          ctx.logger.warn(`agent event "${name}" listener threw: ${String(error)}`)
+        }
+      }
     },
     async serial(name, ...rest) {
       // eslint-disable-next-line @typescript-eslint/unbound-method -- the events mixin accessor returns a pre-bound function
       const serial = ctx.serial as (thisArg: Scoped<Agent>, name: string, ...args: unknown[]) => Promise<never>
       return await serial(carrier, name, agent, ...rest)
     },
-    strictSerial(name, ...rest) {
-      return (async (): Promise<unknown> => {
-        // EventsService.dispatch applies the carrier filter and emits the same
-        // internal/dispatch instrumentation as ctx.serial, then mutates `args`
-        // down to the actual listener parameters. Invoke those callbacks in order
-        // ourselves so every non-undefined value reaches the caller's validator;
-        // Cordis serial would discard null/false before validation could see them.
-        const args: unknown[] = [carrier, name, agent, ...rest]
-        const callbacks = ctx.events.dispatch('serial', args)
-        for (const callback of callbacks) {
-          const result: unknown = await callback(...args)
-          if (result !== undefined) return result
-        }
-        return undefined
-      })() as Promise<Awaited<Return<Events[typeof name]>>>
-    },
     waterfall(name, ...rest) {
       // eslint-disable-next-line @typescript-eslint/unbound-method -- the events mixin accessor returns a pre-bound function
       const waterfall = ctx.waterfall as (thisArg: Scoped<Agent>, name: string, ...args: unknown[]) => never
diff --git a/packages/core/agent/src/index.ts b/packages/core/agent/src/index.ts
index c73de89e6d..42b9d13e35 100644
--- a/packages/core/agent/src/index.ts
+++ b/packages/core/agent/src/index.ts
@@ -5,8 +5,9 @@
  * @module @deepseek-ai/dsh-agent
  */
 
-import { Context, Service } from 'cordis'
+import { Context, getTraceable, Service, symbols } from 'cordis'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
+import type { Scoped } from '@deepseek-ai/dsh-scope'
 import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
 import type { Agent, AgentId, AgentOptions } from './types.ts'
 
@@ -39,31 +40,37 @@ declare module 'cordis' {
  */
 export interface CreateAgentOptions {
   /** The agent's id (the registry handle). */
-  agentId: AgentId
+  readonly agentId: AgentId
   /** The live session's id (NOT derived from agentId). */
-  sessionId: SessionId
+  readonly sessionId: SessionId
   /**
    * Session creation metadata: validated absolute `cwd`, `parentSession`
    * fork lineage, and the `seedLength` seed boundary. Mirrors the
    * `cwd`/`parentSession`/`seedLength` fields of
    * {@link CreateSessionOptions.meta} in dsh-session (the internal-only
    * `createdAt`, used when reconstructing a persisted session, is deliberately
-   * excluded — a factory caller never sets it).
+   * excluded — a factory caller never sets it). This is durable session data,
+   * so the session boundary validates and snapshots it before asynchronous
+   * setup begins.
    */
-  meta?: { cwd?: string; parentSession?: SessionId; seedLength?: number }
+  readonly meta?: { readonly cwd?: string; readonly parentSession?: SessionId; readonly seedLength?: number }
   /**
    * Seed events to reconstruct the child session's log from (the fork lineage
    * primitive). When present, the factory creates the session with this event
    * prefix so `deriveMessages()`/`lastTurnNumber` continue from it — used by the
    * in-process FORK subagent backend to seed a child with a balanced
    * completed-turn prefix of the parent's log. The prefix MUST be contiguous
-   * from seq 0 and balanced (no open turn/step, no dangling tool-call), or the
-   * session constructor (and the dev-mode invariants replay) reject it. Absent
-   * for a fresh (spawn) child.
+   * from seq 0, carry only lossless-JSON data, and be balanced (no open
+   * turn/step, no dangling tool-call), or the session constructor (and the
+   * dev-mode invariants replay) reject it. The factory passes the raw seed to
+   * the session's durable validator/snapshot boundary. Absent for a fresh
+   * (spawn) child.
    */
-  seed?: SessionEvent[]
+  readonly seed?: readonly SessionEvent[]
   /** Per-agent options (model, …). */
-  agentOptions?: AgentOptions
+  readonly agentOptions?: AgentOptions
+  /** Optional creation-only cancellation signal; detached before the returned handle becomes visible. */
+  readonly signal?: AbortSignal
   /**
    * Creation-time composition of the agent's scoped world. The factory awaits
    * setup after minting `agentCtx` but BEFORE inserting or announcing either
@@ -74,11 +81,11 @@ export interface CreateAgentOptions {
    * first prompt assembly. A throw/rejection or owner disposal rolls the scope
    * back without publishing either id.
    *
-   * **Setup composes, it never drives**: calling `send`/`steer`/`inject` here
-   * would run an unpublished agent and violate the session-start boundary.
-   * Drive the agent only after the creation promise resolves.
+   * **Setup composes, it never drives**: the callback is trusted same-process
+   * code and receives the full scoped context, so this is a contract rather
+   * than a runtime restriction. Drive the agent only after creation resolves.
    */
-  setup?: (agentCtx: Context) => Promise<void> | void
+  readonly setup?: (agentCtx: Context) => Promise<void> | void
 }
 
 /**
@@ -87,36 +94,42 @@ export interface CreateAgentOptions {
  */
 export interface ResumeAgentOptions {
   /** The agent's id (the registry handle). */
-  agentId: AgentId
+  readonly agentId: AgentId
   /** The persisted session id to load and resume on. */
-  resumeSessionId: SessionId
+  readonly resumeSessionId: SessionId
   /** Per-agent options (model, …). */
-  agentOptions?: AgentOptions
+  readonly agentOptions?: AgentOptions
+  /** Optional creation-only cancellation signal for persistence load/setup; detached before return. */
+  readonly signal?: AbortSignal
   /**
    * Resume-time composition of the agent's fresh scoped world. Persistence is
    * loaded first; the factory then mints `agentCtx` and awaits setup while the
    * reconstructed session and agent remain unpublished. The callback has the
-   * same composition-only contract as {@link CreateAgentOptions.setup}: all
-   * registrations exist before either creation announcement, driving verbs are
-   * unavailable until the session-start boundary, and rejection or owner
-   * disposal rolls the transaction back without publishing either id.
+   * same trusted composition-only contract as
+   * {@link CreateAgentOptions.setup}: all registrations exist before either
+   * creation announcement, and rejection or owner disposal rolls the
+   * transaction back without publishing either id.
    */
-  setup?: (agentCtx: Context) => Promise<void> | void
+  readonly setup?: (agentCtx: Context) => Promise<void> | void
 }
 
 /**
  * An owned agent plus its disposer, returned by {@link AgentRegistry.create} /
- * {@link AgentRegistry.resume}. The disposer is a CAPABILITY: only the holder
- * can tear this agent down. `dispose()` stops the loop, awaits its exit and
- * every outstanding idle-injection flush (quiescence — NOT just the `disposed`
+ * {@link AgentRegistry.resume}. The disposer is a CAPABILITY: among consumers,
+ * only the holder can tear this agent down. The registered factory provider is
+ * also a structural owner because the scoped agent depends on that provider's
+ * service surface; provider unload stops and drains every live handle it made.
+ * `dispose()` stops the loop, awaits its exit and every outstanding
+ * idle-injection flush (quiescence — NOT just the `disposed`
  * status flip), unregisters the agent, removes its session from the store, and
  * finally unwinds its scoped world. This order captures every agent-started
  * `session/flush` before the session is detached and keeps scoped listeners
  * alive through those checkpoints.
  *
- * `ctx.agents.get(id)` still returns a bare {@link Agent} — the handle is only
- * for the OWNER that created it. Config-created agents (the loop's own startup)
- * are owned by the loop fiber and never need a handle.
+ * `ctx.agents.get(id)` still returns a bare {@link Agent} — the handle is
+ * exposed only to the consumer owner that created it; the structural provider
+ * reaches the same teardown internally. Config-created agents (the loop's own
+ * startup) are owned by the loop fiber and never need a handle.
  */
 export interface AgentHandle {
   agent: Agent
@@ -133,32 +146,53 @@ export interface AgentFactory {
   /**
    * Create a new agent on a caller-supplied session id. Async because creation
    * awaits unpublished setup, inserts both session and agent, emits their
-   * creation notifications in order, unlocks driving at
-   * `agent/session-start`, and only then starts the loop. The sequence is
+   * creation notifications in order, emits `agent/session-start`, and only
+   * then starts the loop. The sequence is
    * rollback-covered, but notifications delivered before a later listener
-   * failure remain observable; if agent announcement began, rollback emits
-   * `agent/disposed`, while the session entry is removed without a separate
-   * disposal event. The owner disposes the resolved handle to stop/drain,
+   * failure remain observable; every agent or session creation announcement
+   * that began is paired by `agent/disposed` or `session/disposed` during
+   * rollback. The owner disposes the resolved handle to stop/drain,
    * unregister, remove the session, and unwind the scope.
+   * The registry passes a context carrying the `create()` caller's fiber and
+   * scope as `ownerCtx`. The implementation attaches the unpublished
+   * transaction and resulting lifecycle to that owner; it must not infer
+   * ownership from the factory object's registration context.
+   * @param ownerCtx - caller-bound context that owns the transaction and live handle.
    * @param options - agent/session identity, configuration, and optional setup.
    * @returns the owned handle after setup, both announcements, and loop start complete.
    */
-  createAgent(options: CreateAgentOptions): Promise<AgentHandle>
+  createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise<AgentHandle>
   /**
    * Load a persisted session and resume an agent on it. Async because it awaits
    * both `ctx.sessionPersistence.load` and the optional unpublished setup
    * transaction; must be called after that service exists (consumers inject
-   * `sessionPersistence`). Publication and drive unlocking follow the same
-   * ordered boundary as {@link createAgent}.
+   * `sessionPersistence`). Publication follows the same ordered boundary as
+   * {@link createAgent}.
+   * @param ownerCtx - caller-bound context that owns load, setup, and the live handle.
    * @param options - persisted identity, configuration, and optional setup.
    * @returns the owned handle after setup, both announcements, and loop start complete.
    */
-  resume(options: ResumeAgentOptions): Promise<AgentHandle>
+  resume(ownerCtx: Context, options: ResumeAgentOptions): Promise<AgentHandle>
 }
 
 /** Thrown when create/resume is called before an agent factory is registered. */
 const NO_FACTORY_MESSAGE = 'no agent factory registered (load an agent-loop plugin)'
 
+/** All mutable lifecycle state for one exact registry entry. */
+interface AgentEntry {
+  readonly id: AgentId
+  readonly agent: Agent
+  readonly carrier: Scoped<Agent>
+  announced: boolean
+  announcing: boolean
+  detachRequested: boolean
+}
+
+/** Plain holder prevents Cordis from tracing the factory field before the caller context is known. */
+interface FactorySlot {
+  readonly target: AgentFactory
+}
+
 /**
  * Agent registry (`ctx.agents`): tracks live agents so UI, hook, and
  * orchestrator plugins can find them without depending on the concrete loop
@@ -167,10 +201,9 @@ const NO_FACTORY_MESSAGE = 'no agent factory registered (load an agent-loop plug
  * {@link setFactory}.
  */
 export class AgentRegistry extends Service {
-  private store = new Map<AgentId, Agent>()
-  /** Entries whose `agent/created` announcement phase began. */
-  private announced = new WeakSet<Agent>()
-  private factory: AgentFactory | undefined
+  private store = new Map<AgentId, AgentEntry>()
+  private entries = new WeakMap<Agent, AgentEntry>()
+  private factory: FactorySlot | undefined
 
   constructor(ctx: Context) {
     super(ctx, 'agents')
@@ -185,8 +218,11 @@ export class AgentRegistry extends Service {
 
   /**
    * Register the agent-creation factory (the loop calls this on construction,
-   * effect-scoped). Throws if a factory is already registered. Returns the
-   * disposer; on dispose the factory slot is cleared.
+   * effect-scoped). A traced Cordis service is canonicalized to its concrete
+   * target; each create/resume call is then traced through that caller's
+   * context so ownership follows the caller without stacking proxy layers.
+   * Throws if a factory is already registered. Returns the disposer; on
+   * dispose the factory slot is cleared.
    * @param factory - the loop-owned factory {@link create}/{@link resume} delegate to.
    * @returns the disposer that clears the factory slot. The exact
    *   Cordis effect disposer (single-shot): composite (generator) effects may
@@ -195,7 +231,11 @@ export class AgentRegistry extends Service {
   setFactory(factory: AgentFactory): () => Promise<void> | void {
     const dispose = this.ctx.effect(() => {
       if (this.factory !== undefined) throw new Error('an agent factory is already registered')
-      this.factory = factory
+      // Avoid stacking two Cordis shadow layers when a caller passes a Service
+      // already read through a context. Calls are re-traced through their
+      // actual owner context below.
+      const target = (factory as AgentFactory & { [symbols.original]?: AgentFactory })[symbols.original] ?? factory
+      this.factory = { target }
       return () => { this.factory = undefined }
     }, 'agents.setFactory()')
     // The exact cordis effect disposer (the agents.register() convention): a
@@ -205,6 +245,12 @@ export class AgentRegistry extends Service {
     return dispose
   }
 
+  /** Return the active creation factory. */
+  private requireFactory(): FactorySlot {
+    if (this.factory === undefined) throw new Error(NO_FACTORY_MESSAGE)
+    return this.factory
+  }
+
   /**
    * Create and publish a new agent through the registered factory.
    * Distinct from {@link register} (which records an already-constructed
@@ -215,8 +261,15 @@ export class AgentRegistry extends Service {
    * @returns the handle after setup, rollback-covered publication, and loop start complete.
    */
   async create(options: CreateAgentOptions): Promise<AgentHandle> {
-    if (this.factory === undefined) throw new Error(NO_FACTORY_MESSAGE)
-    return this.factory.createAgent(options)
+    const ownerCtx = this.ctx
+    // Re-trace a Service-backed factory through the accessing context
+    // explicitly. This preserves AgentLoop's dependency origin while binding
+    // its effects to ownerCtx; plain factories receive ownerCtx as an explicit
+    // capability and need no Cordis tracker magic.
+    const { target } = this.requireFactory()
+    const receiver = getTraceable(ownerCtx, target)
+    // eslint-disable-next-line @typescript-eslint/unbound-method -- Reflect.apply intentionally supplies the caller-traced receiver
+    return Reflect.apply(target.createAgent, receiver, [ownerCtx, options])
   }
 
   /**
@@ -227,8 +280,11 @@ export class AgentRegistry extends Service {
    * @returns the handle after setup, rollback-covered publication, and loop start complete.
    */
   async resume(options: ResumeAgentOptions): Promise<AgentHandle> {
-    if (this.factory === undefined) throw new Error(NO_FACTORY_MESSAGE)
-    return this.factory.resume(options)
+    const ownerCtx = this.ctx
+    const { target } = this.requireFactory()
+    const receiver = getTraceable(ownerCtx, target)
+    // eslint-disable-next-line @typescript-eslint/unbound-method -- Reflect.apply intentionally supplies the caller-traced receiver
+    return Reflect.apply(target.resume, receiver, [ownerCtx, options])
   }
 
   /**
@@ -265,27 +321,72 @@ export class AgentRegistry extends Service {
    * calling {@link announce}. Ordinary callers use {@link register}.
    * @param agent - the prepared, unpublished agent.
    * @returns an idempotent closure that removes this exact entry and emits
-   *   `agent/disposed` with listener failures contained.
+   *   `agent/disposed` with listener failures contained. When called from a
+   *   synchronous `agent/created` listener, removal and disposal wait until
+   *   that creation dispatch unwinds.
    */
   enter(agent: Agent): () => void {
-    if (this.store.has(agent.id)) {
-      throw new Error(`agent "${agent.id}" is already registered`)
+    const id = agent.id
+    const carrier = scopeTarget(agent, agent)
+    // This is the authoritative collision boundary. Concurrent create/resume
+    // operations may both prepare, but only one exact entry can publish.
+    if (this.entries.has(agent) || this.store.has(id)) throw new Error(`agent "${id}" is already registered`)
+    const entry: AgentEntry = {
+      id,
+      agent,
+      carrier,
+      announced: false,
+      announcing: false,
+      detachRequested: false,
     }
-    this.store.set(agent.id, agent)
+    this.store.set(id, entry)
+    this.entries.set(agent, entry)
     let entered = true
-    return () => {
+    const detach = (): void => {
       if (!entered) return
       entered = false
-      this.store.delete(agent.id)
-      // An insertion rolled back before announce was never externally created,
-      // so emitting disposed would invent an impossible lifecycle edge. Marking
-      // happens before the created emit: if a later created listener throws,
-      // earlier listeners may already have observed it and must see disposal.
-      if (!this.announced.delete(agent)) return
+      // Every callback reached by this creation dispatch must observe the same
+      // live entry, and disposal must follow creation. A listener may own
+      // the advanced detach capability, so make that ordering structural:
+      // visibility and the paired disposal are deferred until announce()'s
+      // synchronous dispatch has unwound.
+      if (entry.announcing) {
+        entry.detachRequested = true
+        return
+      }
+      this.detachEntered(entry)
+    }
+    return detach
+  }
+
+  /** Remove one exact entered agent and emit its paired disposal when announced. */
+  private detachEntered(entry: AgentEntry): void {
+    entry.detachRequested = false
+    // A stale capability can never delete a later same-id lifecycle. The
+    // captured entry identity is the final boundary.
+    /* v8 ignore next -- enter() rejects replacement while this single-shot detach capability is live. */
+    if (this.store.get(entry.id) !== entry) return
+    this.store.delete(entry.id)
+    this.entries.delete(entry.agent)
+    // An insertion rolled back before announce was never externally created,
+    // so emitting disposed would invent an impossible lifecycle edge. Marking
+    // happens before the created emit: if a later created listener throws,
+    // earlier listeners may already have observed it and must see disposal.
+    if (!entry.announced) return
+    this.emitDisposed(entry)
+  }
+
+  /** Emit the paired disposal edge through the entry's stable carrier. */
+  private emitDisposed(entry: AgentEntry): void {
+    const args: unknown[] = [entry.carrier, 'agent/disposed', entry.agent]
+    for (const callback of this.ctx.events.dispatch('emit', args)) {
       try {
-        this.ctx.emit(scopeTarget(agent, agent), 'agent/disposed', agent)
+        const returned: unknown = callback(...args)
+        void Promise.resolve(returned).catch((error: unknown) => {
+          this.ctx.logger.warn(`agent "${entry.id}": agent/disposed listener rejected: ${String(error)}`)
+        })
       } catch (error: unknown) {
-        this.ctx.logger.warn(`agent "${agent.id}": agent/disposed listener threw: ${String(error)}`)
+        this.ctx.logger.warn(`agent "${entry.id}": agent/disposed listener threw: ${String(error)}`)
       }
     }
   }
@@ -293,14 +394,37 @@ export class AgentRegistry extends Service {
   /**
    * Announce an agent previously inserted with {@link enter}.
    * @param agent - the live inserted agent to announce.
-   * @throws if `agent` is not the exact live registry entry for its id.
+   * @throws if `agent` is not the exact live registry entry for its id, or its
+   *   creation announcement already began (including a reentrant call from a
+   *   creation listener).
    */
   announce(agent: Agent): void {
-    if (this.store.get(agent.id) !== agent) {
+    const entry = this.entries.get(agent)
+    if (entry === undefined || this.store.get(entry.id) !== entry) {
       throw new Error(`agent "${agent.id}" is not live in this registry`)
     }
-    this.announced.add(agent)
-    this.ctx.emit(scopeTarget(agent, agent), 'agent/created', agent)
+    if (entry.announced || entry.announcing) {
+      throw new Error(`agent "${entry.id}" was already announced`)
+    }
+    // Mark before dispatch so a listener cannot recursively create a second
+    // lifecycle edge; detach still pairs a partially delivered first edge.
+    entry.announcing = true
+    entry.announced = true
+    const args: unknown[] = [entry.carrier, 'agent/created', entry.agent]
+    try {
+      for (const callback of this.ctx.events.dispatch('emit', args)) {
+        // A synchronous creation failure vetoes publication and rolls back.
+        // Returned-promise rejection happens after this synchronous boundary, so
+        // observe and report it instead of leaking an unhandled rejection.
+        const returned: unknown = callback(...args)
+        void Promise.resolve(returned).catch((error: unknown) => {
+          this.ctx.logger.warn(`agent "${entry.id}": agent/created listener rejected: ${String(error)}`)
+        })
+      }
+    } finally {
+      entry.announcing = false
+      if (entry.detachRequested) this.detachEntered(entry)
+    }
   }
 
   /**
@@ -309,7 +433,7 @@ export class AgentRegistry extends Service {
    * @returns the agent, or undefined when no live agent has that id.
    */
   get(id: AgentId): Agent | undefined {
-    return this.store.get(id)
+    return this.store.get(id)?.agent
   }
 
   /**
@@ -317,7 +441,7 @@ export class AgentRegistry extends Service {
    * @returns a fresh array; mutating it does not affect the registry.
    */
   list(): Agent[] {
-    return [...this.store.values()]
+    return [...this.store.values()].map(entry => entry.agent)
   }
 }
 
diff --git a/packages/core/agent/src/types.ts b/packages/core/agent/src/types.ts
index 4196eb43d6..9350a5cc03 100644
--- a/packages/core/agent/src/types.ts
+++ b/packages/core/agent/src/types.ts
@@ -202,12 +202,21 @@ export interface Agent {
    */
   readonly ctx: Context
 
-  /** Queue a user message. Starts a turn when idle; otherwise waits for the next turn. */
+  /**
+   * Queue a user message. Starts a turn when idle; otherwise waits for the next
+   * turn. Content and the resolved source are accepted as one detached,
+   * deeply-frozen lossless-JSON record before notification or enqueue, so
+   * caller or `agent/queued` listener in-place mutation cannot change later
+   * log/model input. Throws synchronously when either value is not losslessly
+   * JSON-serializable; `agent/prompt-submit` may still return an explicit
+   * replacement.
+   */
   send(content: ContentBlock[], options?: SendOptions): void
 
   /**
    * Steer a running turn: content is injected between steps of the current
-   * turn. When idle, behaves like {@link send}.
+   * turn. Uses the same owned-value and synchronous-validation boundary as
+   * {@link send}; when idle, behaves exactly like that method.
    */
   steer(content: ContentBlock[], options?: SendOptions): void
 
@@ -285,10 +294,17 @@ declare module 'cordis' {
     // ---- lifecycle (emit) ----
     /**
      * An agent's fully composed scoped world was published in the
-     * {@link AgentRegistry}. Its session is already live in the session store,
-     * but concrete factories may keep driving verbs locked until the subsequent
-     * `agent/session-start` boundary; that event is the first supported place
-     * to inject or queue work during startup.
+     * {@link AgentRegistry}. Its session is already live in the session store.
+     * Setup is composition-only by contract; the subsequent
+     * `agent/session-start` boundary is the first supported place to inject or
+     * queue startup work. A synchronous listener throw
+     * vetoes publication and rollback emits the matching disposal edges;
+     * returned-promise rejection is observed and logged but cannot
+     * retroactively veto this synchronous boundary. A synchronous listener
+     * that requests the advanced registry detach does not remove the entry
+     * immediately: removal and the paired `agent/disposed` edge wait until the
+     * creation dispatch unwinds, so no later creation listener observes a
+     * disposal that preceded its own creation callback.
      * @param agent - the newly registered agent with its live session and completed setup.
      * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered
      * through `agent.ctx` fires only for that agent's dispatches; a listener on a
@@ -299,11 +315,12 @@ declare module 'cordis' {
      */
     'agent/created'(this: Scoped<Agent>, agent: Agent): void
     /**
-     * An agent was removed from the registry after its driver and any in-flight
-     * turn reached quiescence. Ordered teardown may still be detaching the
-     * session and unwinding the agent's scoped registrations when this
-     * notification runs.
-     * @param agent - the deregistered agent; its driving handle is now inert.
+     * An agent was removed from the registry. The concrete AgentLoop lifecycle
+     * emits this only after its driver and any in-flight turn reach quiescence;
+     * a custom agent registered through the public registry owns its own driver
+     * contract, which the registry cannot infer. Ordered teardown may still be
+     * detaching the session and unwinding scoped registrations when this runs.
+     * @param agent - the exact agent removed from the registry.
      * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered
      * through `agent.ctx` fires only for that agent's dispatches; a listener on a
      * plain plugin context fires for every agent. The dispatch `this` is the
@@ -327,11 +344,12 @@ declare module 'cordis' {
      */
     'agent/status'(this: Scoped<Agent>, agent: Agent, status: AgentStatus): void
     /**
-     * A message entered the agent's inbox (queued or steering). `source` is
-     * the resolved source (defaults applied), not the caller's raw options.
+     * A message entered the agent's inbox (queued or steering). Content and the
+     * resolved source are the detached, deeply-frozen values retained by the
+     * inbox. `source` has defaults applied and is not the caller's raw options.
      * @param agent - the agent whose inbox received the message.
-     * @param content - the enqueued content blocks, verbatim.
-     * @param info - the resolved source plus whether it entered as steering.
+     * @param content - the accepted content blocks retained by the inbox.
+     * @param info - the accepted source plus whether it entered as steering.
      * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered
      * through `agent.ctx` fires only for that agent's dispatches; a listener on a
      * plain plugin context fires for every agent. The dispatch `this` is the
@@ -345,11 +363,12 @@ declare module 'cordis' {
     /**
      * The agent's session lifecycle began, fired once before its first turn.
      * `source` says why ({@link SessionStartSource}: fresh startup, a resumed
-     * persisted session, …). A pure NOTIFICATION (emit, not waterfall): it
-     * carries no veto — a session-start listener that wants to seed context does
-     * so via `agent.inject()` (a `context/message` the first request sees), not
-     * by returning a decision. Cannot block the session from starting; that gap
-     * is deliberate (a bridge logs/injects, it does not gate startup).
+     * persisted session, …). A pure NOTIFICATION (emit, not waterfall): a
+     * listener cannot veto by returning a decision or throwing. A listener that
+     * wants to seed context does so via `agent.inject()` (a `context/message` the
+     * first request sees). A lifecycle owner can still dispose its structural
+     * ownership edge during this notification; publication rechecks liveness and
+     * then aborts before the driver starts.
      * @param agent - the agent whose session lifecycle began.
      * @param source - why the session started (fresh startup, resume, …).
      * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered
diff --git a/packages/core/agent/tests/agent.spec.ts b/packages/core/agent/tests/agent.spec.ts
index 4e89dc0e84..cd40ba59e3 100644
--- a/packages/core/agent/tests/agent.spec.ts
+++ b/packages/core/agent/tests/agent.spec.ts
@@ -1,7 +1,8 @@
 import { describe, expect, it } from 'vitest'
-import { Context } from 'cordis'
+import { Context, Service, symbols } from 'cordis'
 import { Session, SessionId } from '@deepseek-ai/dsh-session'
-import AgentRegistry, { Agent, AgentId } from '@deepseek-ai/dsh-agent'
+import AgentRegistry, { AgentId, agentEvents } from '@deepseek-ai/dsh-agent'
+import type { Agent, AgentFactory, CreateAgentOptions, ResumeAgentOptions } from '@deepseek-ai/dsh-agent'
 
 function stubAgent(rawId: string): Agent {
   const id = AgentId(rawId)
@@ -10,8 +11,6 @@ function stubAgent(rawId: string): Agent {
     options: {},
     session: new Session(SessionId(`${id}-session`)),
     status: 'idle',
-    // A bare context stands in for the agent scope: registry tests never
-    // register through it, they only need the field present.
     ctx: new Context(),
     send() {},
     steer() {},
@@ -22,150 +21,203 @@ function stubAgent(rawId: string): Agent {
 }
 
 describe('AgentRegistry', () => {
-  it('registers agents and emits created/disposed events', async () => {
+  it('registers exact entries, emits lifecycle events, and unregisters on owner disposal', async () => {
     const ctx = new Context()
     await ctx.plugin(AgentRegistry)
-
-    const created: string[] = []
-    const disposed: string[] = []
-    ctx.on('agent/created', agent => void created.push(agent.id))
-    ctx.on('agent/disposed', agent => void disposed.push(agent.id))
+    const lifecycle: string[] = []
+    ctx.on('agent/created', agent => void lifecycle.push(`created:${agent.id}`))
+    ctx.on('agent/disposed', agent => void lifecycle.push(`disposed:${agent.id}`))
 
     const agent = stubAgent('a1')
     const dispose = ctx.agents.register(agent)
-    expect(created).toEqual(['a1'])
-    expect(ctx.agents.get(AgentId('a1'))).toBe(agent)
+    expect(ctx.agents.get(agent.id)).toBe(agent)
     expect(ctx.agents.list()).toEqual([agent])
+    expect(() => ctx.agents.register(stubAgent('a1'))).toThrow(/already registered/)
 
     await dispose()
-    expect(disposed).toEqual(['a1'])
-    expect(ctx.agents.get(AgentId('a1'))).toBeUndefined()
+    expect(ctx.agents.get(agent.id)).toBeUndefined()
+    expect(lifecycle).toEqual(['created:a1', 'disposed:a1'])
   })
 
-  it('rejects duplicate ids and unregisters on fiber dispose (HMR safety)', async () => {
+  it('rolls an entry back and pairs a partially delivered creation when a listener throws', async () => {
     const ctx = new Context()
     await ctx.plugin(AgentRegistry)
-    ctx.agents.register(stubAgent('main'))
-    expect(() => ctx.agents.register(stubAgent('main'))).toThrow('already registered')
+    const lifecycle: string[] = []
+    ctx.on('agent/created', agent => void lifecycle.push(`created:${agent.id}`))
+    ctx.on('agent/created', () => { throw new Error('creation veto') })
+    ctx.on('agent/disposed', agent => void lifecycle.push(`disposed:${agent.id}`))
 
-    const fiber = await ctx.plugin(Object.assign((inner: Context) => {
-      inner.agents.register(stubAgent('scoped'))
-    }, { inject: ['agents'] }))
-    expect(ctx.agents.list().map(a => a.id)).toEqual(['main', 'scoped'])
-
-    await fiber.dispose()
-    expect(ctx.agents.list().map(a => a.id)).toEqual(['main'])
+    expect(() => ctx.agents.register(stubAgent('vetoed'))).toThrow('creation veto')
+    expect(ctx.agents.get(AgentId('vetoed'))).toBeUndefined()
+    expect(lifecycle).toEqual(['created:vetoed', 'disposed:vetoed'])
   })
 
-  it('rolls back the agent entry when an agent/created listener throws (P1-1)', async () => {
+  it('contains asynchronous creation rejection and every disposal-listener failure', async () => {
     const ctx = new Context()
     await ctx.plugin(AgentRegistry)
+    const warnings: string[] = []
+    const heard: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    ctx.on('agent/created', () => Promise.reject(new Error('created async')) as never)
+    ctx.on('agent/disposed', () => { throw new Error('disposed sync') })
+    ctx.on('agent/disposed', () => Promise.reject(new Error('disposed async')) as never)
+    ctx.on('agent/disposed', agent => void heard.push(agent.id))
 
-    let threw = false
-    ctx.on('agent/created', () => {
-      if (!threw) { threw = true; throw new Error('boom created listener') }
-    })
-
-    // The throwing emit must roll the entry back, not leak it.
-    expect(() => ctx.agents.register(stubAgent('main'))).toThrow('boom created listener')
-    expect(ctx.agents.get(AgentId('main'))).toBeUndefined() // rolled back, not leaked
-
-    // A subsequent listener-free register of the SAME id succeeds and is
-    // tracked exactly once (the duplicate-id check is not wedged).
-    const dispose = ctx.agents.register(stubAgent('main'))
-    expect(ctx.agents.list().map(a => a.id)).toEqual(['main'])
+    const dispose = ctx.agents.register(stubAgent('contained'))
+    await Promise.resolve()
     await dispose()
-    expect(ctx.agents.get(AgentId('main'))).toBeUndefined()
+    await Promise.resolve()
+
+    expect(heard).toEqual(['contained'])
+    expect(warnings).toEqual([
+      'agent "contained": agent/created listener rejected: Error: created async',
+      'agent "contained": agent/disposed listener threw: Error: disposed sync',
+      'agent "contained": agent/disposed listener rejected: Error: disposed async',
+    ])
   })
 
-  it('splits insertion from announcement and makes the detach exact/idempotent', async () => {
+  it('separates entry from announcement and stale/idempotent detach cannot remove a replacement', async () => {
     const ctx = new Context()
     await ctx.plugin(AgentRegistry)
-    const created: Agent[] = []
-    const disposed: Agent[] = []
-    ctx.on('agent/created', agent => void created.push(agent))
-    ctx.on('agent/disposed', agent => void disposed.push(agent))
+    const lifecycle: string[] = []
+    ctx.on('agent/created', agent => void lifecycle.push(`created:${agent.id}`))
+    ctx.on('agent/disposed', agent => void lifecycle.push(`disposed:${agent.id}`))
 
     const first = stubAgent('split')
     const detachFirst = ctx.agents.enter(first)
-    expect(ctx.agents.get(first.id)).toBe(first)
-    expect(created).toEqual([])
+    expect(lifecycle).toEqual([])
     ctx.agents.announce(first)
-    expect(created).toEqual([first])
+    expect(() => { ctx.agents.announce(first) }).toThrow(/already announced/)
     detachFirst()
     detachFirst()
-    expect(disposed).toEqual([first])
 
     const replacement = stubAgent('split')
     const detachReplacement = ctx.agents.enter(replacement)
-    // A stale repeated detach cannot remove the replacement.
     detachFirst()
     expect(ctx.agents.get(replacement.id)).toBe(replacement)
     expect(() => { ctx.agents.announce(first) }).toThrow(/not live/)
     detachReplacement()
-    // The replacement was inserted but never announced, so rollback produces
-    // no disposed-without-created notification.
-    expect(disposed).toEqual([first])
+    expect(lifecycle).toEqual(['created:split', 'disposed:split'])
+  })
+
+  it('defers detach requested by a creation listener until that dispatch unwinds', async () => {
+    const ctx = new Context()
+    await ctx.plugin(AgentRegistry)
+    const order: string[] = []
+    const agent = stubAgent('reentrant')
+    ctx.on('agent/created', () => {
+      order.push(`first:${ctx.agents.get(agent.id) === agent}`)
+      detach()
+      order.push(`after-detach:${ctx.agents.get(agent.id) === agent}`)
+    })
+    ctx.on('agent/created', () => void order.push(`second:${ctx.agents.get(agent.id) === agent}`))
+    ctx.on('agent/disposed', () => void order.push('disposed'))
+    const detach = ctx.agents.enter(agent)
+    ctx.agents.announce(agent)
+    expect(order).toEqual(['first:true', 'after-detach:true', 'second:true', 'disposed'])
+    expect(ctx.agents.get(agent.id)).toBeUndefined()
+  })
+})
+
+describe('agentEvents()', () => {
+  it('contains each synchronous throw and returned-promise rejection', async () => {
+    const ctx = new Context()
+    const warnings: string[] = []
+    const heard: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const agent = stubAgent('event')
+    ctx.on('agent/status', () => { throw new Error('sync listener') })
+    ctx.on('agent/status', () => Promise.reject(new Error('async listener')) as never)
+    ctx.on('agent/status', (_agent, status) => void heard.push(status))
+
+    agentEvents(ctx, agent).emit('agent/status', 'running')
+    await Promise.resolve()
+    expect(heard).toEqual(['running'])
+    expect(warnings).toEqual([
+      'agent event "agent/status" listener threw: Error: sync listener',
+      'agent event "agent/status" listener rejected: Error: async listener',
+    ])
   })
 })
 
 describe('AgentRegistry factory seam', () => {
-  /** A stub AgentFactory that records calls and returns a stub agent. */
   function stubFactory() {
-    const calls: { create: unknown[]; resume: unknown[] } = { create: [], resume: [] }
-    const factory: import('@deepseek-ai/dsh-agent').AgentFactory = {
-      async createAgent(options) {
-        calls.create.push(options)
+    const calls: {
+      create: Array<{ ownerCtx: Context; options: CreateAgentOptions }>
+      resume: Array<{ ownerCtx: Context; options: ResumeAgentOptions }>
+    } = { create: [], resume: [] }
+    const factory: AgentFactory = {
+      async createAgent(ownerCtx, options) {
+        calls.create.push({ ownerCtx, options })
         return { agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }
       },
-      resume(options) {
-        calls.resume.push(options)
-        return Promise.resolve({ agent: stubAgent(options.agentId), dispose: () => Promise.resolve() })
+      async resume(ownerCtx, options) {
+        calls.resume.push({ ownerCtx, options })
+        return { agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }
       },
     }
     return { factory, calls }
   }
 
-  it('create()/resume() throw when no factory is registered', async () => {
+  it('requires a factory and delegates through the calling context', async () => {
     const ctx = new Context()
     await ctx.plugin(AgentRegistry)
     await expect(ctx.agents.create({ agentId: AgentId('a'), sessionId: SessionId('s') })).rejects.toThrow(/no agent factory/)
-    await expect(ctx.agents.resume({ agentId: AgentId('a'), resumeSessionId: SessionId('s') })).rejects.toThrow(/no agent factory/)
-  })
-
-  it('setFactory registers a factory; create/resume delegate to it', async () => {
-    const ctx = new Context()
-    await ctx.plugin(AgentRegistry)
     const { factory, calls } = stubFactory()
     ctx.agents.setFactory(factory)
 
-    const created = await ctx.agents.create({ agentId: AgentId('c1'), sessionId: SessionId('sess-1'), meta: { cwd: '/w' } })
-    expect(created.agent.id).toBe('c1')
-    expect(calls.create).toEqual([{ agentId: AgentId('c1'), sessionId: SessionId('sess-1'), meta: { cwd: '/w' } }])
-
-    const resumed = await ctx.agents.resume({ agentId: AgentId('r1'), resumeSessionId: SessionId('old-sess') })
-    expect(resumed.agent.id).toBe('r1')
-    expect(calls.resume).toEqual([{ agentId: AgentId('r1'), resumeSessionId: SessionId('old-sess') }])
-  })
-
-  it('setFactory rejects a second factory', async () => {
-    const ctx = new Context()
-    await ctx.plugin(AgentRegistry)
-    ctx.agents.setFactory(stubFactory().factory)
-    expect(() => ctx.agents.setFactory(stubFactory().factory)).toThrow(/already registered/)
-  })
-
-  it('disposing the setFactory fiber clears the factory (HMR safety)', async () => {
-    const ctx = new Context()
-    await ctx.plugin(AgentRegistry)
-    let dispose!: () => Promise<void> | void
-    const fiber = await ctx.plugin(Object.assign((inner: Context) => {
-      dispose = inner.agents.setFactory(stubFactory().factory)
+    let callerFiber: Context['fiber'] | undefined
+    await ctx.plugin(Object.assign(async (inner: Context) => {
+      callerFiber = inner.fiber
+      await inner.agents.create({ agentId: AgentId('create'), sessionId: SessionId('create-s') })
+      await inner.agents.resume({ agentId: AgentId('resume'), resumeSessionId: SessionId('resume-s') })
     }, { inject: ['agents'] }))
-    await expect(ctx.agents.create({ agentId: AgentId('a'), sessionId: SessionId('s') })).resolves.toBeDefined()
-    void dispose
-    await fiber.dispose()
-    // factory slot cleared → create throws again
-    await expect(ctx.agents.create({ agentId: AgentId('a2'), sessionId: SessionId('s2') })).rejects.toThrow(/no agent factory/)
+    expect(calls.create[0]?.ownerCtx.fiber).toBe(callerFiber)
+    expect(calls.resume[0]?.ownerCtx.fiber).toBe(callerFiber)
+  })
+
+  it('rejects a second factory and clears the slot with its owner (HMR)', async () => {
+    const ctx = new Context()
+    await ctx.plugin(AgentRegistry)
+    const owner = await ctx.plugin(Object.assign((inner: Context) => {
+      inner.agents.setFactory(stubFactory().factory)
+      expect(() => inner.agents.setFactory(stubFactory().factory)).toThrow(/already registered/)
+    }, { inject: ['agents'] }))
+    await expect(ctx.agents.create({ agentId: AgentId('before'), sessionId: SessionId('before-s') })).resolves.toBeDefined()
+    await owner.dispose()
+    await expect(ctx.agents.create({ agentId: AgentId('after'), sessionId: SessionId('after-s') })).rejects.toThrow(/no agent factory/)
+  })
+
+  it('canonicalizes an already traced Service before tracing it for the caller', async () => {
+    const ctx = new Context()
+    await ctx.plugin(AgentRegistry)
+    const states = new WeakMap<object, string[]>()
+    class TracedFactory extends Service implements AgentFactory {
+      constructor(inner: Context) {
+        super(inner, 'tracedFactory')
+        states.set(this, [])
+      }
+      private calls(): string[] {
+        const original = (this as unknown as { [symbols.original]?: TracedFactory })[symbols.original] ?? this
+        const calls = states.get(original)
+        if (calls === undefined) throw new Error('factory receiver was not canonicalized')
+        return calls
+      }
+      async createAgent(_ownerCtx: Context, options: CreateAgentOptions) {
+        this.calls().push('create')
+        return { agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }
+      }
+      async resume(_ownerCtx: Context, options: ResumeAgentOptions) {
+        this.calls().push('resume')
+        return { agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }
+      }
+    }
+    await ctx.plugin(TracedFactory)
+    const traced = (ctx as Context & { tracedFactory: TracedFactory }).tracedFactory
+    ctx.agents.setFactory(traced)
+    await ctx.agents.create({ agentId: AgentId('create'), sessionId: SessionId('create-s') })
+    await ctx.agents.resume({ agentId: AgentId('resume'), resumeSessionId: SessionId('resume-s') })
+    const raw = (traced as unknown as { [symbols.original]?: TracedFactory })[symbols.original]
+    expect(states.get(raw!)).toEqual(['create', 'resume'])
   })
 })
diff --git a/packages/core/scope/README.md b/packages/core/scope/README.md
index f76254a406..a1ee0dcf0b 100644
--- a/packages/core/scope/README.md
+++ b/packages/core/scope/README.md
@@ -4,25 +4,23 @@ Scoped-context registration primitive. `createScope(ctx, key)` mints a Cordis co
 
 ## Public API
 
-- `createScope(ctx: Context, key: ScopeKey): Scope` Mint a scope under `ctx`'s fiber. Usable synchronously (effect collection is uid-gated; service resolution falls through to the minting plugin's dependency surface). Throws on a primitive key, or when `ctx`'s fiber is disposing (`INACTIVE_EFFECT`).
+- `createScope(ctx: Context, key: ScopeKey): Scope` Mint a scope under `ctx`'s fiber. Usable synchronously (effect collection is uid-gated; service resolution falls through to the minting plugin's dependency surface). The typed, same-process key is trusted; an inactive minting context still fails through Cordis (`INACTIVE_EFFECT`).
 - `Scope.ctx` The tagged context: registrations through it are scope-visible AND scope-lifetime. Derived contexts (an `extend`, a fiber mounted under it) inherit the tag; nested scopes shadow (nearest tag wins).
 - `Scope.rawDispose` The EXACT Cordis disposer for the backing fiber — a composite (generator) effect yields THIS function to nest the scope's teardown at that yield position (Cordis dedupes nested effects by function identity; yielding a wrapper leaves the scope disposing as a concurrent sibling).
 - `Scope.dispose(): Promise<void>` Idempotent, shared quiescence boundary for every registration made through the scope. Racing/repeat calls await the same teardown, including when `rawDispose` invoked the underlying single-shot Cordis disposer first.
 - `scopeOf(ctx: Context): ScopeKey | undefined` The tag a context (or any context derived from it) carries; `undefined` = context-global.
-- `scopeTarget(base: T, key?: ScopeKey): Scoped<T>` Build the dispatch `thisArg` for a scope-filtered event: composes `base`'s own `Context.filter` with the scope predicate (untagged listener ⇒ admitted; tagged ⇒ admitted iff tag === key; `key === undefined` ⇒ untagged only). Listener `this` stays `base`-shaped. `{ global: true }` listeners bypass filtering (Cordis semantics).
-- `Scoped<T>` The compile-time carrier brand: scope-filtered events demand it as their `this` type, so dispatching with a bare subject is a compile error.
+- `scopeTarget(base: T, key: ScopeKey | undefined): Scoped<T>` Build the opaque dispatch `thisArg` for a scope-filtered event. It composes `base`'s existing `Context.filter` with the scope predicate (untagged listener ⇒ admitted; tagged ⇒ admitted iff tag === key; `key === undefined` ⇒ untagged only). The carrier contains routing state only; the real subject is carried by the event arguments. `{ global: true }` listeners bypass filtering (Cordis semantics).
+- `Scoped<T>` The compile-time opaque carrier brand: scope-filtered events demand it as their `this` type, so dispatching with a bare subject is a compile error. The type parameter records the subject type but does not expose its properties.
 - `isScopeCarrier(value)` / `carrierKeyOf(value)` Runtime carrier marks, used by the dev invariants to assert every scope-filtered dispatch carries a carrier keyed to the subject its arguments name.
-- `scopeHost(ctx, services)` Test/tooling host whose shared `dispose()` waits for both the host fiber and every minted scope, including a child already tearing down through `rawDispose`.
 
 ## Design contract
 
-Ownership and visibility derive from ONE fact — which context a registration went through. An explicit `{ scope }` registration parameter could express "visible to X, disposed with Y", which is almost always a bug; the scoped context makes it unrepresentable. Rationale and alternatives: [the agent-scope RFC](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md).
+Ownership and visibility derive from ONE fact — which context a registration went through. An explicit `{ scope }` registration parameter could express "visible to X, disposed with Y", which is almost always a bug; the scoped context makes it unrepresentable. This is trusted registration and listener routing, not sandboxing or an authority hierarchy: a same-process plugin is not confined, and a child scope need not be a subset of its parent's view. Rationale, alternatives, and the security non-goal: [the agent-scope RFC](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals).
 
-Handing out a scoped context hands out the minting plugin's service-resolution capability (resolution walks the minting fiber's dependency chain, not the holder's) — mint scopes from a plugin whose `inject` surface is what scope holders should reach.
+Handing out a scoped context hands out the minting plugin's service-resolution surface (resolution walks the minting fiber's dependency chain, not the holder's) — mint it from the plugin whose dependencies the scoped registrations need to resolve.
 
 ## Known Limitations and Deferred Work
 
 - **Only scope-aware surfaces isolate state** — registries must file by `scopeOf()` and events must dispatch through `scopeTarget()`; an arbitrary Cordis service remains context-global merely because it is called through a scoped context.
 - **A context carries one nearest scope key** — nested scopes shadow their parent's tag rather than forming hierarchical or multi-membership policy sets.
-- **Dispatch carriers preserve behavior, not identity** — listener `this` can call the subject's methods, but `this !== subject` and a method read returns a newly bound function.
 - **Service reachability comes from the scope minter** — handing out `Scope.ctx` also hands out the minting plugin's injected service surface, so a broader minter cannot later be narrowed by the holder.
diff --git a/packages/core/scope/src/index.ts b/packages/core/scope/src/index.ts
index 7a7032b0b6..e229243504 100644
--- a/packages/core/scope/src/index.ts
+++ b/packages/core/scope/src/index.ts
@@ -1,23 +1,6 @@
 /**
- * Scoped-context primitive: mint a Cordis context that TAGS everything
- * registered through it with an opaque {@link ScopeKey}, and dispatch events so
- * listeners registered through such a context fire only for their key's
- * subject. Scope-aware registries (`ctx.tools`, `ctx.systemPrompt`) read the
- * tag via {@link scopeOf} to file a registration in the right layer; the agent
- * loop is the one scope MINTER today (one scope per live agent, key = the
- * `Agent` object — see `Agent.ctx` in `@deepseek-ai/dsh-agent`), but the
- * mechanism is key-agnostic by design so packages below the agent layer
- * (`dsh-session`, `dsh-system-prompt`) can depend on it without a dependency
- * cycle.
- *
- * Ownership and visibility derive from ONE fact — which context a registration
- * went through: the scope's fiber owns the disposal (a `ctx.effect()`/
- * `ctx.on()`/registry call through the scoped context unwinds on
- * {@link Scope.dispose}, because Cordis routes a service method's `this.ctx`
- * to the ACCESSING context), and the tag decides who sees it. Splitting those
- * two — an explicit `{ scope }` registration parameter — would let a caller
- * express "visible to X, disposed with Y", which is almost always a bug; the
- * scoped context makes it unrepresentable.
+ * Scoped-context primitive: mint a Cordis context that tags registrations with
+ * an opaque identity and build routing-only event carriers for that identity.
  *
  * @module @deepseek-ai/dsh-scope
  */
@@ -25,354 +8,109 @@
 import type { Context, Fiber } from 'cordis'
 import { Context as CordisContext } from 'cordis'
 
-/**
- * The identity a scope is keyed by. Opaque and compared by object identity —
- * never inspected. The harness convention: a live `Agent` is the key of its
- * own scope, so seam vocabularies that already carry the agent
- * (`ToolExecution.agent`, `AssembleContext.scope`) name the layer directly.
- */
+/** An opaque, identity-compared scope key. */
 export type ScopeKey = object
 
-/** The context tag {@link createScope} writes and {@link scopeOf} reads (module-private). */
+/** Context tag written by {@link createScope}. */
 const kScope = Symbol('dsh.scope')
 
-/** The carrier mark {@link scopeTarget} writes and {@link carrierKeyOf} reads (module-private). */
-const kCarrier = Symbol('dsh.scope.carrier')
-
 declare const ScopedBrand: unique symbol
 
 /**
- * A dispatch carrier built by {@link scopeTarget}: structurally the `base` it
- * overlays, branded so scope-filtered events can DEMAND a carrier as their
- * `this` type — passing a bare subject where a `Scoped<T>` is required is a
- * compile error, which is what makes "forgot the carrier" unrepresentable at
- * dispatch sites. The brand is compile-time only; {@link isScopeCarrier} is
- * the runtime counterpart (used by the dev invariants).
+ * A routing-only event receiver built by {@link scopeTarget}. The type
+ * parameter records the subject type for dispatch checking; the carrier does
+ * not expose the subject's properties. Event payloads carry the real subject.
  */
-export type Scoped<T> = T & { readonly [ScopedBrand]: 'dsh.scope.carrier' }
+export type Scoped<T extends object> = object & { readonly [ScopedBrand]: T }
 
-/**
- * A minted scope: the tagged context to register through, plus the disposers
- * that unwind every registration made through it.
- */
+/** The key associated with each carrier. Presence distinguishes an unkeyed carrier from a non-carrier. */
+const carrierKeys = new WeakMap<object, ScopeKey | undefined>()
+
+/** A minted registration scope and its quiescent disposal boundaries. */
 export interface Scope {
-  /**
-   * The scoped context. Registrations through it are tagged with the scope's
-   * key (scope-aware registries file them in that key's layer; `ctx.on`
-   * listeners fire only for dispatches targeted at that key) and owned by the
-   * scope's fiber (disposed together on {@link dispose}). Contexts DERIVED
-   * from it — an `extend`, a fiber mounted under it — inherit the tag through
-   * the prototype chain.
-   */
+  /** Context through which scope-owned registrations are made. */
   ctx: Context
-  /**
-   * The EXACT disposer Cordis registered on the minting fiber for the scope's
-   * backing fiber. A composite (generator) effect that owns the scope's
-   * position in an ordered teardown must yield THIS function: Cordis dedupes a
-   * nested effect out of the parent's concurrent disposal list by function
-   * identity, so yielding a wrapper would leave the scope disposing as an
-   * unordered sibling. Callers outside a composite effect use {@link dispose}.
-   * @returns the backing fiber's teardown promise (undefined on a repeat call
-   *   — Cordis effect disposers are single-shot).
-   */
+  /** Exact Cordis disposer, used when nesting this scope in an ordered composite effect. */
   rawDispose: () => Promise<void> | void
-  /**
-   * Unwind the scope: dispose the backing fiber, running every collected
-   * registration disposer. Idempotent and always awaitable: repeat and racing
-   * calls share one completion even though the underlying Cordis disposer is
-   * single-shot and returns undefined after its first invocation.
-   * After disposal the scoped context is inert — a further registration
-   * through it throws Cordis's INACTIVE_EFFECT.
-   * @returns for the call that initiates teardown: resolves when every
-   *   registration's disposer has settled. Every repeat/racing call awaits
-   *   that same quiescence boundary, including when {@link rawDispose} claimed
-   *   the underlying single-shot Cordis disposer first.
-   */
+  /** Dispose every scope-owned registration; racing calls await the same completion. */
   dispose(): Promise<void>
 }
 
-/**
- * Dispose a Cordis fiber and await its lifecycle inertia even when some other
- * caller claimed the single-shot raw disposer first. `Fiber.dispose()` returns
- * `undefined` on a repeat call, but the fiber's `inertia` remains the
- * authoritative promise while its async unload is running.
- */
+/** Follow a Cordis fiber through asynchronous teardown even if its raw disposer was already claimed. */
 async function quiesceFiber(fiber: Fiber): Promise<void> {
   await Promise.resolve(fiber.dispose())
   while (fiber.inertia !== undefined) await fiber.inertia
 }
 
-/**
- * The shared no-op plugin every scope fiber mounts: named so diagnostics read
- * `scope` and shared so all scopes join ONE plugin runtime (Cordis deletes the
- * runtime record when its last fiber disposes, so idle deployments carry no
- * residue).
- */
+/** Shared no-op plugin used as the backing scope fiber. */
 function scope(): void {}
 
 /**
- * Mint a registration scope for `key` under `ctx`.
- *
- * Mounts a runtime fiber (`ctx.plugin`) and tags a child of its context with
- * `key`. The fiber is usable synchronously — Cordis activates it on a
- * microtask, but effect collection is uid-gated (not state-gated) and service
- * resolution falls through the pending fiber to the MINTING plugin's
- * dependency surface, so a caller may register through {@link Scope.ctx} the
- * moment this returns.
- *
- * Service resolution through the scoped context flows through the minting
- * plugin's dependency chain (the fiber walk), regardless of what the eventual
- * holder's own fiber injected — handing out the scoped context hands out that
- * capability; see `Agent.ctx` in `@deepseek-ai/dsh-agent` for the harness's
- * contract.
- * @param ctx - the context to mount the scope under; its fiber must be active
- *   (a disposing owner throws Cordis's INACTIVE_EFFECT), and its plugin's
- *   `inject` surface is what the scoped context resolves services against.
- * @param key - the scope's identity ({@link ScopeKey}); must be an object
- *   (identity-compared), else this throws.
- * @returns the tagged context plus its disposers ({@link Scope}).
+ * Mint a scope under `ctx`. The scoped context inherits the minting plugin's
+ * dependency surface and owns every registration made through it.
+ * @param ctx - active context whose dependency surface the scope inherits.
+ * @param key - opaque identity used for listener routing.
+ * @returns the scoped context and exact/shared disposal boundaries.
  */
 export function createScope(ctx: Context, key: ScopeKey): Scope {
-  // Runtime guard behind the ScopeKey type: callers outside the typechecker
-  // (yml-configured plugins, JS consumers) can still pass a primitive.
-  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
-  if ((typeof key !== 'object' && typeof key !== 'function') || key === null) {
-    throw new TypeError('createScope: key must be a non-null object or function (scope keys are identity-compared)')
-  }
   const fiber = ctx.plugin(scope)
   const scoped: Context = fiber.ctx.extend({ [kScope]: key })
   let disposing: Promise<void> | undefined
   return {
     ctx: scoped,
-    // fiber.dispose IS the disposer Cordis pushed onto the minting fiber's
-    // disposable list — the identity a composite effect must yield (see
-    // Scope.rawDispose).
     rawDispose: fiber.dispose,
-    // Memoize the public boundary and explicitly follow fiber inertia: the raw
-    // disposer must remain the exact Cordis function for ordered composition,
-    // so it cannot itself be wrapped to record a raw-first invocation.
     dispose: () => (disposing ??= quiesceFiber(fiber)),
   }
 }
 
 /**
- * Read the scope key a context is tagged with, or `undefined` for an untagged
- * (context-global) context. Walks the prototype chain, so any context DERIVED
- * from a scoped context — service shadows, `extend`s, fibers mounted under it
- * — reads as that scope; with nested scopes the nearest tag wins.
- * @param ctx - the context to inspect (typically a registry method's
- *   `this.ctx`, i.e. the ACCESSING context).
- * @returns the key given to {@link createScope}, or `undefined` when the
- *   context is not derived from any scope.
+ * Read the nearest scope tag inherited by a context.
+ * @param ctx - context to inspect.
+ * @returns its scope key, or `undefined` for an unscoped context.
  */
 export function scopeOf(ctx: Context): ScopeKey | undefined {
-  // A plain (possibly proxied) property read: symbols bypass the Cordis
-  // context proxy's service resolution, and Reflect walks the prototype chain.
   return (ctx as Context & { [kScope]?: ScopeKey })[kScope]
 }
 
 /**
- * Build the dispatch carrier for a scope-filtered event: `base` overlaid with
- * a `Context.filter` that admits a listener iff
+ * Build the routing receiver for a scope-filtered event. Untagged listeners
+ * remain global; tagged listeners run only when their key matches. A base
+ * Cordis filter is composed before the scope predicate.
  *
- * - its registering context is UNTAGGED (a context-global listener — the
- *   compatibility default: plain plugin listeners see every subject), or
- * - its tag IS `key` (a scoped listener seeing exactly its own subject),
- *
- * AND `base`'s own filter (a Cordis `Service`'s isolation check) also admits
- * it. Dispatching with `key === undefined` — a subject-less dispatch, e.g. a
- * tool call with no calling agent or a bare (agent-less) session's events —
- * admits only untagged listeners: a scoped listener never fires for someone
- * else's (or nobody's) subject. Listeners registered `{ global: true }`
- * bypass all filtering (Cordis semantics).
- *
- * Use it as the `thisArg` of the dispatch:
- * `ctx.waterfall(scopeTarget(this, exec.agent), 'tools/pre-execute', …)`. The
- * carrier is a TRANSPARENT proxy over `base`: reads delegate with `base` as
- * the receiver and retrieved methods are bound to `base`, so a listener may
- * call subject methods through its `this` (`this.send(…)` on a
- * `Scoped<Agent>`) even when the subject uses native `#private` fields — a
- * bare proxy receiver would throw on those. Identity is still not
- * transparent: `this !== subject` and method identity varies per read; the
- * subject always travels in the event's arguments. The returned carrier is
- * branded {@link Scoped} and runtime-marked ({@link isScopeCarrier} /
- * {@link carrierKeyOf}) so both the type system and the dev invariants can
- * tell a carrier from a bare subject.
- * @param base - the object the event is dispatched on behalf of (the owning
- *   service, or the subject agent itself); its own `Context.filter` is
- *   preserved and composed.
- * @param key - the subject's scope key, or `undefined` for a subject-less
- *   dispatch.
- * @returns the carrier to pass as the dispatch `thisArg`.
+ * The receiver is deliberately opaque: listener code obtains the real subject
+ * from event arguments, never from `this`.
+ * @param base - subject or service whose existing Cordis filter is preserved.
+ * @param key - routed scope identity, or `undefined` for an unscoped subject.
+ * @returns an opaque dispatch carrier.
  */
 export function scopeTarget<T extends object>(base: T, key: ScopeKey | undefined): Scoped<T> {
   const baseFilter = (base as { [CordisContext.filter]?: (ctx: Context) => boolean })[CordisContext.filter]
-  const filter = (ctx: Context): boolean => {
-    if (baseFilter && !baseFilter.call(base, ctx)) return false
-    const tag = scopeOf(ctx)
-    return tag === undefined || tag === key
-  }
-  const overlay: Record<string | symbol, unknown> = {
-    [CordisContext.filter]: filter,
-    [kCarrier]: { key },
-  }
-  // A hand-rolled proxy, NOT cordis withProps: withProps delegates gets with
-  // the PROXY as receiver, so a getter on `base` runs with proxy `this` and a
-  // method call through the carrier gets a proxy receiver — either one throws
-  // on a native `#private` field of the subject (TypeError: private member
-  // not declared). Cordis hands the carrier to listeners as `this`, and the
-  // event declarations type it `Scoped<Agent>` — so subject method calls
-  // through it are a SUPPORTED shape and must reach the real object: gets
-  // delegate with `base` as receiver, functions come back bound to `base`,
-  // and sets land on `base` directly.
-  return new Proxy(base, {
-    get(target, prop) {
-      // Proxy get invariants pin what this trap may report for a
-      // non-configurable OWN property of the base: a non-writable data prop
-      // must be reported AS-IS (neither overlaid nor bound), a getterless
-      // accessor as undefined — checked FIRST so even an overlay key
-      // colliding with a frozen own prop of a (pathological) base yields the
-      // base's value instead of an engine TypeError. Such a base forgoes
-      // scope filtering; no production base freezes these keys.
-      const own = Reflect.getOwnPropertyDescriptor(target, prop)
-      const pinned = own !== undefined && own.configurable === false
-        && own.get === undefined && own.writable !== true
-      // hasOwn, not `in`: the overlay literal inherits Object.prototype, so
-      // `in` would claim `toString`/`constructor` and shadow the subject's.
-      if (!pinned && Object.hasOwn(overlay, prop)) return overlay[prop]
-      const value: unknown = Reflect.get(target, prop, target)
-      if (typeof value !== 'function' || pinned) return value
-      // `constructor` is looked up, never invoked as a subject method — keep
-      // the real one (withProps special-cases it the same way), so
-      // `carrier.constructor` still identifies the subject's class.
-      if (prop === 'constructor') return value
-      // `Function.prototype.bind` types as `any`; the value is structurally
-      // T[prop] and the trap's contract is untyped (`any`), so unknown is the
-      // honest safe return.
-      return value.bind(target) as unknown
+  const carrier = {
+    [CordisContext.filter](ctx: Context): boolean {
+      if (baseFilter !== undefined && !baseFilter.call(base, ctx)) return false
+      const tag = scopeOf(ctx)
+      return tag === undefined || tag === key
     },
-    set(target, prop, value) {
-      return Reflect.set(target, prop, value, target)
-    },
-  }) as Scoped<T>
+  }
+  carrierKeys.set(carrier, key)
+  return carrier as unknown as Scoped<T>
 }
 
 /**
- * Whether `value` is a carrier built by {@link scopeTarget} — the runtime
- * counterpart of the {@link Scoped} brand, used by the dev invariants to
- * assert that a scope-filtered event was dispatched with a carrier and not a
- * bare subject.
- * @param value - the dispatch `thisArg` to test.
- * @returns true iff `value` came from {@link scopeTarget}.
+ * Test whether a value is a scope carrier.
+ * @param value - dispatch receiver to inspect.
+ * @returns whether {@link scopeTarget} created it.
  */
 export function isScopeCarrier(value: unknown): value is Scoped<object> {
-  if (typeof value !== 'object' || value === null) return false
-  // A property READ, not an `in` check: the carrier overlays its marks in the
-  // get trap only (no `has` trap), so `kCarrier in carrier` would fall
-  // through to the wrapped base and always answer false.
-  return (value as { [kCarrier]?: { key: ScopeKey | undefined } })[kCarrier] !== undefined
+  return typeof value === 'object' && value !== null && carrierKeys.has(value)
 }
 
 /**
- * The scope key a carrier was built for — `undefined` for a subject-less
- * carrier, and also `undefined` for a non-carrier (pair with
- * {@link isScopeCarrier} when the distinction matters). The dev invariants
- * use it to assert the carrier's key IS the subject the event's arguments
- * name.
- * @param value - the dispatch `thisArg` to read.
- * @returns the `key` given to {@link scopeTarget}, or `undefined`.
+ * Read a carrier's routing key.
+ * @param value - dispatch receiver to inspect.
+ * @returns the carrier key, or `undefined` for an unkeyed/non-carrier value.
  */
 export function carrierKeyOf(value: unknown): ScopeKey | undefined {
   if (!isScopeCarrier(value)) return undefined
-  // Optional-prop cast: the guard proves the mark is present at runtime, but
-  // the Scoped<> brand carries no structural kCarrier member to narrow from.
-  return (value as { [kCarrier]?: { key: ScopeKey | undefined } })[kCarrier]?.key
-}
-
-/**
- * A test/tooling host for minting scopes: one mounted plugin whose `inject`
- * list is the service surface every scope minted through it can reach.
- */
-export interface ScopeHost {
-  /**
-   * Mint a scope under the host (see {@link createScope}); the scoped context
-   * resolves exactly the host's injected services.
-   * @param key - the scope's identity ({@link ScopeKey}).
-   * @returns the minted scope.
-   */
-  mint(key: ScopeKey): Scope
-  /**
-   * Dispose the host fiber and with it every scope minted through it.
-   * Every racing/repeat caller observes the same completion, including when a
-   * child's raw disposer started before host disposal.
-   * @returns resolves when the host and every minted scope have reached
-   *   quiescence.
-   */
-  dispose(): Promise<void>
-}
-
-/**
- * Mount a scope-minting host plugin that injects `services`, THE sanctioned
- * way to mint scopes in tests (production scopes are minted by the agent
- * loop). Exists because the naive spelling fails confusingly twice over:
- * a plugin with no `inject` mints scopes whose service reads throw Cordis's
- * cryptic `cannot get property … without inject`, and a plugin whose inject
- * can never be satisfied RESOLVES its fiber await without ever running the
- * callback — a silent no-op host. This helper fails LOUD instead: when the
- * callback did not run, it names the absent services and disposes the host.
- * @param ctx - the context to mount the host under.
- * @param services - the service names scopes minted through this host reach
- *   (the host plugin's `inject` list).
- * @returns the host (mint scopes, dispose them all at once).
- * @throws when any of `services` is not available on `ctx` — named, not the
- *   Cordis dead end.
- */
-export async function scopeHost(ctx: Context, services: string[]): Promise<ScopeHost> {
-  let hostCtx: Context | undefined
-  // A named function statement (not Object.assign({name}) — Function.name is
-  // read-only) so diagnostics read `scopeHost`.
-  function scopeHostPlugin(inner: Context): void { hostCtx = inner }
-  const fiber = ctx.plugin(Object.assign(scopeHostPlugin, { inject: services }))
-  await fiber
-  if (hostCtx === undefined) {
-    // Dependency-pending: cordis resolves the await without running the
-    // callback. Name the absentees and unwind the pending fiber.
-    const missing = services.filter(name => ctx.get(name) === undefined)
-    await fiber.dispose()
-    /* v8 ignore next -- the '(unknown)' fallback is defensive: a pending
-     * fiber with zero absent services cannot occur (an all-present inject
-     * list runs the callback) */
-    const named = missing.map(name => `"${name}"`).join(', ') || '(unknown)'
-    throw new Error(`scopeHost: service${missing.length === 1 ? '' : 's'} ${named} not available on this context — load the providing plugin(s) before minting scopes`)
-  }
-  const host = hostCtx
-  const scopes = new Set<Scope>()
-  let disposing: Promise<void> | undefined
-  const dispose = async (): Promise<void> => {
-    // Start every boundary before awaiting any one of them. A child whose raw
-    // disposer already ran is still followed through Scope.dispose(); a child
-    // the host unload claims first is followed through the same fiber inertia.
-    const tasks = [quiesceFiber(fiber), ...[...scopes].map(scope => scope.dispose())]
-    const results = await Promise.allSettled(tasks)
-    scopes.clear()
-    const errors = results.flatMap(result => result.status === 'rejected' ? [result.reason as unknown] : [])
-    if (errors.length === 1) throw errors[0]
-    if (errors.length > 1) throw new AggregateError(errors, 'scopeHost: disposal failed')
-  }
-  return {
-    mint: (key: ScopeKey) => {
-      const minted = createScope(host, key)
-      let disposing: Promise<void> | undefined
-      const tracked: Scope = {
-        ctx: minted.ctx,
-        // Preserve the exact Cordis identity: only the public shared boundary
-        // is wrapped to retire this child from the host's tracking set.
-        rawDispose: minted.rawDispose,
-        dispose: () => (disposing ??= minted.dispose().finally(() => { scopes.delete(tracked) })),
-      }
-      scopes.add(tracked)
-      return tracked
-    },
-    dispose: () => (disposing ??= dispose()),
-  }
+  return carrierKeys.get(value)
 }
diff --git a/packages/core/scope/tests/scope.spec.ts b/packages/core/scope/tests/scope.spec.ts
index 44b9cf4442..0b7bbef348 100644
--- a/packages/core/scope/tests/scope.spec.ts
+++ b/packages/core/scope/tests/scope.spec.ts
@@ -1,374 +1,155 @@
 import { describe, expect, expectTypeOf, it } from 'vitest'
 import { Context } from 'cordis'
-import { carrierKeyOf, createScope, isScopeCarrier, scopeHost, scopeOf, scopeTarget } from '@deepseek-ai/dsh-scope'
-import type { Scope, ScopeKey, Scoped } from '@deepseek-ai/dsh-scope'
+import { carrierKeyOf, createScope, isScopeCarrier, scopeOf, scopeTarget } from '@deepseek-ai/dsh-scope'
+import type { Scope, Scoped } from '@deepseek-ai/dsh-scope'
 
 declare module 'cordis' {
   interface Events {
     /**
-     * Test-only event for exercising scope-filtered dispatch.
+     * Test-only event for scope-filtered dispatch.
      * @param value - opaque payload recorded by listeners.
      * @mode emit
      */
     'scope-test/ping'(value: string): void
-    /**
-     * Test-only waterfall for exercising carrier `this` shape.
-     * @param value - seed value listeners may wrap.
-     * @mode waterfall
-     */
-    'scope-test/echo'(value: string, next: () => string): string
   }
 }
 
-/** Mount a host plugin and mint a scope inside it, returning both. */
+/** Mount a host plugin and mint a scope inside it. */
 async function mintScope(ctx: Context, key: object): Promise<Scope> {
   let scope!: Scope
-  await ctx.plugin((inner: Context) => {
-    scope = createScope(inner, key)
-  })
+  await ctx.plugin((inner: Context) => { scope = createScope(inner, key) })
   return scope
 }
 
 describe('createScope', () => {
-  it('rejects primitive keys but accepts callable objects (matching ScopeKey)', async () => {
+  it('tags contexts and derived contexts, with the nearest tag winning', async () => {
     const ctx = new Context()
-    // Typed through `unknown` so the ScopeKey type cannot argue the assertion
-    // away: this test exercises exactly the callers the typechecker misses.
-    const badKeys: unknown[] = ['k', null]
-    for (const bad of badKeys) {
-      expect(() => createScope(ctx, bad as ScopeKey)).toThrow(/must be a non-null object or function/)
-    }
+    const outerKey = { name: 'outer' }
+    const innerKey = { name: 'inner' }
+    const outer = await mintScope(ctx, outerKey)
+    const inner = createScope(outer.ctx, innerKey)
 
-    const callable = Object.assign(() => {}, { nameForTest: 'callable-key' })
-    const scope = await mintScope(ctx, callable)
-    expect(scopeOf(scope.ctx)).toBe(callable)
-    await scope.dispose()
-  })
-
-  it('tags the scoped context, readable through derivations (nearest tag wins)', async () => {
-    const ctx = new Context()
-    const key = { name: 'a' }
-    const inner = { name: 'a.inner' }
-    const scope = await mintScope(ctx, key)
-
-    expect(scopeOf(scope.ctx)).toBe(key)
-    // An extend of the scoped context inherits the tag through the prototype chain.
-    expect(scopeOf(scope.ctx.extend({}))).toBe(key)
-    // A plain context carries no tag.
     expect(scopeOf(ctx)).toBeUndefined()
-    // A fiber mounted UNDER the scoped context reads as that scope…
-    let mountedCtx!: Context
-    await scope.ctx.plugin((c: Context) => { mountedCtx = c })
-    expect(scopeOf(mountedCtx)).toBe(key)
-    // …and a nested scope shadows the outer tag (nearest wins).
-    const nested = createScope(scope.ctx, inner)
-    expect(scopeOf(nested.ctx)).toBe(inner)
+    expect(scopeOf(outer.ctx)).toBe(outerKey)
+    expect(scopeOf(outer.ctx.extend({}))).toBe(outerKey)
+    expect(scopeOf(inner.ctx)).toBe(innerKey)
+
+    await inner.dispose()
+    await outer.dispose()
   })
 
-  it('is usable synchronously: registrations land before the fiber activates', async () => {
+  it('is usable synchronously before the backing fiber activates', async () => {
     const ctx = new Context()
     const events: string[] = []
+    let scope!: Scope
     await ctx.plugin((inner: Context) => {
-      const scope = createScope(inner, { name: 'sync' })
-      // Same tick as createScope — no await between mint and use.
-      scope.ctx.effect(() => () => void events.push('effect-disposed'))
-      scope.ctx.on('scope-test/ping', value => void events.push(`heard:${value}`))
+      scope = createScope(inner, { name: 'sync' })
+      scope.ctx.effect(() => () => void events.push('disposed'))
       events.push('registered')
     })
-    ctx.emit(scopeTarget(ctx, undefined), 'scope-test/ping', 'nobody')
     expect(events).toEqual(['registered'])
-  })
-
-  it('dispose() unwinds registrations, is idempotent, and inerts the context', async () => {
-    const ctx = new Context()
-    const scope = await mintScope(ctx, { name: 'd' })
-    const order: string[] = []
-    scope.ctx.effect(() => () => void order.push('a'))
-    scope.ctx.effect(() => () => void order.push('b'))
-
     await scope.dispose()
-    expect(order).toEqual(['b', 'a']) // LIFO within the scope fiber
-
-    // Repeat dispose: the underlying cordis disposer returns undefined; the
-    // wrapper still resolves.
-    await expect(scope.dispose()).resolves.toBeUndefined()
-    // Registration through a disposed scope throws INACTIVE_EFFECT.
-    expect(() => scope.ctx.effect(() => () => {})).toThrow(/inactive context/)
+    expect(events).toEqual(['registered', 'disposed'])
   })
 
-  it('dispose() follows a rawDispose-first race through async quiescence', async () => {
+  it('shares quiescence across repeat and raw-disposer-first calls', async () => {
     const ctx = new Context()
-    const scope = await mintScope(ctx, { name: 'raw-first' })
+    const scope = await mintScope(ctx, { name: 'quiescence' })
     const gate = Promise.withResolvers<undefined>()
-    let cleanupFinished = false
+    let finished = false
     scope.ctx.effect(() => async () => {
       await gate.promise
-      cleanupFinished = true
+      finished = true
     })
 
     const raw = Promise.resolve(scope.rawDispose())
-    let publicSettled = false
-    const publicDispose = scope.dispose().then(() => { publicSettled = true })
+    const publicDispose = scope.dispose()
     await Promise.resolve()
-    expect(publicSettled).toBe(false)
-    expect(cleanupFinished).toBe(false)
-
+    expect(finished).toBe(false)
     gate.resolve(undefined)
-    await Promise.all([raw, publicDispose])
-    expect(cleanupFinished).toBe(true)
-    await expect(scope.dispose()).resolves.toBeUndefined()
+    await Promise.all([raw, publicDispose, scope.dispose()])
+    expect(finished).toBe(true)
   })
 
-  it('rawDispose is the exact cordis disposer: yielding it nests the scope at its position', async () => {
+  it('exposes the exact raw disposer for ordered composite teardown', async () => {
     const ctx = new Context()
     const order: string[] = []
-    let composite!: () => Promise<void> | void
+    let dispose!: () => Promise<void> | void
     await ctx.plugin((inner: Context) => {
-      composite = inner.effect(function* () {
-        yield () => void order.push('outermost') // disposed LAST
+      dispose = inner.effect(function* () {
+        yield () => void order.push('outer')
         const scope = createScope(inner, { name: 'nested' })
-        scope.ctx.effect(() => () => void order.push('scope-registration'))
-        yield scope.rawDispose // disposed SECOND — nested by identity
-        yield () => void order.push('innermost') // disposed FIRST
+        scope.ctx.effect(() => () => void order.push('scope'))
+        yield scope.rawDispose
+        yield () => void order.push('inner')
       })
     })
-    await composite()
-    // The scope disposed exactly at its yield position (between the two
-    // neighbours), not as a concurrent sibling of the composite.
-    expect(order).toEqual(['innermost', 'scope-registration', 'outermost'])
+    await dispose()
+    expect(order).toEqual(['inner', 'scope', 'outer'])
   })
 })
 
-describe('scopeTarget dispatch filtering', () => {
-  it('scoped listeners hear only their key; untagged listeners hear everything', async () => {
+describe('scopeTarget', () => {
+  it('routes scoped listeners by key while untagged listeners remain global', async () => {
     const ctx = new Context()
     const keyA = { name: 'A' }
     const keyB = { name: 'B' }
     const scopeA = await mintScope(ctx, keyA)
     const scopeB = await mintScope(ctx, keyB)
-
     const heard: string[] = []
     ctx.on('scope-test/ping', value => void heard.push(`global:${value}`))
     scopeA.ctx.on('scope-test/ping', value => void heard.push(`A:${value}`))
     scopeB.ctx.on('scope-test/ping', value => void heard.push(`B:${value}`))
 
-    ctx.emit(scopeTarget(ctx, keyA), 'scope-test/ping', 'to-A')
-    ctx.emit(scopeTarget(ctx, keyB), 'scope-test/ping', 'to-B')
-    ctx.emit(scopeTarget(ctx, undefined), 'scope-test/ping', 'to-nobody')
+    ctx.emit(scopeTarget(ctx, keyA), 'scope-test/ping', 'a')
+    ctx.emit(scopeTarget(ctx, keyB), 'scope-test/ping', 'b')
+    ctx.emit(scopeTarget(ctx, undefined), 'scope-test/ping', 'none')
 
-    expect(heard).toEqual([
-      'global:to-A', 'A:to-A',
-      'global:to-B', 'B:to-B',
-      'global:to-nobody',
-    ])
+    expect(heard).toEqual(['global:a', 'A:a', 'global:b', 'B:b', 'global:none'])
+    await Promise.all([scopeA.dispose(), scopeB.dispose()])
   })
 
-  it('{ global: true } listeners bypass scope filtering entirely', async () => {
+  it('preserves a base Cordis filter and its receiver', async () => {
     const ctx = new Context()
-    const keyA = { name: 'A' }
-    const scopeA = await mintScope(ctx, keyA)
-    const heard: string[] = []
-    scopeA.ctx.on('scope-test/ping', value => void heard.push(`escape:${value}`), { global: true })
-
-    ctx.emit(scopeTarget(ctx, { name: 'other' }), 'scope-test/ping', 'foreign')
-    ctx.emit(scopeTarget(ctx, undefined), 'scope-test/ping', 'nobody')
-    expect(heard).toEqual(['escape:foreign', 'escape:nobody'])
-  })
-
-  it("composes the base's own Context.filter (a rejecting base filter wins)", async () => {
-    const ctx = new Context()
-    const keyA = { name: 'A' }
-    const scopeA = await mintScope(ctx, keyA)
+    const key = { name: 'A' }
+    const scope = await mintScope(ctx, key)
     const heard: string[] = []
     ctx.on('scope-test/ping', value => void heard.push(`global:${value}`))
-    scopeA.ctx.on('scope-test/ping', value => void heard.push(`A:${value}`))
+    scope.ctx.on('scope-test/ping', value => void heard.push(`A:${value}`))
+    let receiverMatches = false
+    const base = {
+      [Context.filter](this: object): boolean {
+        receiverMatches = this === base
+        return false
+      },
+    }
 
-    // A base whose own filter rejects every listener context: nothing fires,
-    // scoped or not — the scope predicate never overrides the base's veto.
-    const vetoBase = { [Context.filter]: () => false }
-    ctx.emit(scopeTarget(vetoBase, keyA), 'scope-test/ping', 'vetoed')
+    ctx.emit(scopeTarget(base, key), 'scope-test/ping', 'vetoed')
     expect(heard).toEqual([])
-
-    // A base whose filter accepts delegates to the scope predicate.
-    const openBase = { [Context.filter]: () => true }
-    ctx.emit(scopeTarget(openBase, keyA), 'scope-test/ping', 'open')
-    expect(heard).toEqual(['global:open', 'A:open'])
+    expect(receiverMatches).toBe(true)
+    await scope.dispose()
   })
 
-  it('keeps listener `this` base-shaped through the carrier (waterfall)', async () => {
+  it('{ global: true } listeners retain Cordis global-listener semantics', async () => {
     const ctx = new Context()
-    const base = { label: 'the-base' }
-    let seenLabel: string | undefined
-    ctx.on('scope-test/echo', function (this: { label: string }, value, next) {
-      seenLabel = this.label
-      return `${next()}+${value}`
-    })
-    const result = ctx.waterfall(scopeTarget(base, undefined), 'scope-test/echo', 'v', () => 'seed')
-    expect(result).toBe('seed+v')
-    expect(seenLabel).toBe('the-base')
+    const scope = await mintScope(ctx, { name: 'A' })
+    const heard: string[] = []
+    scope.ctx.on('scope-test/ping', value => void heard.push(value), { global: true })
+    ctx.emit(scopeTarget(ctx, { name: 'other' }), 'scope-test/ping', 'foreign')
+    ctx.emit(scopeTarget(ctx, undefined), 'scope-test/ping', 'none')
+    expect(heard).toEqual(['foreign', 'none'])
+    await scope.dispose()
   })
 
-  it('is transparent for subjects with native #private fields: methods and getters through the carrier reach the real object', () => {
-    // The ds-review-bot regression: cordis hands the carrier to listeners as
-    // `this` (typed Scoped<Agent>), so subject method calls through it are a
-    // supported shape. A proxy that delegates with the PROXY as receiver
-    // (cordis withProps) throws TypeError on any native #private the method
-    // or getter touches; the carrier must delegate with the BASE as receiver
-    // and bind retrieved methods to it.
-    class Subject {
-      #count = 0
-      bump(): number { return ++this.#count }
-      get count(): number { return this.#count }
-    }
-    const subject = new Subject()
-    const carrier = scopeTarget(subject, subject)
-    expect(carrier.bump()).toBe(1) // method call: bound to the base
-    expect(subject.count).toBe(1) // ...and it mutated the REAL object
-    expect(carrier.count).toBe(1) // getter: runs with the base as receiver
-    // The get trap returns the method already bound to the base;
-    // detachability IS the assertion.
-    // eslint-disable-next-line @typescript-eslint/unbound-method
-    const detached = carrier.bump
-    expect(detached()).toBe(2)
-  })
-
-  it('delegates sets to the base and leaves frozen own function props unbound (proxy invariant)', () => {
-    const frozenFn = (): string => 'frozen'
-    const base: { mutable: number; pinned: () => string; toString: () => string } = {
-      mutable: 0,
-      pinned: frozenFn,
-      toString: () => 'base-str',
-    }
-    Object.defineProperty(base, 'pinned', { value: frozenFn, writable: false, configurable: false })
-    const carrier = scopeTarget(base, undefined)
-    carrier.mutable = 7
-    expect(base.mutable).toBe(7) // sets land on the base, not a detached overlay
-    // A non-configurable, non-writable own data prop must be reported
-    // unchanged (binding it would violate the proxy get invariant).
-    expect(carrier.pinned).toBe(frozenFn)
-    // The overlay literal inherits Object.prototype; hasOwn (not `in`) keeps
-    // it from shadowing the subject's own prototype-surface members.
-    expect(String(carrier)).toBe('base-str')
-  })
-
-  it('honors the get invariant even when an overlay key collides with a frozen own prop of the base', () => {
-    // Pathological but engine-enforced: a base whose own [Context.filter] is
-    // a non-configurable, non-writable data prop pins what any proxy over it
-    // may report for that key. The carrier must yield the base's value (an
-    // overlay there would be a runtime TypeError from the engine, not a
-    // filtering choice). Such a base forgoes scope filtering by construction.
-    const pinnedFilter = (): boolean => true
-    const base = {}
-    Object.defineProperty(base, Context.filter, { value: pinnedFilter, writable: false, configurable: false })
-    const carrier = scopeTarget(base, { name: 'key' })
-    expect((carrier as Record<symbol, unknown>)[Context.filter]).toBe(pinnedFilter)
-  })
-
-  it('keeps the real constructor: class identity survives the carrier', () => {
-    class Subject { work(): string { return 'w' } }
-    const subject = new Subject()
-    const carrier = scopeTarget(subject, subject)
-    // `constructor` is looked up, never invoked as a subject method — binding
-    // it would break `carrier.constructor === Subject` for no benefit.
-    expect(carrier.constructor).toBe(Subject)
-  })
-})
-
-describe('carrier marks', () => {
-  it('isScopeCarrier / carrierKeyOf distinguish carriers, keys, and bare subjects', () => {
-    const base = { name: 'base' }
+  it('uses an opaque branded carrier with a separately tracked key', () => {
     const key = { name: 'key' }
-    const keyed = scopeTarget(base, key)
-    const subjectless = scopeTarget(base, undefined)
-
-    expect(isScopeCarrier(keyed)).toBe(true)
-    expect(carrierKeyOf(keyed)).toBe(key)
-    expect(isScopeCarrier(subjectless)).toBe(true)
-    expect(carrierKeyOf(subjectless)).toBeUndefined()
-
-    expect(isScopeCarrier(base)).toBe(false)
-    expect(carrierKeyOf(base)).toBeUndefined()
-    expect(isScopeCarrier(null)).toBe(false)
-    expect(isScopeCarrier('x')).toBe(false)
-  })
-
-  it('brands the carrier type (compile-time)', () => {
-    const base = { name: 'base' }
-    const carrier = scopeTarget(base, undefined)
-    expectTypeOf(carrier).toExtend<Scoped<{ name: string }>>()
-    // A bare subject is NOT assignable where a carrier is demanded.
-    expectTypeOf(base).not.toExtend<Scoped<{ name: string }>>()
-  })
-})
-
-describe('scopeHost', () => {
-  it('mints scopes that reach the injected services; dispose unwinds them all', async () => {
-    const ctx = new Context()
-    ctx.provide('answers', { value: 42 })
-    const host = await scopeHost(ctx, ['answers'])
-    const scope = host.mint({ name: 'a' })
-    expect((scope.ctx as Context & { answers: { value: number } }).answers.value).toBe(42)
-    const order: string[] = []
-    scope.ctx.effect(() => () => void order.push('scoped-disposed'))
-    await host.dispose()
-    expect(order).toEqual(['scoped-disposed'])
-    expect(() => scope.ctx.effect(() => () => {})).toThrow(/inactive context/)
-  })
-
-  it('dispose waits for a child whose raw disposer won the race', async () => {
-    const ctx = new Context()
-    ctx.provide('answers', { value: 42 })
-    const host = await scopeHost(ctx, ['answers'])
-    const scope = host.mint({ name: 'raw-first-child' })
-    const gate = Promise.withResolvers<undefined>()
-    let cleanupFinished = false
-    scope.ctx.effect(() => async () => {
-      await gate.promise
-      cleanupFinished = true
-    })
-
-    const raw = Promise.resolve(scope.rawDispose())
-    let hostSettled = false
-    const hostDispose = host.dispose().then(() => { hostSettled = true })
-    await Promise.resolve()
-    expect(hostSettled).toBe(false)
-
-    gate.resolve(undefined)
-    await Promise.all([raw, hostDispose])
-    expect(cleanupFinished).toBe(true)
-    await expect(host.dispose()).resolves.toBeUndefined()
-  })
-
-  it('reaches every child before surfacing one or multiple disposal failures', async () => {
-    const oneCtx = new Context()
-    oneCtx.provide('answers', { value: 42 })
-    const oneHost = await scopeHost(oneCtx, ['answers'])
-    const one = oneHost.mint({ name: 'one' })
-    one.dispose = () => Promise.reject(new Error('one failed'))
-    await expect(oneHost.dispose()).rejects.toThrow('one failed')
-
-    const manyCtx = new Context()
-    manyCtx.provide('answers', { value: 42 })
-    const manyHost = await scopeHost(manyCtx, ['answers'])
-    const a = manyHost.mint({ name: 'a' })
-    const b = manyHost.mint({ name: 'b' })
-    a.dispose = () => Promise.reject(new Error('a failed'))
-    b.dispose = () => Promise.reject(new Error('b failed'))
-    await expect(manyHost.dispose()).rejects.toMatchObject({
-      name: 'AggregateError',
-      message: 'scopeHost: disposal failed',
-      errors: [expect.objectContaining({ message: 'a failed' }), expect.objectContaining({ message: 'b failed' })],
-    })
-  })
-
-  it('fails LOUD naming absent services instead of resolving as a silent no-op host', async () => {
-    const ctx = new Context()
-    await expect(scopeHost(ctx, ['tools', 'systemPrompt']))
-      .rejects.toThrow('scopeHost: services "tools", "systemPrompt" not available')
-  })
-
-  it('names a single absent service in the singular', async () => {
-    const ctx = new Context()
-    await expect(scopeHost(ctx, ['tools'])).rejects.toThrow('scopeHost: service "tools" not available')
+    const subject = { value: 1 }
+    const carrier = scopeTarget(subject, key)
+    expect(isScopeCarrier(carrier)).toBe(true)
+    expect(carrierKeyOf(carrier)).toBe(key)
+    expect(isScopeCarrier(subject)).toBe(false)
+    expect(carrierKeyOf(subject)).toBeUndefined()
+    expect('value' in carrier).toBe(false)
+    expectTypeOf(carrier).toEqualTypeOf<Scoped<typeof subject>>()
   })
 })
diff --git a/packages/core/session/README.md b/packages/core/session/README.md
index fe15d4ab97..f1dba1d81a 100644
--- a/packages/core/session/README.md
+++ b/packages/core/session/README.md
@@ -4,40 +4,45 @@ Event-sourced session log and in-memory store. A `Session` is the append-only so
 
 ## Service: `SessionStore` (ctx key: `sessions`)
 
-Creates and holds event-sourced `Session` instances. Persistence is intentionally not implemented here — plugins subscribe to `session/event` and flush on `session/flush`.
+Creates and holds event-sourced `Session` instances. Persistence is intentionally not implemented here — plugins subscribe to `session/event`, flush on `session/flush`, and may mirror the paired `session/created`/`session/disposed` lifecycle.
 
 ### Public API
 
-- `ctx.sessions.create(id?: SessionId, options?: { seed?: SessionEvent[]; meta?: { cwd?: string; parentSession?: SessionId; createdAt?: number; seedLength?: number } }): Session` — Create a session. `options.seed` replays/forks an existing event log; `options.meta` attaches creation metadata (validated absolute `cwd`, `parentSession` lineage, seed boundary) as the immutable `SessionHeader`. The store fills `version`/`id` and defaults `createdAt` to now; a caller reconstructing a persisted session passes the original `createdAt` and persisted `seedLength` to preserve them. Disposed with the calling fiber.
-- `ctx.sessions.flush(session: Session): Promise<void>` Dispatch the awaited `session/flush` durability checkpoint with the carrier captured at enter — THE flush entry point (the loop's turn-end checkpoint and idle injection call it; never dispatch a raw `ctx.parallel`). Rejects a prepared, detached, or stale same-id object instead of inventing a subject-less carrier.
+- `ctx.sessions.create(id?: SessionId, options?: { seed?: readonly SessionEvent[]; meta?: { cwd?: string; parentSession?: SessionId; createdAt?: number; seedLength?: number } }): Session` — Create a session. The persistence/replay seed and resulting header are validated, detached, and deep-frozen at this durable boundary. The store fills `version`/`id` and defaults `createdAt` to now; a persisted reconstruction supplies the original `createdAt` and `seedLength`. Disposed with the calling fiber.
+- `ctx.sessions.flush(session: Session): Promise<void>` Dispatch the awaited `session/flush` durability checkpoint with the carrier captured at enter — THE flush entry point (the loop's turn-end checkpoint and idle injection call it; never dispatch a raw `ctx.parallel`). Every captured listener starts, the call waits for all of them to settle, and a failure rejects only after the other listeners finish. Rejects a prepared, detached, or stale same-id object instead of inventing a subject-less carrier.
 - `ctx.sessions.fork(source, boundary?, childSessionId?): Session` — Resolve a live session object or id, select a seed through the inclusive `boundary` event seq (default: current last event), require that boundary to be `turn/end`, and create a live child session with lineage metadata.
 - `ctx.sessions.get(id: SessionId): Session | undefined`
 - `ctx.sessions.list(): Session[]`
 
 #### Advanced: ordered-teardown lifecycle primitives
 
-`create()` covers the common case (the session is owned by the calling fiber). When a session must be torn down **in order with another resource** — so a final flush is captured before `onAppend` detaches — `create()`'s self-contained effect is wrong, because a fiber unload disposes sibling effects *concurrently*. For that, split the lifecycle and fold it into the owner's single effect:
+`create()` covers the common case (the session is owned by the calling fiber). When a session must be torn down **in order with another resource** — so a final flush is captured before the store attachment and publication hooks are removed — `create()`'s self-contained effect is wrong, because a fiber unload disposes sibling effects *concurrently*. For that, split the lifecycle and fold it into the owner's single effect:
 
-- `ctx.sessions.prepare(id?, options?): Session` — validate the id/cwd and construct the `Session`, WITHOUT entering it into the store. Same options as `create`.
-- `ctx.sessions.enter(session): () => void` — wire `onAppend` → `session/event`, capture its scope carrier, and add the session to the store; returns the idempotent DETACH disposer, which clears both notification and carrier state. Does NOT emit `session/created` (the caller installs the disposer first, then calls `announce`, so a throwing listener rolls the attach back). It re-checks the id because public `prepare`/`enter` calls may be interleaved; a stale prepared object must not overwrite a live same-id session.
-- `ctx.sessions.announce(session): void` — emit `session/created` for an entered session.
+- `ctx.sessions.prepare(id?, options?): Session` — validate durable seed/header data and construct the `Session` WITHOUT entering it into the store. Same options as `create`.
+- `ctx.sessions.enter(session): () => void` — perform the authoritative ID collision check, install append publication state, and insert the exact session without announcing it. Returns an idempotent detach bound to the captured entry object, so a stale disposer cannot remove a later same-ID replacement. Concurrent same-ID preparation is allowed; only one final entry succeeds.
+- `ctx.sessions.announce(session): void` — begin the one allowed `session/created` announcement for an entered session; repeat and reentrant calls reject before dispatch. A detach requested synchronously by a creation listener is deferred until that dispatch unwinds, so another creation listener cannot observe `session/disposed` before its own `session/created` callback. Detach emits `session/disposed` exactly once, including rollback after a partially delivered creation notification; a never-announced entry emits neither edge.
 
 `dsh-agent-loop` is the canonical consumer: after unpublished agent setup it enters both session and agent before announcing either, then nests loop stop, agent removal, session detach, and scope unwind in one ordered lifecycle. The final flush therefore settles before this package detaches the session, whether teardown starts from an `AgentHandle` or owner-fiber unload.
 
 ### Live service events
 
-The store announces creation, publishes each append, and provides an awaited durability checkpoint. Exact `session/*` signatures, modes, and scope-carrier behavior live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md); the append-only payload vocabulary is separately generated into the [persistence catalog](../../../docs/persistence-catalog.md). Persistence consumers write behind from the append notification and drain on the store-owned flush entry point rather than dispatching the event directly.
+The store pairs announced creation with disposal, publishes each append, and provides an awaited durability checkpoint. Before the log push it resolves the scoped `session/event` callback list. The push is the commit point; callback throws or returned-promise rejections are logged and contained per observer. A committed append therefore returns normally, later observers still run, and detach waits until publication unwinds. Exact `session/*` signatures, modes, and scope-carrier behavior live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md); the append-only payload vocabulary is separately generated into the [persistence catalog](../../../docs/persistence-catalog.md).
 
 ### Class: `Session`
 
 Plain class (not a Cordis Service). Create via `ctx.sessions.create()`.
 
-- `session.append(type, data, opts?): SessionEvent` — synchronous, never blocks on I/O. **Throws** if `data` is not losslessly JSON-serializable (BigInt, function, symbol, undefined, non-finite number, circular ref, or an exotic object like Map/Set/Date) — the event log is the durable source of truth, so this invariant is enforced at the source (exported as `isJsonValue` for backends to reuse on their replay/fork entry points). A third parameter `opts: SurfaceIntent` carries surface metadata: `surfaceOp` controls how the event enters the surface linked list, and `sourceEventSeqs` records provenance (the seq numbers of events this one derives from). It is **required** for the five `SurfaceEventType` events (every message-producing event must declare how it joins the surface) and rejected by the compiler for non-surface types. The marker requirement is enforced two ways: the typed overload makes `opts` mandatory when `type` is a specific `SurfaceEventType` literal, AND `append` **throws** at runtime if a surface-eligible event arrives with no `surfaceOp` — covering the case where `type` widens to the `SessionEventType` union (a caller iterating raw events, where the conditional overload collapses to optional) so a marker-less message event can never silently land in the log and vanish from `deriveMessages()`.
-- `session.deriveMessages(): Message[]` — the LLM message history, CACHED: each surface node is projected exactly once, when first seen (O(new nodes) per call; a surface rewrite rebuilds via `surface.replaceGeneration`). Returns a fresh array snapshot per call over SHARED, deep-frozen `Message` objects — cloned once off the log at projection time, so a consumer can never mutate logged data (mutation throws). The surface is the single source of derived history — there is no raw-log fallback.
-- `session.deriveEventMessage(event): Message | null` — the per-event projection `deriveMessages()` folds: one event's derived message (an unfrozen clone), or `null` when it produces none (a non-surface event, or an empty-content `assistant/message` hosting only usage). External reconstructors and the dev invariant fold the same function over a log prefix's surface, so no two paths can disagree about what a request's messages were (the reconstructability RFC).
+- `session.append(type, data, opts?): SessionEvent` — synchronous, never blocks on I/O. At this durable boundary, data and surface metadata are lossless-JSON snapshotted and deep-frozen. For an attached session, a reentrant append during dispatch/observer publication rejects, and detach waits for that publication to unwind. Callbacks resolve before the log push; the push is the commit point, after which each observer failure is contained independently. Runtime surface validation covers widened unions and raw seed/load logs.
+- `session.deriveMessages(): Message[]` — the LLM message history, CACHED: each surface node is projected exactly once, when first seen (O(new nodes) per call; a surface rewrite rebuilds via `surface.replaceGeneration`). Returns a fresh array per call over shared, deep-frozen `Message` objects. Each projection reuses the already deep-frozen content in its durable log event, so no second deep clone is needed and a consumer still cannot mutate logged data. The surface is the single source of derived history — there is no raw-log fallback.
+- `session.deriveEventMessage(event): Message | null` — the per-event projection `deriveMessages()` folds: a fresh message wrapper that reuses the event's already frozen content, or `null` when the event produces none (a non-surface event, or an empty-content `assistant/message` hosting only usage). External reconstructors and the dev invariant fold the same function over a log prefix's surface, so no two paths can disagree about what a request's messages were (the reconstructability RFC).
 - `session.surface: SurfaceManager` — the derived surface, lazily rebuilt from `surfaceOp` markers in the log. Processes only new events (delta) on each access — the log is append-only, so prior events never change. `surface.replaceGeneration` is the rewrite signal: bumped by every folded `replace` and by `invalidate()`, never reset, so an incremental consumer comparing generations cannot be fooled.
-- `session.events`, `session.seq`, `session.id`
-- `session.header: SessionHeader` — immutable creation metadata (`version`, `id`, `createdAt`, optional `cwd`/`parentSession`/`seedLength`). Kept out of the event log (a storage concern, not replayable state); a minimal header (stamped with the current `SESSION_FORMAT_VERSION`) is synthesized for bare `Session` construction.
+- `session.events` — a cached, frozen array snapshot over deep-frozen events. Repeated reads without an append return the same array; an append invalidates the cache and the next read returns a new snapshot, while earlier snapshots stay unchanged. Neither a cast nor a retained reference can push into the live log or rewrite an accepted event.
+- `session.seq`, `session.id` — current sequence and readonly typed identity.
+- `session.header: SessionHeader` — detached, deep-frozen creation metadata (`version`, `id`, `createdAt`, optional `cwd`/`parentSession`/`seedLength`). Construction validates the durable record and requires its id to match `session.id`.
+
+### Lossless JSON utilities
+
+Durable values need one accepted representation, not a check followed by a second read. `isJsonValue(value)` is the boolean predicate; `snapshotJsonValue(value)` recursively validates and copies a plain value in one pass, returning `undefined` for invalid input and propagating a throwing getter. The snapshot helper accepts finite JSON numbers except `-0` (JSON rewrites it to `0`), dense ordinary arrays, and plain or null-prototype objects; it rejects cycles, unsupported scalars, and exotic prototypes before normalization.
 
 ### Surface types
 
@@ -65,12 +70,12 @@ Every `SessionEvent` carries two optional top-level fields (structural metadata)
 
 ### Metadata types (`types.ts`)
 
-- `SessionHeader` — immutable session metadata, written once: `{ version, id, createdAt, cwd?, parentSession?, seedLength? }`. Owned here (beside `SessionId`) because `Session.header` is typed by it; persistence backends re-export it rather than own it (which would force a package cycle).
+- `SessionHeader` — session metadata written once when published as `Session.header`, where detachment and deep-freezing enforce immutability at runtime: `{ version, id, createdAt, cwd?, parentSession?, seedLength? }`. Persistence loaders may return mutable detached copies of the same data type. Owned here (beside `SessionId`) because `Session.header` is typed by it; persistence backends re-export it rather than own it (which would force a package cycle).
 
 ### Extension points
 
 - Persistence plugins: subscribe to `session/event` (write-behind) and drain on `session/flush` (awaited) and fiber dispose. A durable backend reads the log and reloads it into a live session; the metadata seam (`SessionHeader`, `session.header`) is what such a backend stores beside the log.
-- Replay/fork: `ctx.sessions.create(id, { seed })` seeds a new session with an existing event log. The surface rebuilds deterministically from `surfaceOp` markers in the seeded events. The seed is validated to the SAME always-on invariants `append` enforces — contiguous seqs, JSON-serializable data, and required `surfaceOp` markers on surface-eligible events — so marker-less message events are rejected at construction rather than silently vanishing from `deriveMessages()`. Broader turn-enclosure checks stay in `dsh-invariants` and persistence repair. Ordinary live-session forks use `ctx.sessions.fork(source, boundary?, childSessionId?)`, where `boundary` is the inclusive source event seq to fork through.
+- Replay/fork: `ctx.sessions.create(id, { seed })` seeds a new session with an existing event log. The surface rebuilds deterministically from `surfaceOp` markers in the seeded events. The constructor reads each seed entry once and uses the same one-pass lossless-JSON snapshot and exact surface-metadata shape checks as `append`, then enforces contiguous seqs and deep-freezes every accepted record; a stateful caller, exotic nested value, marker-less or malformed surface event, metadata on a non-surface event, or retained seed reference therefore cannot silently change the reconstructed history. Broader turn-enclosure checks stay in `dsh-invariants` and persistence repair. Ordinary live-session forks use `ctx.sessions.fork(source, boundary?, childSessionId?)`, where `boundary` is the inclusive source event seq to fork through.
 - Compaction: the `dsh-compact-basic` plugin appends a `user/message` with `surfaceOp: { op: 'replace', start, end }` to shadow old surface nodes behind a summary checkpoint.
 
 ## Known Limitations and Deferred Work
diff --git a/packages/core/session/src/index.ts b/packages/core/session/src/index.ts
index d3f4ca4890..6ce38bbffe 100644
--- a/packages/core/session/src/index.ts
+++ b/packages/core/session/src/index.ts
@@ -14,12 +14,12 @@ import type { Scoped } from '@deepseek-ai/dsh-scope'
 import type { ContentBlock, Message, MessageSource } from '@deepseek-ai/dsh-llm'
 import { SESSION_FORMAT_VERSION, SessionId } from './types.ts'
 import type { CreateSessionOptions, EpochHeader, SessionEvent, SessionEventMap, SessionEventType, SessionHeader, SurfaceIntent, SurfaceEventType } from './types.ts'
-import { isJsonValue } from './json.ts'
+import { snapshotJsonValue } from './json.ts'
 import { SurfaceManager, isSurfaceEligibleType } from './surface.ts'
 import { foldRequestHeader } from './request-header.ts'
 
 export * from './types.ts'
-export { isJsonValue } from './json.ts'
+export { isJsonValue, snapshotJsonValue } from './json.ts'
 export type { JsonValue } from './json.ts'
 export { interruptedTurnClosers } from './repair.ts'
 export type { SurfaceNode } from './surface.ts'
@@ -34,7 +34,12 @@ declare module 'cordis' {
 
   interface Events {
     /**
-     * A session was created in the store.
+     * A session was created in the store. A synchronous listener throw vetoes
+     * publication and rollback emits the matching `session/disposed` edge;
+     * returned-promise rejection is observed and logged but cannot retroactively
+     * veto this synchronous boundary. A synchronous listener that requests the
+     * advanced detach does not remove the entry immediately: removal and the
+     * paired `session/disposed` edge wait until the creation dispatch unwinds.
      * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the
      * session's owner scope, captured when the session was ENTERED (an agent's
      * session is entered through `agent.ctx`, so its events dispatch in that
@@ -45,9 +50,26 @@ declare module 'cordis' {
      * @mode emit
      */
     'session/created'(this: Scoped<Session>, session: Session): void
+    /**
+     * A previously announced session left the store. Emitted exactly once on
+     * normal detach or publication rollback, and never for a prepared/entered
+     * session whose `session/created` announcement did not begin. Listener
+     * failures (including returned-promise rejections) are logged and contained
+     * per listener so teardown always reaches quiescence.
+     * Scope-filtered dispatch uses the same owner carrier captured at entry;
+     * agent-scoped listeners hear only their own session's teardown.
+     * @param session - the session that is no longer live in the store.
+     * @mode emit
+     */
+    'session/disposed'(this: Scoped<Session>, session: Session): void
     /**
      * An event was appended to a session log (sync, fire-and-forget). This is
-     * the per-append feed a UI or invariant plugin tails.
+     * the per-append feed a UI or invariant plugin tails. The log push is the
+     * commit point; synchronous throws and returned-promise rejections from
+     * observers are logged and contained per listener, so they cannot make a
+     * committed append appear to fail or starve later listeners. The exact
+     * callback list and Cordis internal-dispatch checks resolve before the push;
+     * callbacks themselves run only after it.
      * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the
      * session's owner scope, captured when the session was ENTERED (an agent's
      * session is entered through `agent.ctx`, so its events dispatch in that
@@ -99,6 +121,137 @@ function renderTagged(tag: string, content: ContentBlock[], source: MessageSourc
   ]
 }
 
+/** Detach, validate, and freeze the creation metadata published by a session. */
+function snapshotSessionHeader(id: SessionId, source?: SessionHeader): SessionHeader {
+  const input: unknown = source === undefined
+    ? { version: SESSION_FORMAT_VERSION, id, createdAt: Date.now() }
+    : source
+  const snapshot = snapshotJsonValue(input)
+  if (snapshot === undefined) throw new Error('session header is not losslessly JSON-serializable')
+  if (snapshot === null || typeof snapshot !== 'object' || Array.isArray(snapshot)) {
+    throw new Error('session header is not a plain JSON record')
+  }
+  const record = snapshot as Record<string, unknown>
+  if (record.version !== SESSION_FORMAT_VERSION) {
+    throw new Error(`session header version must be ${SESSION_FORMAT_VERSION}, got ${String(record.version)}`)
+  }
+  if (record.id !== id) {
+    throw new Error(`session header id "${String(record.id)}" does not match session id "${id}"`)
+  }
+  if (typeof record.createdAt !== 'number' || !Number.isFinite(record.createdAt)) {
+    throw new Error('session header createdAt must be a finite number')
+  }
+  if (record.cwd !== undefined) {
+    if (typeof record.cwd !== 'string') throw new Error('session header cwd must be a string')
+    if (!isAbsolute(record.cwd)) {
+      throw new Error(`session header cwd must be an absolute path, got "${record.cwd}"`)
+    }
+  }
+  if (record.parentSession !== undefined && typeof record.parentSession !== 'string') {
+    throw new Error('session header parentSession must be a string')
+  }
+  if (record.seedLength !== undefined
+    && (typeof record.seedLength !== 'number' || !Number.isSafeInteger(record.seedLength) || record.seedLength < 0)) {
+    throw new Error('session header seedLength must be a non-negative safe integer')
+  }
+  return deepFreeze(record as unknown as SessionHeader)
+}
+
+/** Validate the runtime shape of surface metadata after its JSON snapshot. */
+function assertSurfaceMetadataShape(
+  type: string,
+  surfaceOp: unknown,
+  sourceEventSeqs: unknown,
+): void {
+  const eligible = isSurfaceEligibleType(type)
+  if (!eligible) {
+    if (surfaceOp !== undefined || sourceEventSeqs !== undefined) {
+      throw new Error(`session event "${type}" is not surface-eligible and cannot carry surface metadata`)
+    }
+    return
+  }
+  if (surfaceOp === undefined) {
+    throw new Error(`session event "${type}" is surface-eligible and requires a surfaceOp marker`)
+  }
+  if (surfaceOp !== 'append') {
+    if (surfaceOp === null || typeof surfaceOp !== 'object' || Array.isArray(surfaceOp)) {
+      throw new Error(`session event "${type}" carries an invalid surfaceOp`)
+    }
+    const op = surfaceOp as Record<string, unknown>
+    const keys = Object.keys(op)
+    if (keys.length !== 3 || !Object.hasOwn(op, 'op') || !Object.hasOwn(op, 'start') || !Object.hasOwn(op, 'end')
+      || op['op'] !== 'replace'
+      || typeof op['start'] !== 'number' || !Number.isSafeInteger(op['start']) || op['start'] < 0
+      || typeof op['end'] !== 'number' || !Number.isSafeInteger(op['end']) || op['end'] < 0) {
+      throw new Error(`session event "${type}" carries an invalid replace surfaceOp`)
+    }
+  }
+  if (sourceEventSeqs !== undefined) {
+    if (!Array.isArray(sourceEventSeqs)
+      || sourceEventSeqs.some(seq => typeof seq !== 'number' || !Number.isSafeInteger(seq) || seq < 0)) {
+      throw new Error(`session event "${type}" sourceEventSeqs must contain non-negative safe integers`)
+    }
+  }
+}
+
+/** Validate the fixed event envelope after one-pass JSON materialization. */
+function assertSessionEventEnvelope(value: Record<string, unknown>, index: number): asserts value is SessionEvent {
+  const event = value
+  const allowed = new Set(['type', 'seq', 'time', 'data', 'surfaceOp', 'sourceEventSeqs'])
+  if (Object.keys(event).some(key => !allowed.has(key))
+    || !Object.hasOwn(event, 'type') || typeof event['type'] !== 'string'
+    || !Object.hasOwn(event, 'seq') || typeof event['seq'] !== 'number'
+    || !Number.isSafeInteger(event['seq']) || event['seq'] < 0
+    || !Object.hasOwn(event, 'time') || typeof event['time'] !== 'number'
+    || !Number.isSafeInteger(event['time']) || event['time'] < 0
+    || !Object.hasOwn(event, 'data')) {
+    throw new Error(`seed event at index ${index} has an invalid event envelope`)
+  }
+}
+
+type SessionCallback = (...args: unknown[]) => unknown
+
+/** Resolve one listener snapshot, including Cordis's internal dispatch checks. */
+function collectSessionCallbacks(ctx: Context, args: unknown[]): SessionCallback[] {
+  return [...ctx.events.dispatch('emit', args)] as SessionCallback[]
+}
+
+/** Invoke one resolved observe-only listener snapshot with per-listener containment. */
+function invokeContainedSessionObservers(
+  ctx: Context,
+  name: 'session/event' | 'session/disposed',
+  id: SessionId,
+  args: unknown[],
+  callbacks: SessionCallback[],
+): void {
+  for (const callback of callbacks) {
+    try {
+      const returned: unknown = callback(...args)
+      void Promise.resolve(returned).catch((error: unknown) => {
+        ctx.logger.warn(`session "${id}": ${name} listener rejected: ${String(error)}`)
+      })
+    } catch (error: unknown) {
+      ctx.logger.warn(`session "${id}": ${name} listener threw: ${String(error)}`)
+    }
+  }
+}
+
+/** All mutable lifecycle state for one exact store entry. */
+interface SessionEntry {
+  readonly id: SessionId
+  readonly session: Session
+  readonly carrier: Scoped<Session>
+  readonly emitCtx: Context
+  announced: boolean
+  announcing: boolean
+  appending: boolean
+  detachRequested: boolean
+  detach(): void
+}
+
+/** Store attachment for the append path; module-private to keep Session store-agnostic publicly. */
+const attachments = new WeakMap<Session, SessionEntry>()
+
 /**
  * An event-sourced session: an append-only log of {@link SessionEvent}s.
  *
@@ -107,8 +260,6 @@ function renderTagged(tag: string, content: ContentBlock[], source: MessageSourc
  */
 export class Session {
   private log: SessionEvent[] = []
-  /** Set by the store so appends are observable; undefined when detached. */
-  onAppend: ((event: SessionEvent) => void) | undefined
 
   /**
    * Derived surface — a cached linked list of message-producing events.
@@ -126,16 +277,16 @@ export class Session {
   }
 
   /**
-   * Immutable creation metadata (format version, cwd, lineage, seed boundary).
-   * Supplied by the store via `ctx.sessions.create()`. When a `Session` is
-   * constructed bare (tests, ad-hoc replay), a minimal header is synthesized
-   * (stamped with the current {@link SESSION_FORMAT_VERSION}) so
+   * Detached, deep-frozen creation metadata (format version, cwd, lineage,
+   * seed boundary). Supplied by the store via `ctx.sessions.create()`. When a
+   * `Session` is constructed bare (tests, ad-hoc replay), a minimal header is
+   * synthesized (stamped with the current {@link SESSION_FORMAT_VERSION}) so
    * `session.header` is always present. Kept out of the event log — it is a
    * storage concern, not replayable conversation state.
    */
   readonly header: SessionHeader
 
-  constructor(public readonly id: SessionId, seed?: SessionEvent[], header?: SessionHeader) {
+  constructor(public readonly id: SessionId, seed?: readonly SessionEvent[], header?: SessionHeader) {
     if (seed) {
       // Validate the seed to the SAME invariants `append` enforces, so a
       // replay/fork (`ctx.sessions.create(id, { seed })`) cannot construct a
@@ -144,12 +295,16 @@ export class Session {
       // `seq = log.length` contract the whole system relies on). Without this,
       // a bad seed would surface only later as a backend rejection or a silent
       // divergence between the live log and disk.
-      seed.forEach((event, index) => {
-        if (event.seq !== index) {
-          throw new Error(`seed event at index ${index} has seq ${event.seq} (expected ${index}); seed must be contiguous from 0`)
+      this.log = Array.from(seed, (source, index) => {
+        // The seed is a persistence/replay boundary: validate and detach the
+        // complete event in one lossless-JSON pass.
+        const snapshot = snapshotJsonValue(source)
+        if (snapshot === undefined) {
+          throw new Error(`seed event at index ${index} is not losslessly JSON-serializable`)
         }
-        if (!isJsonValue(event.data)) {
-          throw new Error(`seed event "${event.type}" (seq ${event.seq}) carries non-JSON-serializable data`)
+        assertSessionEventEnvelope(snapshot, index)
+        if (snapshot.seq !== index) {
+          throw new Error(`seed event at index ${index} has seq ${snapshot.seq} (expected ${index}); seed must be contiguous from 0`)
         }
         // Surface-eligible events MUST carry a surfaceOp marker — the surface is
         // the sole source of derived history, so a marker-less message event
@@ -157,30 +312,30 @@ export class Session {
         // this at compile time via its typed overload; a seed arrives as raw
         // SessionEvent[] (replay/fork/load), bypassing that, so re-check at
         // runtime here rather than silently resuming with empty history.
-        if (isSurfaceEligibleType(event.type)
-          && (event as SessionEvent<SurfaceEventType>).surfaceOp === undefined) {
-          throw new Error(`seed event "${event.type}" (seq ${event.seq}) is surface-eligible but carries no surfaceOp marker`)
+        const structural = snapshot as SessionEvent & { surfaceOp?: unknown; sourceEventSeqs?: unknown }
+        try {
+          assertSurfaceMetadataShape(snapshot.type, structural.surfaceOp, structural.sourceEventSeqs)
+        } catch (error: unknown) {
+          throw new Error(`invalid seed event at index ${index}: ${error instanceof Error ? error.message : 'invalid surface metadata'}`)
         }
+        return deepFreeze(snapshot)
       })
-      // Deep-clone each seed event, NOT just the array: the seed events and
-      // their `data` are still owned by the caller (or the source session of a
-      // fork), so keeping the references would let a post-create mutation of the
-      // original rewrite this session's durable log — or reintroduce a
-      // non-JSON-serializable value AFTER the validation above. Snapshotting at
-      // the boundary makes `session.events` independent and keeps it equal to
-      // what was validated. Serializability is guaranteed by the check above, so
-      // structuredClone can never hit a non-cloneable value here.
-      this.log = seed.map(event => structuredClone(event))
     }
-    this.header = header ?? { version: SESSION_FORMAT_VERSION, id, createdAt: Date.now() }
+    this.header = snapshotSessionHeader(id, header)
   }
 
+  /** Cached immutable public snapshot of the private append-only log. */
+  private eventsSnapshot: readonly SessionEvent[] | undefined
+
   /**
-   * The append-only event log, exposed live by reference (readonly-typed, not
-   * a snapshot): later appends are visible through the same array.
+   * An immutable snapshot of the append-only event log. The snapshot is reused
+   * until the next append; a previously returned array does not grow later.
+   * Events and their nested data are deep-frozen at acceptance, so neither a
+   * cast nor ordinary JavaScript can rewrite durable history.
    */
   get events(): readonly SessionEvent[] {
-    return this.log
+    this.eventsSnapshot ??= Object.freeze([...this.log])
+    return this.eventsSnapshot
   }
 
   /** The next event's sequence number — always the log length (the `seq = log.length` contiguity contract). */
@@ -190,8 +345,11 @@ export class Session {
 
   /**
    * Append one typed event to the log and synchronously notify observers via
-   * `onAppend`. The hot path never blocks on I/O — persistence plugins buffer
-   * asynchronously.
+   * the store-owned, module-private publication hooks. The hot path never blocks
+   * on I/O — persistence plugins buffer asynchronously. Once the event enters
+   * the log, the append is committed: observer failures are logged and
+   * contained per listener, so they do not change the return value or prevent
+   * later listeners from observing the same accepted event.
    *
    * @param type - The event type (key of {@link SessionEventMap}).
    * @param data - The event payload; must be JSON-serializable.
@@ -205,66 +363,72 @@ export class Session {
    * @returns the logged event — its assigned `seq`/`time` plus the SNAPSHOT of
    *   `data` that entered the log, so reading `event.data` back sees the logged
    *   value, never the caller's still-mutable input.
-   * @throws if `data` is not losslessly JSON-serializable (BigInt, function,
-   *   symbol, undefined, non-finite number, circular ref, or an exotic object
-   *   like Map/Set/Date). The event log is the durable source of truth, so this
-   *   invariant is enforced at the source — a bad event never enters the log,
-   *   keeping `session.events` always equal to what a backend can persist. The
-   *   throw surfaces at the buggy caller's append site, not asynchronously in a
-   *   backend flush.
+   * @throws if `type` is not a string, or if `data` or surface metadata is not
+   *   losslessly JSON-serializable
+   *   (BigInt, function, symbol, undefined, negative zero, non-finite number,
+   *   circular reference, sparse array, or an exotic object such as
+   *   Map/Set/Date/class instance). One recursive pass reads, validates, and
+   *   copies each nested value once, so a stateful getter cannot supply one value
+   *   to validation and another to storage. The event log is the durable source
+   *   of truth, so a bad event fails at the append site rather than later during
+   *   a backend flush. A synchronous internal dispatch validation failure or an
+   *   append reentered while this acceptance/publication boundary is open also
+   *   rejects before the log changes.
    */
   append<T extends SessionEventType>(
     type: T,
     data: SessionEventMap[T],
     ...opts: T extends SurfaceEventType ? [opts: SurfaceIntent] : []
   ): SessionEvent<T> {
-    if (!isJsonValue(data)) {
+    const surfaceOpts: SurfaceIntent | undefined = opts[0]
+    const surfaceMetadata = {
+      ...surfaceOpts?.sourceEventSeqs === undefined ? {} : { sourceEventSeqs: surfaceOpts.sourceEventSeqs },
+      ...surfaceOpts?.surfaceOp === undefined ? {} : { surfaceOp: surfaceOpts.surfaceOp },
+    }
+    const dataSnapshot = snapshotJsonValue(data)
+    if (dataSnapshot === undefined) {
       throw new Error(`session event "${type}" carries non-JSON-serializable data`)
     }
-    const surfaceOpts: SurfaceIntent | undefined = opts[0]
-    // Surface-eligible events MUST carry a surfaceOp marker — the surface is the
-    // sole source of derived history, so a marker-less message event would be
-    // logged yet vanish from deriveMessages(). The typed `opts` overload makes
-    // the marker mandatory only when `T` is a SPECIFIC SurfaceEventType literal;
-    // when `T` widens to the SessionEventType union (a caller iterating raw
-    // events: `for (const e of log) append(e.type, e.data)`), the conditional
-    // rest collapses to optional and the compiler stops enforcing it. Re-check
-    // at runtime so that loophole can't silently drop history.
-    if (isSurfaceEligibleType(type) && surfaceOpts?.surfaceOp === undefined) {
-      throw new Error(`session event "${type}" is surface-eligible and requires a surfaceOp marker`)
+    const surfaceMetadataSnapshot = snapshotJsonValue(surfaceMetadata)
+    if (surfaceMetadataSnapshot === undefined) {
+      throw new Error(`session event "${type}" carries non-JSON-serializable surface metadata`)
     }
-    // Snapshot `data` into the log, NOT the caller's reference: the validation
-    // above proves it is JSON-serializable AT THIS MOMENT, but the caller still
-    // owns the object and could mutate it afterwards (before a persistence
-    // flush, or permanently in the in-memory history) — making `session.events`
-    // diverge from the value that passed validation, or reintroducing a
-    // non-serializable value. Cloning here keeps the log equal to what was
-    // validated. structuredClone is safe because serializability was just
-    // checked. The returned event carries the SAME snapshot, so a caller reading
-    // back `event.data` sees the logged value, not its own mutable input.
-    //
-    // Surface metadata is snapshot separately: sourceEventSeqs (number[] —
-    // primitives, so array spread is a complete copy) and surfaceOp (a string
-    // primitive, or cloned if it's a replace object).
-    // Build the event shape with conditional surface fields via spreading.
-    // The result is cast through `unknown` because the conditional spreads
-    // produce an intersection type that the assignability checker can't
-    // narrow to a specific discriminated-union member when T is generic.
-    // This is a safe internal boundary: data was validated above, and
-    // surface metadata was snapshot from primitive/clone-safe values.
-    const event = {
+    assertSurfaceMetadataShape(
       type,
-      seq: this.log.length,
-      time: Date.now(),
-      data: structuredClone(data),
-      ...surfaceOpts?.sourceEventSeqs !== undefined ? { sourceEventSeqs: [...surfaceOpts.sourceEventSeqs] } : {},
-      ...surfaceOpts?.surfaceOp !== undefined ? {
-        surfaceOp: typeof surfaceOpts.surfaceOp === 'string' ? surfaceOpts.surfaceOp : structuredClone(surfaceOpts.surfaceOp),
-      } : {},
-    } as unknown as SessionEvent<T>
-    this.log.push(event as unknown as SessionEvent)
-    this.onAppend?.(event as unknown as SessionEvent)
-    return event
+      (surfaceMetadataSnapshot as { surfaceOp?: unknown }).surfaceOp,
+      (surfaceMetadataSnapshot as { sourceEventSeqs?: unknown }).sourceEventSeqs,
+    )
+
+    const entry = attachments.get(this)
+    if (entry?.appending) {
+      throw new Error('session append cannot reenter while another append is being published')
+    }
+    if (entry !== undefined) entry.appending = true
+    try {
+      const event = deepFreeze({
+        type,
+        seq: this.log.length,
+        time: Date.now(),
+        data: dataSnapshot,
+        ...surfaceMetadataSnapshot,
+      } as unknown as SessionEvent<T>)
+      let callbacks: SessionCallback[] | undefined
+      const callbackArgs: unknown[] = [this, event]
+      if (entry !== undefined) {
+        callbacks = collectSessionCallbacks(entry.emitCtx, [entry.carrier, 'session/event', ...callbackArgs])
+      }
+      this.log.push(event as SessionEvent)
+      this.eventsSnapshot = undefined
+      if (callbacks !== undefined && entry !== undefined) {
+        invokeContainedSessionObservers(entry.emitCtx, 'session/event', entry.id, callbackArgs, callbacks)
+      }
+      return event
+    } finally {
+      if (entry !== undefined) {
+        entry.appending = false
+        if (entry.detachRequested && !entry.announcing) entry.detach()
+      }
+    }
   }
 
   /** Cached fold of the request-header events — see {@link requestHeader}. */
@@ -312,10 +476,9 @@ export class Session {
    * call costs O(new nodes), and a surface rewrite (a `replace`;
    * {@link SurfaceManager.replaceGeneration}) rebuilds. The returned array is
    * a fresh snapshot per call (later appends never grow an array a caller
-   * already holds); the `Message` objects in it are SHARED and **deep-frozen**
-   * — cloned once off the log at projection time, so consumers can never
-   * mutate logged data, and mutation attempts throw instead of silently
-   * diverging replay from history.
+   * already holds); the `Message` objects in it are SHARED and **deep-frozen**.
+   * Their content reuses the already frozen durable event data, so the cache
+   * needs no second deep clone and consumers still cannot mutate the log.
    * @returns a fresh array of the shared, frozen derived history.
    */
   deriveMessages(): Message[] {
@@ -347,9 +510,10 @@ export class Session {
    * The per-node pure function {@link deriveMessages} folds over the surface;
    * an external reconstructor (or the dev invariant) folds the same function
    * over a log prefix's surface to rebuild the exact messages any request was
-   * built from (the reconstructability RFC). The returned `content` is
-   * deep-cloned off the logged event: the log is append-only by contract, so
-   * no live reference to logged data leaves this boundary.
+   * built from (the reconstructability RFC). The returned message wrapper is
+   * fresh; its content reuses the logged event's already deep-frozen durable
+   * data, so changing the wrapper cannot rewrite the log and changing content
+   * throws.
    * @param event - the event to project.
    * @returns the derived message, or null when the event produces none.
    */
@@ -360,29 +524,29 @@ export class Session {
 
     switch (event.type) {
       case 'user/message': {
-        return { role: 'user', content: structuredClone(event.data.content) }
+        return { role: 'user', content: event.data.content }
       }
       case 'assistant/message': {
         // Skip an empty-content assistant/message: it exists only to host a
         // max-tokens step's usage and must not inject a content-less assistant
         // turn into the provider transcript.
         if (event.data.content.length === 0) return null
-        return { role: 'assistant', content: structuredClone(event.data.content) }
+        return { role: 'assistant', content: event.data.content }
       }
       case 'tool/result': {
         const { callId, content, isError } = event.data
         return {
           role: 'user',
-          content: [{ type: 'tool-result', toolCallId: callId, content: structuredClone(content), isError }],
+          content: [{ type: 'tool-result', toolCallId: callId, content, isError }],
         }
       }
       case 'context/message': {
         const { content, source } = event.data
-        return { role: 'user', content: renderTagged('context', structuredClone(content), source) }
+        return { role: 'user', content: renderTagged('context', content, source) }
       }
       case 'steering/message': {
         const { content, source } = event.data
-        return { role: 'user', content: renderTagged('steering', structuredClone(content), source) }
+        return { role: 'user', content: renderTagged('steering', content, source) }
       }
       default:
         // A non-surface event (boundary, chunk, log-only record) projects to
@@ -425,15 +589,7 @@ export class SessionForkError extends Error {
  * subscribe to `session/event` and flush on `session/flush` / dispose.
  */
 export class SessionStore extends Service {
-  private store = new Map<SessionId, Session>()
-  /**
-   * Each live session's dispatch carrier, captured at {@link enter} from the
-   * ENTERING context's scope tag (an agent session is entered through
-   * `agent.ctx` ⇒ its events dispatch in that agent's scope; a bare session ⇒
-   * subject-less carrier). WeakMap so a detached session drops its carrier
-   * with the entry.
-   */
-  private carriers = new WeakMap<Session, Scoped<Session>>()
+  private store = new Map<SessionId, SessionEntry>()
   private counter = 0
 
   constructor(ctx: Context) {
@@ -449,15 +605,16 @@ export class SessionStore extends Service {
    * fills `version`/`id`/`createdAt`).
    *
    * For an agent whose session must be torn down IN ORDER with its loop (so the
-   * loop's final flush is captured before `onAppend` detaches), do NOT use this
+   * loop's final flush is captured before the store attachment ends), do NOT use this
    * — fold the session lifecycle into the agent's own effect via
-   * {@link prepare} + {@link enter} + {@link announce} (see `dsh-agent-loop`'s
-   * `startOwned`).
+   * {@link prepare} + {@link enter} + {@link announce} (see
+   * `dsh-agent-loop`'s creation transaction).
    *
    * @param id - the session id; omitted, the store mints `session-<n>`.
    * @param options - seed events and/or creation metadata for the header.
    * @returns the live session, already entered and announced.
-   * @throws if a session with `id` already exists, or if `meta.cwd` is a
+   * @throws if a session with `id` already exists, metadata is not a plain
+   *   lossless-JSON record with valid scalar fields, or `meta.cwd` is a
    *   non-absolute path (storage backends key directories off it).
    */
   create(id?: SessionId, options?: CreateSessionOptions): Session {
@@ -465,7 +622,7 @@ export class SessionStore extends Service {
     // Single effect owned by the calling fiber. Yield the detach BEFORE
     // announcing so a throwing `session/created` listener rolls the attach back
     // (the generator effect disposes already-yielded disposers on a throw)
-    // instead of leaking the store entry + onAppend.
+    // instead of leaking the store entry and its publication hooks.
     this.ctx.effect(function* (this: SessionStore) {
       yield this.enter(session)
       this.announce(session)
@@ -479,37 +636,42 @@ export class SessionStore extends Service {
    * Pairs with {@link enter} + {@link announce}: a caller that owns a composite
    * `ctx.effect` (the agent factory) folds the session lifecycle into that ONE
    * effect so a fiber unload tears the session + agent down as a single ORDERED
-   * chain rather than as racing sibling effects — which would detach `onAppend`
+   * chain rather than as racing sibling effects — which would remove the publication hooks
    * before the loop's closing `session/flush`, dropping the closing events.
    *
    * @param id - the session id; omitted, the store mints `session-<n>`.
    * @param options - seed events and/or creation metadata for the header.
    * @returns the constructed session, NOT yet in the store.
-   * @throws if a session with `id` already exists, or if `meta.cwd` is a
+   * @throws if a session with `id` already exists, metadata is not a plain
+   *   lossless-JSON record with valid scalar fields, or `meta.cwd` is a
    *   non-absolute path.
    */
   prepare(id?: SessionId, options?: CreateSessionOptions): Session {
-    const sessionId = SessionId(id ?? `session-${++this.counter}`)
-    if (this.store.has(sessionId)) throw new Error(`session "${sessionId}" already exists`)
-    const cwd = options?.meta?.cwd
-    if (cwd !== undefined && !isAbsolute(cwd)) {
-      throw new Error(`session cwd must be an absolute path, got "${cwd}"`)
+    let sessionId: SessionId
+    if (id === undefined) {
+      do sessionId = SessionId(`session-${++this.counter}`)
+      while (this.store.has(sessionId))
+    } else {
+      sessionId = SessionId(id)
     }
+    if (this.store.has(sessionId)) throw new Error(`session "${sessionId}" already exists`)
+    const seed = options?.seed
+    const meta = options?.meta
     const header: SessionHeader = {
       version: SESSION_FORMAT_VERSION,
       id: sessionId,
-      createdAt: options?.meta?.createdAt ?? Date.now(),
-      ...cwd !== undefined ? { cwd } : {},
-      ...options?.meta?.parentSession !== undefined ? { parentSession: options.meta.parentSession } : {},
-      ...options?.meta?.seedLength !== undefined ? { seedLength: options.meta.seedLength } : {},
+      createdAt: meta?.createdAt ?? Date.now(),
+      ...meta?.cwd === undefined ? {} : { cwd: meta.cwd },
+      ...meta?.parentSession === undefined ? {} : { parentSession: meta.parentSession },
+      ...meta?.seedLength === undefined ? {} : { seedLength: meta.seedLength },
     }
-    return new Session(sessionId, options?.seed, header)
+    return new Session(sessionId, seed, header)
   }
 
   /**
-   * Enter a {@link prepare}d session into the store: wire `onAppend` →
-   * `session/event` and add it to the store. Returns the DETACH disposer
-   * (`onAppend = undefined` + store removal). Does NOT emit `session/created` —
+   * Enter a {@link prepare}d session into the store: install the module-private
+   * append publication hooks and add it to the store. Returns the DETACH
+   * disposer (hooks + store removal). Does NOT emit `session/created` —
    * the caller yields this disposer inside its effect and THEN calls
    * {@link announce}, so a throwing `session/created` listener rolls the attach
    * back instead of leaking it.
@@ -523,37 +685,105 @@ export class SessionStore extends Service {
    * assume that.
    *
    * @param session - a {@link prepare}d session not yet in the store.
-   * @returns the detach disposer (`onAppend = undefined` + store removal).
+   * @returns the detach disposer (publication hooks + store removal). When called from
+   *   a synchronous `session/created` listener, removal and disposal wait until
+   *   that creation dispatch unwinds.
    * @throws if a session with this id is already in the store.
    */
   enter(session: Session): () => void {
-    if (this.store.has(session.id)) throw new Error(`session "${session.id}" already exists`)
-    // The carrier is decided HERE, once, from the ENTERING context's scope tag
-    // (`this.ctx` is the caller's context — the tracker mechanism): every
-    // session/created|event|flush dispatch for this session uses it, so the
-    // session's whole event feed is scope-filtered consistently. The base is
-    // the session itself (scoped listeners' `this` is the session).
+    const id = session.id
     const carrier = scopeTarget(session, scopeOf(this.ctx))
-    this.carriers.set(session, carrier)
-    const emitCtx = this.ctx
-    session.onAppend = (event) => { emitCtx.emit(carrier, 'session/event', session, event) }
-    this.store.set(session.id, session)
+    // This is the authoritative collision boundary after arbitrary unpublished
+    // preparation. Only one exact same-id transaction can publish.
+    if (this.store.has(id)) throw new Error(`session "${id}" already exists`)
+    if (attachments.has(session)) throw new Error(`session "${id}" is already attached to a store`)
+    const entry: SessionEntry = {
+      id,
+      session,
+      carrier,
+      emitCtx: this.ctx,
+      announced: false,
+      announcing: false,
+      appending: false,
+      detachRequested: false,
+      detach: () => { this.detachEntered(entry) },
+    }
+    this.store.set(id, entry)
+    attachments.set(session, entry)
     let entered = true
-    return () => {
+    const detach = (): void => {
       if (!entered) return
       entered = false
-      session.onAppend = undefined
-      this.carriers.delete(session)
-      this.store.delete(session.id)
+      // A lifecycle listener may own the advanced detach capability. Keep the
+      // entry and its publication hooks live until synchronous creation or append
+      // publication unwinds, then publish the paired disposal edge.
+      if (entry.announcing || entry.appending) {
+        entry.detachRequested = true
+        return
+      }
+      entry.detach()
+    }
+    return detach
+  }
+
+  /** Remove one exact entered session and emit its paired disposal when announced. */
+  private detachEntered(entry: SessionEntry): void {
+    entry.detachRequested = false
+    // A stale capability cannot remove observers or storage belonging to a
+    // later same-id lifecycle.
+    /* v8 ignore next -- enter() rejects replacement while this single-shot detach capability is live. */
+    if (this.store.get(entry.id) !== entry) return
+    this.store.delete(entry.id)
+    attachments.delete(entry.session)
+    if (entry.announced) this.emitDisposed(entry)
+  }
+
+  /** Emit `session/created` exactly once for an {@link enter}ed session (with
+   * the carrier {@link enter} captured). Separate from {@link enter} so the
+   * caller can yield the detach disposer first (rollback safety — see
+   * {@link enter}).
+   * @param session - the entered session to announce to listeners.
+   * @throws if the session is not live or its announcement already began,
+   *   including a reentrant call from a creation listener. */
+  announce(session: Session): void {
+    const entry = this.liveEntryFor(session)
+    if (entry.announced || entry.announcing) {
+      throw new Error(`session "${entry.id}" was already announced`)
+    }
+    // Mark before emit: Cordis emit may deliver to earlier listeners and then
+    // throw. Rollback must still pair that partial creation with disposal, and
+    // a listener cannot recursively create a second lifecycle edge.
+    entry.announced = true
+    const callbackArgs: unknown[] = [session]
+    entry.announcing = true
+    try {
+      const callbacks = collectSessionCallbacks(this.ctx, [entry.carrier, 'session/created', session])
+      for (const callback of callbacks) {
+        // Synchronous throws intentionally propagate and veto publication; the
+        // yielded detach then emits the paired disposal edge. An async function
+        // is nevertheless assignable to a void listener, so observe its returned
+        // promise: rejection is too late to roll back and must be logged instead
+        // of becoming unhandled.
+        const returned: unknown = callback(...callbackArgs)
+        void Promise.resolve(returned).catch((error: unknown) => {
+          this.ctx.logger.warn(`session "${entry.id}": session/created listener rejected: ${String(error)}`)
+        })
+      }
+    } finally {
+      entry.announcing = false
+      if (entry.detachRequested && !entry.appending) entry.detach()
     }
   }
 
-  /** Emit `session/created` for an {@link enter}ed session (with the carrier
-   * {@link enter} captured). Separate from {@link enter} so the caller can
-   * yield the detach disposer first (rollback safety — see {@link enter}).
-   * @param session - the entered session to announce to listeners. */
-  announce(session: Session): void {
-    this.ctx.emit(this.liveCarrierFor(session), 'session/created', session)
+  /** Emit the paired teardown notification with per-listener containment. */
+  private emitDisposed(entry: SessionEntry): void {
+    const callbackArgs: unknown[] = [entry.session]
+    try {
+      const callbacks = collectSessionCallbacks(this.ctx, [entry.carrier, 'session/disposed', entry.session])
+      invokeContainedSessionObservers(this.ctx, 'session/disposed', entry.id, callbackArgs, callbacks)
+    } catch (error: unknown) {
+      this.ctx.logger.warn(`session "${entry.id}": session/disposed dispatch threw: ${String(error)}`)
+    }
   }
 
   /**
@@ -564,26 +794,34 @@ export class SessionStore extends Service {
    * raw `ctx.parallel('session/flush', …)` — one owner, one spelling, and the
    * scoped-dispatch invariant can pin it.
    * @param session - the session whose buffered events must reach durable storage.
-   * @returns resolves when every flush listener has settled; rejects if one rejects.
+   * @returns resolves when every flush listener has settled; after all settle,
+   *   rejects with the first registered listener failure if any listener failed.
    */
   async flush(session: Session): Promise<void> {
-    await this.ctx.parallel(this.liveCarrierFor(session), 'session/flush', session)
+    const { carrier } = this.liveEntryFor(session)
+    const callbackArgs: unknown[] = [session]
+    const callbacks = collectSessionCallbacks(this.ctx, [carrier, 'session/flush', session])
+    const results = await Promise.allSettled(callbacks.map((callback) => {
+      try {
+        return callback(...callbackArgs)
+      } catch (error: unknown) {
+        // Preserve the listener's exact rejection value; flush is a caller-owned
+        // failure boundary, and Cordis listeners may throw arbitrary values.
+        // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors
+        return Promise.reject(error)
+      }
+    }))
+    const failure = results.find((result): result is PromiseRejectedResult => result.status === 'rejected')
+    if (failure !== undefined) throw failure.reason
   }
 
-  /** Return the exact live session's carrier; detached/prepared objects reject. */
-  private liveCarrierFor(session: Session): Scoped<Session> {
-    if (this.store.get(session.id) !== session) {
+  /** Return the exact live entry; detached/prepared objects reject. */
+  private liveEntryFor(session: Session): SessionEntry {
+    const entry = attachments.get(session)
+    if (entry === undefined || this.store.get(entry.id) !== entry) {
       throw new Error(`session "${session.id}" is not live in this store`)
     }
-    const carrier = this.carriers.get(session)
-    // enter() installs store + carrier in one synchronous sequence; a live
-    // session without one is an internal invariant violation, never fallback
-    // to subject-less dispatch (that would silently cross scope boundaries).
-    /* v8 ignore next -- enter installs store and carrier in one synchronous sequence */
-    if (carrier === undefined) {
-      throw new Error(`session "${session.id}" has no dispatch carrier`)
-    }
-    return carrier
+    return entry
   }
 
   /**
@@ -592,7 +830,7 @@ export class SessionStore extends Service {
    * @returns the session, or undefined when no live session has that id.
    */
   get(id: SessionId): Session | undefined {
-    return this.store.get(id)
+    return this.store.get(id)?.session
   }
 
   /**
@@ -600,7 +838,7 @@ export class SessionStore extends Service {
    * @returns a fresh array; mutating it does not affect the store.
    */
   list(): Session[] {
-    return [...this.store.values()]
+    return [...this.store.values()].map(entry => entry.session)
   }
 
   /**
@@ -670,7 +908,7 @@ export class SessionStore extends Service {
       )
     }
 
-    return events.slice(0, boundary + 1).map(event => structuredClone(event))
+    return events.slice(0, boundary + 1)
   }
 
   private _resolveForkSource(source: SessionForkSource): Session {
diff --git a/packages/core/session/src/json.ts b/packages/core/session/src/json.ts
index 22303c6c61..2ec36087dd 100644
--- a/packages/core/session/src/json.ts
+++ b/packages/core/session/src/json.ts
@@ -1,45 +1,127 @@
 /**
- * JSON-serializability validation for session event data.
+ * Lossless-JSON validation and snapshot materialization for session data.
  *
  * The session event log is the durable source of truth (the event-sourcing / session-persistence RFCs): every
  * `event.data` must round-trip losslessly through JSON so any persistence
  * backend can store and reload it byte-identically. This invariant belongs to
  * the log itself — `Session.append` enforces it at the source, so a
  * non-serializable event never enters `session.events` and the live log can
- * never diverge from what a backend can persist. Backends re-use the same
- * predicate to validate their own `append(events)` entry point (replay/fork
- * paths that do not go through a live `Session`).
+ * never diverge from what a backend can persist. Other public boundaries use
+ * {@link snapshotJsonValue} when they must validate and detach in one pass;
+ * {@link isJsonValue} remains the non-copying structural predicate.
  *
  * @module @deepseek-ai/dsh-session/json
  */
 
 /**
  * A value that round-trips losslessly through JSON: `null`, a boolean, a finite
- * number, a string, an array of such values, or a plain object whose values are
- * such values. The static type companion to {@link isJsonValue} (which validates
- * the same shape at runtime). Use it to type a payload that must survive
- * session-log persistence and replay byte-identically — e.g. a tool's private
- * presentation `meta`.
+ * number other than negative zero, a string, an array of such values, or a
+ * plain object whose values are such values. TypeScript cannot distinguish
+ * `-0` from `number`, so {@link isJsonValue} and {@link snapshotJsonValue}
+ * enforce that last numeric detail at runtime. Use this type for a payload that
+ * must survive session-log persistence and replay byte-identically — e.g. a
+ * tool's private presentation `meta`.
  */
 export type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue }
 
 /**
- * Whether `value` is losslessly JSON-serializable: only `null`, finite numbers,
- * booleans, strings, plain arrays, and plain objects of such values. Rejects
- * `BigInt`, function, symbol, `undefined`, non-finite numbers (`NaN`/`Infinity`,
- * which `JSON.stringify` turns into `null`), and exotic objects (`Map`/`Set`/
- * `Date`/class instances) — anything `JSON.stringify` would drop, throw on, or
- * convert lossily. Sparse arrays are rejected too: a hole serializes to `null`,
- * so `[1, , 3]` would not round-trip. Detects circular references (which would
- * throw) and reports them as non-serializable rather than propagating the throw.
+ * Materialize one detached lossless-JSON snapshot in a SINGLE recursive pass.
+ * Each array slot or own enumerable string-keyed object value is read exactly
+ * once, validated, and copied immediately. This is intentionally not
+ * `isJsonValue(value)` followed by `structuredClone(value)`: a stateful getter
+ * could return plain JSON to the check and an exotic class instance to the
+ * clone, whose prototype `structuredClone` would erase before a later check.
  *
- * Scope — matches `JSON.stringify` exactly: only an object's OWN ENUMERABLE
- * STRING-keyed properties are inspected (`Object.values`). Symbol-keyed and
- * non-enumerable properties are NOT examined, because `JSON.stringify` likewise
- * drops them — they never reach the durable form, so a non-serializable value
- * hiding under a symbol/non-enumerable key cannot make the round-trip lossy.
- * Getters are invoked during the check (again as `JSON.stringify` would), so the
- * contract is for plain data records, not objects with side-effecting accessors.
+ * Accepts the same scalar/object vocabulary as {@link isJsonValue}: arrays use
+ * the ordinary `Array.prototype` (subclass instances are not plain JSON
+ * containers), while null-prototype objects are accepted and normalized to
+ * ordinary plain objects. Sparse arrays, cycles, negative zero, non-finite
+ * numbers, unsupported scalar types, and exotic object or array shells return
+ * `undefined`. A throwing getter is a caller failure and propagates unchanged.
+ *
+ * @param value - the candidate value to validate and detach.
+ * @returns the detached snapshot, or `undefined` when the value is not
+ *   losslessly JSON-serializable.
+ */
+export function snapshotJsonValue<T>(value: T): T | undefined {
+  const ancestors = new Set<object>()
+
+  const visit = (current: unknown): JsonValue | undefined => {
+    if (current === null) return null
+    switch (typeof current) {
+      case 'boolean':
+      case 'string':
+        return current
+      case 'number':
+        return Number.isFinite(current) && !Object.is(current, -0) ? current : undefined
+      case 'bigint':
+      case 'function':
+      case 'symbol':
+      case 'undefined':
+        return undefined
+      case 'object':
+        break
+    }
+
+    if (ancestors.has(current)) return undefined
+    ancestors.add(current)
+    try {
+      if (Array.isArray(current)) {
+        if (Object.getPrototypeOf(current) !== Array.prototype) return undefined
+        const length = current.length
+        const snapshot: JsonValue[] = []
+        for (let index = 0; index < length; index++) {
+          if (!Object.prototype.hasOwnProperty.call(current, index)) return undefined
+          const item = visit(current[index])
+          if (item === undefined) return undefined
+          snapshot.push(item)
+        }
+        return snapshot
+      }
+
+      const prototype = Object.getPrototypeOf(current) as unknown
+      if (prototype !== Object.prototype && prototype !== null) return undefined
+      const snapshot: { [key: string]: JsonValue } = {}
+      for (const key of Object.keys(current)) {
+        const item = visit((current as Record<string, unknown>)[key])
+        if (item === undefined) return undefined
+        // Define the key as data so a JSON field literally named "__proto__"
+        // cannot mutate the snapshot's prototype through ordinary assignment.
+        Object.defineProperty(snapshot, key, {
+          value: item,
+          enumerable: true,
+          configurable: true,
+          writable: true,
+        })
+      }
+      return snapshot
+    } finally {
+      ancestors.delete(current)
+    }
+  }
+
+  return visit(value) as T | undefined
+}
+
+/**
+ * Whether `value` is losslessly JSON-serializable: only `null`, finite numbers
+ * other than negative zero, booleans, strings, plain arrays, and plain objects
+ * of such values. Rejects `BigInt`, function, symbol, `undefined`, `-0` (which
+ * JSON rewrites to `0`), non-finite numbers (`NaN`/`Infinity`, which JSON turns
+ * into `null`), and exotic objects (`Map`/`Set`/`Date`/class instances) —
+ * anything `JSON.stringify` would drop, throw on, or convert lossily. Sparse
+ * arrays are rejected too: a hole serializes to `null`, so `[1, , 3]` would not
+ * round-trip. Detects circular references (which would throw) and reports them
+ * as non-serializable rather than propagating the throw.
+ *
+ * Scope — this is a structural plain-data predicate, not an invocation of
+ * `JSON.stringify`: only an object's OWN ENUMERABLE STRING-keyed properties are
+ * inspected (`Object.values`). Symbol-keyed and non-enumerable properties are
+ * omitted from the durable data surface. Custom `toJSON` behavior is not
+ * executed; boundaries that persist a value first materialize a new plain-data
+ * record with {@link snapshotJsonValue}. Getters are invoked during this check,
+ * so callers that need a stable detached value use that one-pass materializer
+ * instead of checking and then rereading a side-effecting record.
  * @param value - the candidate event data to test.
  * @param seen - objects on the current descent path, for circular-reference
  *   detection; the recursion threads it — callers omit it.
@@ -52,7 +134,7 @@ export function isJsonValue(value: unknown, seen: Set<object> = new Set()): bool
     case 'string':
       return true
     case 'number':
-      return Number.isFinite(value)
+      return Number.isFinite(value) && !Object.is(value, -0)
     case 'bigint':
     case 'function':
     case 'symbol':
@@ -66,6 +148,7 @@ export function isJsonValue(value: unknown, seen: Set<object> = new Set()): bool
   seen.add(value)
   try {
     if (Array.isArray(value)) {
+      if (Object.getPrototypeOf(value) !== Array.prototype) return false
       // Reject sparse arrays: a hole is skipped by `every`/`forEach` but
       // JSON.stringify writes it as `null`, so `[1, , 3]` would round-trip
       // lossily. Require every index 0..length-1 to be an OWN property.
diff --git a/packages/core/session/src/types.ts b/packages/core/session/src/types.ts
index ca6779e1dc..c4838808c1 100644
--- a/packages/core/session/src/types.ts
+++ b/packages/core/session/src/types.ts
@@ -32,6 +32,9 @@ export const SESSION_FORMAT_VERSION = 0
 
 /**
  * Immutable session metadata — written once at creation and never rewritten.
+ * {@link Session} enforces that contract at runtime: it validates and detaches
+ * the accepted scalar fields, requires this header's id to match the session
+ * id, and deep-freezes the published record.
  *
  * Kept SEPARATE from the event log deliberately: format-version, cwd, and
  * lineage are storage concerns, not conversation events, so they stay out of
@@ -45,15 +48,15 @@ export interface SessionHeader {
    * session is created. A persistence backend rejects any other version on load
    * (no migration — see the constant).
    */
-  version: number
+  readonly version: number
   /** The session's id (mirrors the {@link Session}'s id). */
-  id: SessionId
+  readonly id: SessionId
   /** Unix epoch milliseconds when the session was created. */
-  createdAt: number
+  readonly createdAt: number
   /** Absolute working directory the session was created in (if any). */
-  cwd?: string
+  readonly cwd?: string
   /** The session this one was forked from (seed lineage), if any. */
-  parentSession?: SessionId
+  readonly parentSession?: SessionId
   /**
    * How many leading events were INHERITED via a seed rather than produced by
    * this session — the seed boundary. Set when a fork seeds a child with a
@@ -63,7 +66,7 @@ export interface SessionHeader {
    * harness can skip the inherited prefix when deriving the child's OWN script
    * (the seeded events are the parent's, not this child's model calls).
    */
-  seedLength?: number
+  readonly seedLength?: number
 }
 
 /**
@@ -73,9 +76,10 @@ export interface SessionHeader {
  */
 export interface CreateSessionOptions {
   /** Events to seed the new session with (replay/fork). */
-  seed?: SessionEvent[]
+  readonly seed?: readonly SessionEvent[]
   /**
-   * Creation metadata. The store fills in `version`/`id` and defaults
+   * Creation metadata. The store reads this plain record and each accepted
+   * field once, then fills in `version`/`id` and defaults
    * `createdAt` to now; the caller supplies the storage-level fields (validated
    * absolute `cwd`, `parentSession` lineage, the seed boundary `seedLength`, and
    * — when reconstructing a persisted session — the original `createdAt` to
@@ -86,7 +90,12 @@ export interface CreateSessionOptions {
    * length, not the original boundary — the caller must pass the persisted
    * boundary back. A fresh fork passes its actual seeded-prefix length.
    */
-  meta?: { cwd?: string; parentSession?: SessionId; createdAt?: number; seedLength?: number }
+  readonly meta?: {
+    readonly cwd?: string
+    readonly parentSession?: SessionId
+    readonly createdAt?: number
+    readonly seedLength?: number
+  }
 }
 
 /**
diff --git a/packages/core/session/tests/derived-cache.spec.ts b/packages/core/session/tests/derived-cache.spec.ts
index b416d15639..46015106c8 100644
--- a/packages/core/session/tests/derived-cache.spec.ts
+++ b/packages/core/session/tests/derived-cache.spec.ts
@@ -89,15 +89,15 @@ describe('Session.deriveEventMessage — the per-event projection', () => {
     expect(session.deriveEventMessage(event)).toEqual(session.deriveMessages().at(-1))
   })
 
-  it('clones content off the log: the projection never aliases the logged event', () => {
+  it('reuses the logged event\'s already frozen content', () => {
     const session = new Session(SessionId('per-event-clone'))
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     const event = session.append('user/message', { content: [{ type: 'text', text: 'orig' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
     const message = session.deriveEventMessage(event)!
-    expect(message.content).not.toBe(event.data.content)
-    // deriveEventMessage returns an unfrozen clone (the cache freezes ITS
-    // copies); mutating it must not reach the log.
-    ;(message.content[0] as { text: string }).text = 'mutated'
+    expect(message.content).toBe(event.data.content)
+    expect(Object.isFrozen(message.content)).toBe(true)
+    expect(Object.isFrozen(message.content[0])).toBe(true)
+    expect(() => { (message.content[0] as { text: string }).text = 'mutated' }).toThrow()
     expect(session.deriveMessages().at(-1)!.content).toEqual([{ type: 'text', text: 'orig' }])
   })
 
diff --git a/packages/core/session/tests/fork.spec.ts b/packages/core/session/tests/fork.spec.ts
index 25328294cf..af143ea5ee 100644
--- a/packages/core/session/tests/fork.spec.ts
+++ b/packages/core/session/tests/fork.spec.ts
@@ -60,7 +60,7 @@ describe('SessionStore.fork', () => {
     })
   })
 
-  it('forks the latest completed boundary by default and deep-clones seed events', async () => {
+  it('forks the latest completed boundary by default into detached frozen seed events', async () => {
     const { ctx, sessions } = await setup()
     const source = ctx.sessions.create(SessionId('parent'), { meta: { cwd: '/workspace' } })
     appendClosedTurn(source, 1, 'hello')
@@ -70,8 +70,11 @@ describe('SessionStore.fork', () => {
     expect(child.events).toEqual(source.events)
     expect(child.events).not.toBe(source.events)
     expect(child.events[1]).not.toBe(source.events[1])
-    firstUserMessage(child.events).data.content[0] = { type: 'text', text: 'child mutation' }
+    expect(() => {
+      firstUserMessage(child.events).data.content[0] = { type: 'text', text: 'child mutation' }
+    }).toThrow(TypeError)
     expect(firstUserMessage(source.events).data.content).toEqual([{ type: 'text', text: 'hello' }])
+    expect(firstUserMessage(child.events).data.content).toEqual([{ type: 'text', text: 'hello' }])
     expect(child.header).toMatchObject({
       id: SessionId('child'),
       cwd: '/workspace',
diff --git a/packages/core/session/tests/json.spec.ts b/packages/core/session/tests/json.spec.ts
new file mode 100644
index 0000000000..4fb06fd744
--- /dev/null
+++ b/packages/core/session/tests/json.spec.ts
@@ -0,0 +1,152 @@
+import { describe, expect, it } from 'vitest'
+import { isJsonValue, snapshotJsonValue } from '@deepseek-ai/dsh-session'
+
+describe('snapshotJsonValue', () => {
+  it('copies the complete JSON scalar vocabulary and rejects unsupported scalars', () => {
+    const unsupportedFunction = (): void => {}
+
+    expect(snapshotJsonValue(null)).toBeNull()
+    expect(snapshotJsonValue(true)).toBe(true)
+    expect(snapshotJsonValue('text')).toBe('text')
+    expect(snapshotJsonValue(1.25)).toBe(1.25)
+    expect(snapshotJsonValue(-0)).toBeUndefined()
+    expect(isJsonValue(-0)).toBe(false)
+    expect(snapshotJsonValue(Number.NaN)).toBeUndefined()
+    expect(snapshotJsonValue(Number.POSITIVE_INFINITY)).toBeUndefined()
+    expect(snapshotJsonValue(1n)).toBeUndefined()
+    expect(snapshotJsonValue(unsupportedFunction)).toBeUndefined()
+    expect(snapshotJsonValue(Symbol('value'))).toBeUndefined()
+    const unsupportedUndefined: unknown = undefined
+    expect(snapshotJsonValue(unsupportedUndefined)).toBeUndefined()
+  })
+
+  it('recursively detaches dense arrays and plain or null-prototype objects', () => {
+    const shared = { value: 1 }
+    const nullPrototype = Object.assign(Object.create(null) as Record<string, unknown>, { shared })
+    const source = { list: [nullPrototype, shared], alias: shared }
+
+    const snapshot = snapshotJsonValue(source)!
+    shared.value = 2
+
+    expect(snapshot).toEqual({ list: [{ shared: { value: 1 } }, { value: 1 }], alias: { value: 1 } })
+    expect(snapshot).not.toBe(source)
+    expect(snapshot.list).not.toBe(source.list)
+    expect(snapshot.alias).not.toBe(shared)
+    expect(snapshot.list[0]).not.toBe(nullPrototype)
+    expect(Object.getPrototypeOf(snapshot.list[0])).toBe(Object.prototype)
+  })
+
+  it('reads each object value and array slot once while materializing', () => {
+    class Exotic {
+      readonly accepted = false
+    }
+    let objectReads = 0
+    let arrayReads = 0
+    const nested = Object.defineProperty({}, 'value', {
+      enumerable: true,
+      get: () => {
+        objectReads += 1
+        return objectReads === 1 ? { accepted: true } : new Exotic()
+      },
+    })
+    const array = new Array<unknown>(1)
+    Object.defineProperty(array, 0, {
+      enumerable: true,
+      get: () => {
+        arrayReads += 1
+        return arrayReads === 1 ? nested : new Exotic()
+      },
+    })
+
+    expect(snapshotJsonValue(array)).toEqual([{ value: { accepted: true } }])
+    expect(objectReads).toBe(1)
+    expect(arrayReads).toBe(1)
+  })
+
+  it('rejects exotic containers, sparse arrays, cycles, and invalid children', () => {
+    class ExoticObject {
+      readonly value = 1
+    }
+    class ExoticArray extends Array<number> {}
+    const sparse = new Array<number>(1)
+    const cyclic: Record<string, unknown> = {}
+    cyclic.self = cyclic
+
+    expect(snapshotJsonValue(new ExoticObject())).toBeUndefined()
+    expect(snapshotJsonValue(new Map([['value', 1]]))).toBeUndefined()
+    expect(snapshotJsonValue(new ExoticArray(1))).toBeUndefined()
+    expect(snapshotJsonValue(sparse)).toBeUndefined()
+    expect(snapshotJsonValue(cyclic)).toBeUndefined()
+    expect(snapshotJsonValue([undefined])).toBeUndefined()
+    expect(snapshotJsonValue({ value: undefined })).toBeUndefined()
+  })
+
+  it('preserves a literal __proto__ JSON key without changing the snapshot prototype', () => {
+    const source = Object.create(null) as Record<string, unknown>
+    source.__proto__ = { safe: true }
+
+    const snapshot = snapshotJsonValue(source)!
+
+    expect(Object.getPrototypeOf(snapshot)).toBe(Object.prototype)
+    expect(Object.prototype.hasOwnProperty.call(snapshot, '__proto__')).toBe(true)
+    expect(snapshot.__proto__).toEqual({ safe: true })
+  })
+
+  it('propagates a throwing getter after reading it once', () => {
+    const failure = new Error('getter failed')
+    let reads = 0
+    const source = Object.defineProperty({}, 'value', {
+      enumerable: true,
+      get: () => {
+        reads += 1
+        throw failure
+      },
+    })
+
+    expect(() => snapshotJsonValue(source)).toThrow(failure)
+    expect(reads).toBe(1)
+  })
+})
+
+describe('isJsonValue', () => {
+  it('recognizes supported scalars and rejects every lossy scalar case', () => {
+    const unsupportedFunction = (): void => {}
+    const unsupportedUndefined: unknown = undefined
+
+    expect(isJsonValue(null)).toBe(true)
+    expect(isJsonValue(false)).toBe(true)
+    expect(isJsonValue('text')).toBe(true)
+    expect(isJsonValue(1.25)).toBe(true)
+    expect(isJsonValue(-0)).toBe(false)
+    expect(isJsonValue(Number.NaN)).toBe(false)
+    expect(isJsonValue(1n)).toBe(false)
+    expect(isJsonValue(unsupportedFunction)).toBe(false)
+    expect(isJsonValue(Symbol('value'))).toBe(false)
+    expect(isJsonValue(unsupportedUndefined)).toBe(false)
+  })
+
+  it('accepts dense arrays and plain objects, including null-prototype records', () => {
+    const nullPrototype = Object.assign(Object.create(null) as Record<string, unknown>, { value: true })
+
+    expect(isJsonValue([1, { nested: null }, nullPrototype])).toBe(true)
+    expect(isJsonValue({ value: [1, 2] })).toBe(true)
+    expect(isJsonValue(nullPrototype)).toBe(true)
+  })
+
+  it('rejects sparse arrays, invalid children, exotic objects, and cycles', () => {
+    class Exotic {
+      readonly value = 1
+    }
+    class ExoticArray extends Array<number> {}
+    const sparse = new Array<number>(1)
+    const cyclic: Record<string, unknown> = {}
+    cyclic.self = cyclic
+
+    expect(isJsonValue(sparse)).toBe(false)
+    expect(isJsonValue(new ExoticArray(1))).toBe(false)
+    expect(isJsonValue([undefined])).toBe(false)
+    expect(isJsonValue({ value: undefined })).toBe(false)
+    expect(isJsonValue(new Exotic())).toBe(false)
+    expect(isJsonValue(cyclic)).toBe(false)
+  })
+})
diff --git a/packages/core/session/tests/scoped.spec.ts b/packages/core/session/tests/scoped.spec.ts
index ee1e710397..7a5e617254 100644
--- a/packages/core/session/tests/scoped.spec.ts
+++ b/packages/core/session/tests/scoped.spec.ts
@@ -60,6 +60,23 @@ describe('session dispatch carriers', () => {
     bare.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     expect(heard).toEqual(['global:turn/start'])
   })
+
+  it('reuses the captured owner carrier for the paired disposal notification', async () => {
+    const ctx = await mount()
+    const owner = await mintScope(ctx, 'owner')
+    const other = await mintScope(ctx, 'other')
+    const heard: string[] = []
+    ctx.on('session/disposed', (session) => { heard.push(`global:${session.id}`) })
+    owner.ctx.on('session/disposed', (session) => { heard.push(`owner:${session.id}`) })
+    other.ctx.on('session/disposed', (session) => { heard.push(`other:${session.id}`) })
+
+    const session = owner.ctx.sessions.prepare()
+    const detach = owner.ctx.sessions.enter(session)
+    owner.ctx.sessions.announce(session)
+    detach()
+
+    expect(heard).toEqual([`global:${session.id}`, `owner:${session.id}`])
+  })
 })
 
 describe('sessions.flush()', () => {
@@ -91,6 +108,40 @@ describe('sessions.flush()', () => {
     await expect(ctx.sessions.flush(session)).rejects.toThrow('disk full')
   })
 
+  it('does not let a synchronous flush failure starve later listeners', async () => {
+    const ctx = await mount()
+    const flushed: Session[] = []
+    ctx.on('session/flush', () => { throw new Error('disk full') })
+    ctx.on('session/flush', (session) => { flushed.push(session) })
+    const session = ctx.sessions.create()
+
+    await expect(ctx.sessions.flush(session)).rejects.toThrow('disk full')
+    expect(flushed).toEqual([session])
+  })
+
+  it('waits for slower flush listeners before reporting another listener failure', async () => {
+    const ctx = await mount()
+    const gate = Promise.withResolvers<undefined>()
+    let slowStarted = false
+    let settled = false
+    ctx.on('session/flush', () => Promise.reject(new Error('disk full')))
+    ctx.on('session/flush', () => {
+      slowStarted = true
+      return gate.promise
+    })
+    const session = ctx.sessions.create()
+
+    const flushing = ctx.sessions.flush(session)
+    void flushing.finally(() => { settled = true }).catch(() => undefined)
+    await Promise.resolve()
+    expect(slowStarted).toBe(true)
+    expect(settled).toBe(false)
+
+    gate.resolve(undefined)
+    await expect(flushing).rejects.toThrow('disk full')
+    expect(settled).toBe(true)
+  })
+
   it('rejects a never-entered session instead of inventing a carrier', async () => {
     const ctx = await mount()
     const scope = await mintScope(ctx, 'owner')
diff --git a/packages/core/session/tests/session.spec.ts b/packages/core/session/tests/session.spec.ts
index f63353af9b..2204fc9027 100644
--- a/packages/core/session/tests/session.spec.ts
+++ b/packages/core/session/tests/session.spec.ts
@@ -1,8 +1,8 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import { CallId } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SESSION_FORMAT_VERSION, Session, SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
-import type { SessionEventType, TodoItem } from '@deepseek-ai/dsh-session'
+import type { CreateSessionOptions, SessionEventType, SessionHeader, TodoItem } from '@deepseek-ai/dsh-session'
 
 describe('Session', () => {
   it('derives message history from the event log', () => {
@@ -156,7 +156,7 @@ describe('Session', () => {
     const badSeed = [
       { type: 'user/message' as const, seq: 0, time: 1, data: { content: [{ type: 'text' as const, text: 'x' }], source: { kind: 'user' as const }, bad: 1n } },
     ] as unknown as SessionEvent[]
-    expect(() => new Session(SessionId('seed-bad'), badSeed)).toThrow(/non-JSON-serializable/)
+    expect(() => new Session(SessionId('seed-bad'), badSeed)).toThrow(/losslessly JSON-serializable/)
   })
 
   it('validates seed events: rejects a non-contiguous seq', () => {
@@ -177,7 +177,7 @@ describe('Session', () => {
       { type: 'user/message' as const, seq: 1, time: 2, data: { content: [{ type: 'text' as const, text: 'hi' }], source: { kind: 'user' as const } } },
       { type: 'turn/end' as const, seq: 2, time: 3, data: { turn: 1, reason: { kind: 'completed' as const } } },
     ] as SessionEvent[]
-    expect(() => new Session(SessionId('seed-no-marker'), markerlessSeed)).toThrow(/surface-eligible but carries no surfaceOp/)
+    expect(() => new Session(SessionId('seed-no-marker'), markerlessSeed)).toThrow(/requires a surfaceOp marker/)
   })
 
   it('accepts a well-formed contiguous serializable seed', () => {
@@ -190,6 +190,151 @@ describe('Session', () => {
     expect(session.events).toHaveLength(3)
   })
 
+  it('reads each seed array entry once so validation and storage use the same event', () => {
+    const accepted = {
+      type: 'turn/start' as const,
+      seq: 0,
+      time: 1,
+      data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } },
+    }
+    const drifted = { ...accepted, seq: 99, data: { invalid: 1n } }
+    let reads = 0
+    const seed = new Array<SessionEvent>(1)
+    Object.defineProperty(seed, 0, {
+      enumerable: true,
+      get: () => {
+        reads += 1
+        return reads === 1 ? accepted : drifted
+      },
+    })
+
+    const session = new Session(SessionId('seed-entry-snapshot'), seed)
+
+    expect(reads).toBe(1)
+    expect(session.events).toEqual([accepted])
+  })
+
+  it('reads a nested seed-data getter once and stores its first JSON value', () => {
+    let reads = 0
+    const data = Object.defineProperty({}, 'value', {
+      enumerable: true,
+      get: () => {
+        reads += 1
+        return reads === 1 ? 'accepted' : 1n
+      },
+    })
+    const seed = [{ type: 'test/unstable', seq: 0, time: 1, data }] as unknown as SessionEvent[]
+
+    const session = new Session(SessionId('seed-nested-drift'), seed)
+
+    expect(reads).toBe(1)
+    expect(session.events[0]!.data).toEqual({ value: 'accepted' })
+  })
+
+  it('rejects non-JSON surface metadata in a seed event', () => {
+    const seed = [{
+      type: 'user/message',
+      seq: 0,
+      time: 1,
+      data: { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } },
+      surfaceOp: { op: 'replace', start: 1n, end: 2 },
+    }] as unknown as SessionEvent[]
+
+    expect(() => new Session(SessionId('seed-bad-metadata'), seed))
+      .toThrow(/losslessly JSON-serializable/)
+  })
+
+  it('rejects exotic seed metadata before cloning can erase its prototype', () => {
+    class ReplaceOp {
+      readonly op = 'replace' as const
+      readonly start = 0
+      readonly end = 0
+    }
+    const seed = [{
+      type: 'user/message',
+      seq: 0,
+      time: 1,
+      data: { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } },
+      surfaceOp: new ReplaceOp(),
+    }] as unknown as SessionEvent[]
+
+    expect(() => new Session(SessionId('seed-exotic-metadata'), seed))
+      .toThrow(/losslessly JSON-serializable/)
+  })
+
+  it('rejects an exotic seed event shell before spreading erases its prototype', () => {
+    class SeedEvent {
+      readonly type = 'turn/start' as const
+      readonly seq = 0
+      readonly time = 1
+      readonly data = { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } }
+    }
+    const seed: SessionEvent[] = [new SeedEvent()]
+
+    expect(() => new Session(SessionId('seed-exotic-shell'), seed))
+      .toThrow(/not losslessly JSON-serializable/)
+  })
+
+  it('accepts a null-prototype seed event shell as a plain JSON record', () => {
+    const event = Object.assign(Object.create(null) as Record<string, unknown>, {
+      type: 'turn/start' as const,
+      seq: 0,
+      time: 1,
+      data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } },
+    }) as unknown as SessionEvent
+
+    const session = new Session(SessionId('seed-null-prototype'), [event])
+
+    expect(session.events).toEqual([{ ...event }])
+  })
+
+  it('reads a nested seed-metadata getter once and stores its first JSON value', () => {
+    let reads = 0
+    const surfaceOp = Object.defineProperty({ op: 'replace', end: 0 }, 'start', {
+      enumerable: true,
+      get: () => {
+        reads += 1
+        return reads === 1 ? 0 : 1n
+      },
+    })
+    const seed = [{
+      type: 'user/message',
+      seq: 0,
+      time: 1,
+      data: { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } },
+      surfaceOp,
+    }] as unknown as SessionEvent[]
+
+    const session = new Session(SessionId('seed-unstable-metadata'), seed)
+    const event = session.events[0]!
+    if (event.type !== 'user/message') throw new Error('test fixture must remain a user/message')
+
+    expect(reads).toBe(1)
+    expect(event.surfaceOp).toEqual({ op: 'replace', start: 0, end: 0 })
+  })
+
+  it('adds seed context when surface validation throws a non-Error value', () => {
+    const originalHasOwn = Object.hasOwn
+    const hasOwn = vi.spyOn(Object, 'hasOwn').mockImplementation((object: object, property: PropertyKey): boolean => {
+      if ((object as Record<string, unknown>)['op'] === 'replace') throw 'validator failed'
+      return originalHasOwn(object, property)
+    })
+    const seed = [{
+      type: 'user/message',
+      seq: 0,
+      time: 1,
+      data: { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } },
+      surfaceOp: { op: 'replace', start: 0, end: 0 },
+    }] as unknown as SessionEvent[]
+
+    try {
+      expect(() => new Session(SessionId('seed-non-error-metadata-failure'), seed))
+        .toThrow('invalid seed event at index 0: invalid surface metadata')
+    } finally {
+      hasOwn.mockRestore()
+    }
+  })
+
   it('snapshots the seed: mutating the original after construction does not affect session.events', () => {
     const seed = [
       { type: 'turn/start' as const, seq: 0, time: 1, data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } } },
@@ -222,6 +367,261 @@ describe('Session', () => {
     // The returned event carries the same snapshot, not the caller's input.
     expect((event.data.content[0] as { text: string }).text).toBe('original')
   })
+
+  it('reads a nested append-data getter once and stores its first JSON value', () => {
+    const session = new Session(SessionId('append-nested-drift'))
+    let reads = 0
+    const data = Object.defineProperty({}, 'value', {
+      enumerable: true,
+      get: () => {
+        reads += 1
+        return reads === 1 ? 'accepted' : 1n
+      },
+    })
+
+    const event = session.append('todo/write', data as never)
+
+    expect(reads).toBe(1)
+    expect(event.data).toEqual({ value: 'accepted' })
+    expect(session.events).toEqual([event])
+  })
+
+  it('rejects non-JSON surface metadata before appending the event', () => {
+    const session = new Session(SessionId('append-bad-metadata'))
+
+    expect(() => session.append(
+      'user/message',
+      { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } },
+      { surfaceOp: { op: 'replace', start: 1n, end: 2 } } as never,
+    )).toThrow(/non-JSON-serializable surface metadata/)
+    expect(session.events).toEqual([])
+  })
+
+  it('rejects exotic surface metadata before cloning can erase its prototype', () => {
+    class ReplaceOp {
+      readonly op = 'replace' as const
+      readonly start = 0
+      readonly end = 0
+    }
+    const session = new Session(SessionId('append-exotic-metadata'))
+
+    expect(() => session.append(
+      'user/message',
+      { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } },
+      { surfaceOp: new ReplaceOp() },
+    )).toThrow(/non-JSON-serializable surface metadata/)
+    expect(session.events).toEqual([])
+  })
+
+  it('reads a nested append-metadata getter once and stores its first JSON value', () => {
+    const session = new Session(SessionId('append-unstable-metadata'))
+    let reads = 0
+    const surfaceOp = Object.defineProperty({ op: 'replace', end: 0 }, 'start', {
+      enumerable: true,
+      get: () => {
+        reads += 1
+        return reads === 1 ? 0 : 1n
+      },
+    })
+
+    const event = session.append(
+      'user/message',
+      { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } },
+      { surfaceOp } as never,
+    )
+
+    expect(reads).toBe(1)
+    expect(event.surfaceOp).toEqual({ op: 'replace', start: 0, end: 0 })
+    expect(session.events).toEqual([event])
+  })
+
+  it('rejects invalid plain surface metadata shapes at append', () => {
+    const session = new Session(SessionId('append-invalid-surface-shape'))
+    const appendRaw = session.append.bind(session) as unknown as (
+      type: SessionEventType,
+      data: unknown,
+      opts?: unknown,
+    ) => SessionEvent
+    const data = { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }
+
+    expect(() => appendRaw('user/message', data, { surfaceOp: 'invalid' }))
+      .toThrow(/invalid surfaceOp/)
+    expect(() => appendRaw('user/message', data, {
+      surfaceOp: { op: 'replace', start: -1, end: 0 },
+    })).toThrow(/invalid replace surfaceOp/)
+    expect(() => appendRaw('user/message', data, {
+      surfaceOp: 'append',
+      sourceEventSeqs: [0, -1],
+    })).toThrow(/non-negative safe integers/)
+    expect(session.events).toEqual([])
+  })
+
+  it('rejects surface metadata on non-surface append and seed events', () => {
+    const session = new Session(SessionId('non-surface-metadata'))
+    const appendRaw = session.append.bind(session) as unknown as (
+      type: SessionEventType,
+      data: unknown,
+      opts?: unknown,
+    ) => SessionEvent
+
+    expect(() => appendRaw(
+      'turn/start',
+      { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } },
+      { surfaceOp: 'append' },
+    )).toThrow(/not surface-eligible and cannot carry surface metadata/)
+    expect(() => new Session(SessionId('non-surface-metadata-seed'), [{
+      type: 'turn/start',
+      seq: 0,
+      time: 1,
+      data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } },
+      surfaceOp: 'append',
+    } as unknown as SessionEvent])).toThrow(/invalid seed event.*not surface-eligible/)
+    expect(session.events).toEqual([])
+  })
+
+  it('deep-freezes seeded and appended event snapshots', () => {
+    const seeded = new Session(SessionId('seed-frozen'), [{
+      type: 'turn/start',
+      seq: 0,
+      time: 1,
+      data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } },
+    }])
+    const seededEvent = seeded.events[0]!
+    if (seededEvent.type !== 'turn/start') throw new Error('test fixture must remain a turn/start')
+    expect(Object.isFrozen(seededEvent)).toBe(true)
+    expect(Object.isFrozen(seededEvent.data)).toBe(true)
+    expect(Object.isFrozen(seededEvent.data.trigger)).toBe(true)
+    expect(() => { seededEvent.data.turn = 99 }).toThrow(TypeError)
+
+    const appended = new Session(SessionId('append-frozen'))
+    const appendedEvent = appended.append('todo/write', {
+      todos: [{ content: 'first', status: 'pending' }],
+    })
+    expect(Object.isFrozen(appendedEvent)).toBe(true)
+    expect(Object.isFrozen(appendedEvent.data)).toBe(true)
+    expect(Object.isFrozen(appendedEvent.data.todos)).toBe(true)
+    expect(Object.isFrozen(appendedEvent.data.todos[0])).toBe(true)
+    expect(() => { appendedEvent.data.todos[0]!.content = 'mutated' }).toThrow(TypeError)
+  })
+
+  it('returns cached frozen event-array snapshots that do not grow after append', () => {
+    const session = new Session(SessionId('events-snapshot'))
+    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+    const before = session.events
+    const beforeEvent = before[0]!
+    if (beforeEvent.type !== 'turn/start') throw new Error('test fixture must remain a turn/start')
+
+    expect(session.events).toBe(before)
+    expect(Object.isFrozen(before)).toBe(true)
+    expect(() => { (before as SessionEvent[]).push(beforeEvent) }).toThrow(TypeError)
+    expect(() => { beforeEvent.data.turn = 99 }).toThrow(TypeError)
+
+    session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    const after = session.events
+    expect(before).toHaveLength(1)
+    expect(after).toHaveLength(2)
+    expect(after).not.toBe(before)
+    expect(session.events).toBe(after)
+  })
+
+  it('detaches and freezes an explicitly supplied session header', () => {
+    const input = {
+      version: SESSION_FORMAT_VERSION,
+      id: SessionId('header-owned'),
+      createdAt: 123,
+      cwd: '/accepted',
+      parentSession: SessionId('parent'),
+      seedLength: 2,
+    }
+
+    const session = new Session(SessionId('header-owned'), undefined, input)
+    input.cwd = '/caller-mutated'
+
+    expect(session.header).toEqual({
+      version: SESSION_FORMAT_VERSION,
+      id: 'header-owned',
+      createdAt: 123,
+      cwd: '/accepted',
+      parentSession: 'parent',
+      seedLength: 2,
+    })
+    expect(session.header).not.toBe(input)
+    expect(Object.isFrozen(session.header)).toBe(true)
+    expect(Reflect.set(session.header, 'cwd', '/published-mutated')).toBe(false)
+    expect(session.id).toBe('header-owned')
+    expect(session.header.cwd).toBe('/accepted')
+  })
+
+  it('rejects an exotic, non-JSON, or mismatched supplied header', () => {
+    class ExoticHeader implements SessionHeader {
+      readonly version = SESSION_FORMAT_VERSION
+      readonly id = SessionId('header-invalid')
+      readonly createdAt = 123
+    }
+
+    expect(() => new Session(SessionId('header-invalid'), undefined, new ExoticHeader()))
+      .toThrow(/not losslessly JSON-serializable/)
+    expect(() => new Session(SessionId('header-invalid'), undefined, {
+      version: SESSION_FORMAT_VERSION,
+      id: SessionId('header-invalid'),
+      createdAt: 123,
+      parentSession: 1n,
+    } as unknown as SessionHeader)).toThrow(/not losslessly JSON-serializable/)
+    expect(() => new Session(SessionId('header-invalid'), undefined, {
+      version: SESSION_FORMAT_VERSION,
+      id: SessionId('other'),
+      createdAt: 123,
+    })).toThrow(/does not match session id/)
+  })
+
+  it('rejects invalid scalar fields in an explicitly supplied header', () => {
+    const base = {
+      version: SESSION_FORMAT_VERSION,
+      id: SessionId('header-shape'),
+      createdAt: 123,
+    }
+    const cases: Array<{ header: unknown; error: RegExp }> = [
+      { header: 1, error: /not a plain JSON record/ },
+      { header: null, error: /not a plain JSON record/ },
+      { header: { ...base, version: 1 }, error: /header version/ },
+      { header: { ...base, createdAt: '123' }, error: /createdAt must be a finite number/ },
+      { header: { ...base, cwd: 1 }, error: /header cwd must be a string/ },
+      { header: { ...base, cwd: 'relative' }, error: /header cwd must be an absolute path/ },
+      { header: { ...base, parentSession: 1 }, error: /header parentSession must be a string/ },
+      { header: { ...base, seedLength: '1' }, error: /seedLength must be a non-negative safe integer/ },
+      { header: { ...base, seedLength: 0.5 }, error: /seedLength must be a non-negative safe integer/ },
+      { header: { ...base, seedLength: -1 }, error: /seedLength must be a non-negative safe integer/ },
+    ]
+
+    for (const { header, error } of cases) {
+      expect(() => new Session(SessionId('header-shape'), undefined, header as SessionHeader)).toThrow(error)
+    }
+  })
+
+  it('rejects seed records with invalid fixed-envelope fields', () => {
+    const base = {
+      type: 'turn/start',
+      seq: 0,
+      time: 1,
+      data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } },
+    }
+    const cases: unknown[] = [
+      { ...base, extra: true },
+      { ...base, type: 1 },
+      { ...base, seq: '0' },
+      { ...base, seq: 0.5 },
+      { ...base, seq: -1 },
+      { ...base, time: '1' },
+      { ...base, time: 0.5 },
+      { ...base, time: -1 },
+      { type: base.type, seq: base.seq, time: base.time },
+    ]
+
+    for (const [index, event] of cases.entries()) {
+      expect(() => new Session(SessionId(`bad-envelope-${index}`), [event as SessionEvent]))
+        .toThrow(/invalid event envelope/)
+    }
+  })
 })
 
 
@@ -238,6 +638,10 @@ describe('SessionStore', () => {
     const session = ctx.sessions.create()
     expect(created).toEqual([session])
 
+    // The store-owned append publication hooks are module-private. A JavaScript caller
+    // may create an unrelated property with the old implementation's name,
+    // but cannot suppress the durable event feed.
+    expect(Reflect.set(session, 'onAppend', undefined)).toBe(true)
     session.append('user/message', { content: [{ type: 'text', text: 'x' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
     expect(events).toHaveLength(1)
     expect(events[0]![0]).toBe(session)
@@ -293,6 +697,93 @@ describe('SessionStore', () => {
     expect(ctx.sessions.get(SessionId('lifecycle'))).toBeUndefined()
   })
 
+  it('prevents simultaneous attachment of one session object to two stores', async () => {
+    const firstCtx = new Context()
+    const secondCtx = new Context()
+    await firstCtx.plugin(SessionStore)
+    await secondCtx.plugin(SessionStore)
+    const session = new Session(SessionId('owned-key'))
+    const detachFirst = firstCtx.sessions.enter(session)
+
+    expect(() => secondCtx.sessions.enter(session)).toThrow(/already attached to a store/)
+    expect(firstCtx.sessions.get(SessionId('owned-key'))).toBe(session)
+
+    detachFirst()
+    expect(firstCtx.sessions.get(SessionId('owned-key'))).toBeUndefined()
+    const detachSecond = secondCtx.sessions.enter(session)
+    expect(secondCtx.sessions.get(SessionId('owned-key'))).toBe(session)
+    detachSecond()
+
+  })
+
+  it('rejects direct and reentrant repeat announcements to preserve one lifecycle pair', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    let created = 0
+    let disposed = 0
+    let reentrantError = ''
+    ctx.on('session/created', (session) => {
+      created += 1
+      try {
+        ctx.sessions.announce(session)
+      } catch (error: unknown) {
+        reentrantError = String(error)
+      }
+    })
+    ctx.on('session/disposed', () => { disposed += 1 })
+
+    const session = ctx.sessions.prepare(SessionId('once'))
+    const detach = ctx.sessions.enter(session)
+    ctx.sessions.announce(session)
+    expect(reentrantError).toMatch(/already announced/)
+    expect(() => { ctx.sessions.announce(session) }).toThrow(/already announced/)
+    detach()
+    expect({ created, disposed }).toEqual({ created: 1, disposed: 1 })
+  })
+
+  it('defers a reentrant detach until the creation dispatch unwinds', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const order: string[] = []
+    const session = ctx.sessions.prepare(SessionId('reentrant-detach'))
+    const detach = ctx.sessions.enter(session)
+
+    ctx.on('session/created', (created) => {
+      order.push('created:first')
+      detach()
+      expect(ctx.sessions.get(created.id)).toBe(created)
+    })
+    ctx.on('session/created', (created) => {
+      order.push('created:second')
+      expect(ctx.sessions.get(created.id)).toBe(created)
+    })
+    ctx.on('session/disposed', (disposed) => {
+      order.push('disposed')
+      expect(ctx.sessions.get(disposed.id)).toBeUndefined()
+    })
+
+    ctx.sessions.announce(session)
+
+    expect(order).toEqual(['created:first', 'created:second', 'disposed'])
+    expect(ctx.sessions.get(session.id)).toBeUndefined()
+    detach()
+  })
+
+  it('rolls back create when its owner unloads from session/created', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    let ownerCtx!: Context
+    const owner = await ctx.plugin(Object.assign((inner: Context) => { ownerCtx = inner }, { inject: ['sessions'] }))
+    const id = SessionId('create-unload-race')
+    ctx.on('session/created', (session) => {
+      if (session.id === id) void owner.dispose()
+    })
+
+    ownerCtx.sessions.create(id)
+    await owner.dispose()
+    expect(ctx.sessions.get(id)).toBeUndefined()
+  })
+
   it('synthesizes a minimal current-version header for a bare-created session', async () => {
     const ctx = new Context()
     await ctx.plugin(SessionStore)
@@ -317,6 +808,26 @@ describe('SessionStore', () => {
     })
   })
 
+  it('rejects non-JSON and invalid scalar session metadata', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const cases: Array<{ meta: unknown; error: RegExp }> = [
+      { meta: { parentSession: 1n }, error: /header is not losslessly JSON-serializable/ },
+      { meta: { cwd: 1 }, error: /header cwd must be a string/ },
+      { meta: { parentSession: 1 }, error: /header parentSession must be a string/ },
+      { meta: { createdAt: '123' }, error: /header createdAt must be a finite number/ },
+      { meta: { seedLength: '1' }, error: /seedLength must be a non-negative safe integer/ },
+      { meta: { seedLength: 0.5 }, error: /seedLength must be a non-negative safe integer/ },
+      { meta: { seedLength: -1 }, error: /seedLength must be a non-negative safe integer/ },
+    ]
+
+    for (const [index, { meta, error }] of cases.entries()) {
+      expect(() => ctx.sessions.prepare(SessionId(`bad-meta-${index}`), {
+        meta: meta as NonNullable<CreateSessionOptions['meta']>,
+      })).toThrow(error)
+    }
+  })
+
   it('rejects a non-absolute meta.cwd', async () => {
     const ctx = new Context()
     await ctx.plugin(SessionStore)
@@ -351,11 +862,13 @@ describe('SessionStore', () => {
     expect(observed).toBe(0)
   })
 
-  it('rolls back the session (and onAppend) when a session/created listener throws (P1-1)', async () => {
+  it('pairs a partial session/created announcement with disposal during rollback', async () => {
     const ctx = new Context()
     await ctx.plugin(SessionStore)
 
     let threw = false
+    const disposed: Session[] = []
+    ctx.on('session/disposed', (session) => { disposed.push(session) })
     ctx.on('session/created', () => {
       if (!threw) { threw = true; throw new Error('boom created listener') }
     })
@@ -363,9 +876,10 @@ describe('SessionStore', () => {
     // The throwing emit must roll the store entry back, not leak it.
     expect(() => ctx.sessions.create(SessionId('fixed'))).toThrow('boom created listener')
     expect(ctx.sessions.get(SessionId('fixed'))).toBeUndefined() // rolled back, not leaked
+    expect(disposed.map(session => session.id)).toEqual(['fixed'])
 
     // A subsequent create of the SAME id succeeds (the already-exists check is
-    // not wedged) and its onAppend is correctly wired (events observable).
+    // not wedged) and its store-owned publication hooks are correctly wired.
     const events: SessionEvent[] = []
     ctx.on('session/event', (_session, event) => void events.push(event))
     const session = ctx.sessions.create(SessionId('fixed'))
@@ -373,6 +887,243 @@ describe('SessionStore', () => {
     session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
     expect(events).toHaveLength(1)
   })
+
+  it('contains session/event observer failures after the append commit point', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const session = ctx.sessions.create(SessionId('contained-event'))
+    const heard: SessionEvent[] = []
+    let committedBeforeNotify = false
+    ctx.on('session/event', (observedSession, event) => {
+      committedBeforeNotify = observedSession.events.at(-1) === event
+      throw new Error('sync event observer')
+    })
+    ctx.on('session/event', () => Promise.reject(new Error('async event observer')) as never)
+    ctx.on('session/event', (_observedSession, event) => { heard.push(event) })
+
+    let appended!: SessionEvent
+    expect(() => {
+      appended = session.append('turn/start', {
+        turn: 1,
+        trigger: { kind: 'message', source: { kind: 'user' } },
+      })
+    }).not.toThrow()
+    expect(committedBeforeNotify).toBe(true)
+    expect(session.events).toEqual([appended])
+    expect(heard).toEqual([appended])
+    await Promise.resolve()
+    await Promise.resolve()
+
+    expect(warnings).toEqual([
+      'session "contained-event": session/event listener threw: Error: sync event observer',
+      'session "contained-event": session/event listener rejected: Error: async event observer',
+    ])
+  })
+
+  it('runs internal dispatch validation on one frozen candidate before commit and resets after a veto', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const session = ctx.sessions.create(SessionId('dispatch-veto'))
+    const validations: Array<{ event: SessionEvent; logLength: number; frozen: boolean }> = []
+    const observed: SessionEvent[] = []
+    let reject = true
+    ctx.on('internal/dispatch', (_mode, name, args) => {
+      if (name !== 'session/event') return
+      const [observedSession, event] = args as [Session, SessionEvent]
+      validations.push({
+        event,
+        logLength: observedSession.events.length,
+        frozen: Object.isFrozen(event) && Object.isFrozen(event.data),
+      })
+      if (reject) {
+        reject = false
+        throw new Error('reject first candidate')
+      }
+    })
+    ctx.on('session/event', (_observedSession, event) => { observed.push(event) })
+
+    expect(() => session.append('turn/start', {
+      turn: 1,
+      trigger: { kind: 'message', source: { kind: 'user' } },
+    })).toThrow('reject first candidate')
+    expect(session.events).toEqual([])
+    expect(observed).toEqual([])
+
+    const appended = session.append('turn/start', {
+      turn: 1,
+      trigger: { kind: 'message', source: { kind: 'user' } },
+    })
+    expect(validations.map(({ logLength, frozen }) => ({ logLength, frozen }))).toEqual([
+      { logLength: 0, frozen: true },
+      { logLength: 0, frozen: true },
+    ])
+    expect(validations.map(({ event }) => event.seq)).toEqual([0, 0])
+    expect(validations[1]!.event).toBe(appended)
+    expect(session.events).toEqual([appended])
+    expect(observed).toEqual([appended])
+  })
+
+  it('resolves session/event dispatch before commit so instrumentation failure cannot hide a logged event', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const session = ctx.sessions.create(SessionId('dispatch-check'))
+    const observed: SessionEvent[] = []
+    ctx.on('internal/dispatch', (_mode, name) => {
+      if (name === 'session/event') throw new Error('dispatch instrumentation rejected the carrier')
+    })
+    ctx.on('session/event', (_observedSession, event) => { observed.push(event) })
+
+    expect(() => session.append('turn/start', {
+      turn: 1,
+      trigger: { kind: 'message', source: { kind: 'user' } },
+    })).toThrow('dispatch instrumentation rejected the carrier')
+    expect(session.events).toEqual([])
+    expect(observed).toEqual([])
+  })
+
+  it('contains a reentrant observer append without reordering later observers', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const session = ctx.sessions.create(SessionId('reentrant-observer'))
+    const heard: SessionEvent[] = []
+    ctx.on('session/event', (observedSession) => {
+      observedSession.append('todo/write', { todos: [] })
+    })
+    ctx.on('session/event', (_observedSession, event) => { heard.push(event) })
+
+    const appended = session.append('turn/start', {
+      turn: 1,
+      trigger: { kind: 'message', source: { kind: 'user' } },
+    })
+    expect(session.events).toEqual([appended])
+    expect(heard).toEqual([appended])
+    expect(warnings).toEqual([
+      'session "reentrant-observer": session/event listener threw: Error: session append cannot reenter while another append is being published',
+    ])
+  })
+
+  it('defers detach through dispatch resolution, commit, and observer publication', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const order: string[] = []
+    const session = ctx.sessions.prepare(SessionId('detach-during-append'))
+    const detach = ctx.sessions.enter(session)
+    ctx.on('internal/dispatch', (_mode, name, args) => {
+      if (name !== 'session/event') return
+      const session = args[0] as Session
+      order.push(`resolve:${ctx.sessions.get(session.id) === session ? 'live' : 'detached'}`)
+      detach()
+    })
+    ctx.on('session/event', (session) => {
+      order.push(`observe:${ctx.sessions.get(session.id) === session ? 'live' : 'detached'}`)
+    })
+    ctx.on('session/disposed', (session) => {
+      order.push(`dispose:${ctx.sessions.get(session.id) === session ? 'live' : 'detached'}`)
+    })
+    ctx.sessions.announce(session)
+
+    const appended = session.append('turn/start', {
+      turn: 1,
+      trigger: { kind: 'message', source: { kind: 'user' } },
+    })
+
+    expect(session.events).toEqual([appended])
+    expect(order).toEqual(['resolve:live', 'observe:live', 'dispose:detached'])
+    expect(ctx.sessions.get(session.id)).toBeUndefined()
+  })
+
+  it('observes async session/created rejection without rolling back or starving peers', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const heard: string[] = []
+    ctx.on('session/created', () => Promise.reject(new Error('late creation failure')) as never)
+    ctx.on('session/created', (session) => { heard.push(session.id) })
+
+    const session = ctx.sessions.create(SessionId('async-created'))
+    await Promise.resolve()
+    await Promise.resolve()
+
+    expect(ctx.sessions.get(session.id)).toBe(session)
+    expect(heard).toEqual(['async-created'])
+    expect(warnings).toEqual([
+      'session "async-created": session/created listener rejected: Error: late creation failure',
+    ])
+  })
+
+  it('contains synchronous and async session/disposed listener failures per observer', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const heard: string[] = []
+    ctx.on('session/disposed', () => { throw new Error('sync disposed') })
+    ctx.on('session/disposed', () => Promise.reject(new Error('async disposed')) as never)
+    ctx.on('session/disposed', (session) => { heard.push(session.id) })
+
+    const unannounced = ctx.sessions.prepare(SessionId('never-announced'))
+    const detachUnannounced = ctx.sessions.enter(unannounced)
+    detachUnannounced()
+    expect(heard).toEqual([])
+
+    const announced = ctx.sessions.prepare(SessionId('contained-disposal'))
+    const detach = ctx.sessions.enter(announced)
+    ctx.sessions.announce(announced)
+    expect(() => { detach() }).not.toThrow()
+    await Promise.resolve()
+    await Promise.resolve()
+
+    expect(heard).toEqual(['contained-disposal'])
+    expect(warnings).toEqual([
+      'session "contained-disposal": session/disposed listener threw: Error: sync disposed',
+      'session "contained-disposal": session/disposed listener rejected: Error: async disposed',
+    ])
+  })
+
+  it('contains internal dispatch failure after session detachment', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const heard: Session[] = []
+    ctx.on('internal/dispatch', (_mode, name) => {
+      if (name === 'session/disposed') throw new Error('disposed dispatch instrumentation')
+    })
+    ctx.on('session/disposed', (session) => { heard.push(session) })
+    const session = ctx.sessions.prepare(SessionId('disposed-dispatch'))
+    const detach = ctx.sessions.enter(session)
+    ctx.sessions.announce(session)
+
+    expect(() => { detach() }).not.toThrow()
+    expect(ctx.sessions.get(session.id)).toBeUndefined()
+    expect(heard).toEqual([])
+    expect(warnings).toEqual([
+      'session "disposed-dispatch": session/disposed dispatch threw: Error: disposed dispatch instrumentation',
+    ])
+  })
+
+  it('does not let internal dispatch replace the disposed callback tuple', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const replacement = new Session(SessionId('replacement-disposed'))
+    const heard: Session[] = []
+    ctx.on('internal/dispatch', (_mode, name, args) => {
+      if (name === 'session/disposed') args[0] = replacement
+    })
+    ctx.on('session/disposed', (session) => { heard.push(session) })
+    const session = ctx.sessions.prepare(SessionId('fixed-disposed-tuple'))
+    const detach = ctx.sessions.enter(session)
+    ctx.sessions.announce(session)
+
+    detach()
+
+    expect(heard).toEqual([session])
+  })
 })
 
 describe('todo/write event', () => {
diff --git a/packages/core/system-prompt/README.md b/packages/core/system-prompt/README.md
index a3d4c0bc24..9b8bde0a66 100644
--- a/packages/core/system-prompt/README.md
+++ b/packages/core/system-prompt/README.md
@@ -1,6 +1,6 @@
 # dsh-system-prompt
 
-System prompt assembly registry. Plugins contribute ordered text sections, tool-schema providers, named prompt variables, and authoritative named protections; the agent loop calls `assemble(context)` once per step, and `renderPrompt(assembly)` is the full system prompt the model sees. The plugin registers the harness-owned openers itself — the static `harness:identity` section and the deployment's `deployment:persona` section — so they exist for every agent regardless of which loop plugin drives it.
+System prompt assembly registry. Plugins contribute ordered text sections, tool-schema providers, and named prompt variables; contributions that implement required protocol may declare themselves owner-final. The agent loop calls `assemble(context)` once per step, and `renderPrompt(assembly)` is the full system prompt the model sees. The plugin registers the harness-owned openers itself — the static `harness:identity` section and the deployment's `deployment:persona` section — so they exist for every agent regardless of which loop plugin drives it.
 
 ## Config
 
@@ -13,22 +13,20 @@ System prompt assembly registry. Plugins contribute ordered text sections, tool-
 
 ### Public API
 
-- `ctx.systemPrompt.section(section: PromptSection): () => Promise<void> | void` Contribute a section. The registry snapshots `name`, `order`, and the text value/callback, so later caller-object mutation cannot rename a stored section. The layer is the CALLING context's scope: `agent.ctx` contributes to that agent alone, SHADOWING a same-named global section there (the per-agent persona mechanism — a scoped `deployment:persona`). Duplicate names within one layer throw, and a globally protected section name cannot be shadowed. Disposed with the calling fiber.
-- `ctx.systemPrompt.tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise<void> | void` Contribute tool schemas, evaluated at each assembly with that assembly's context. `ToolProviderResult` = `{ schemas, knownNames? }`: `schemas` is the post-restriction visible set for `context.scope`; `knownNames` (defaulting to the schemas' names) is the pre-restriction universe `toolOrder` validates against. A provider must not return a schema named `TOOL_ORDER_REST`. Scoped providers are consulted only for their scope's assemblies. Disposed with the calling fiber.
-- `ctx.systemPrompt.variable(name: string, provider: (context) => string | undefined): () => Promise<void> | void` Contribute a prompt variable, referenced from section text as `{{name}}`. Scoped variables (via `agent.ctx`) shadow a same-named global for that agent. Duplicate-in-layer or unreferenceable names throw; `undefined` means "no value for this assembly". Disposed with the calling fiber.
-- `ctx.systemPrompt.protect(protection: PromptProtection): () => Promise<void> | void` Make named section/tool contributions authoritative after the assembly waterfall. Protection restores canonical registry/provider presence and definition; restored entries keep canonical order with one another and anchor before their first surviving later unprotected canonical neighbor (or at the end), without undoing listener reordering of unprotected entries. Canonical absence is authoritative too, so a mode-hidden tool cannot be fabricated by a listener. Calling through `agent.ctx` protects only that agent's assemblies. A global section protection additionally reserves its name against scoped shadows; registering either side of that conflict fails loudly instead of treating the shadow as canonical. Inputs are snapshotted, empty protections throw, and disposal removes the protection.
-- `ctx.systemPrompt.assemble(context?: AssembleContext): Promise<PromptAssembly>` Assemble the prompt for one caller: the global layer merged with `context.scope`'s layer (scoped shadows global). Runs through the scope-filtered `system-prompt/assemble` waterfall, then restores protected contributions from the pre-waterfall canonical assembly. Rejects when a configured `toolOrder` names a tool outside the providers' `knownNames` universe (a restricted-away KNOWN tool is a normal absence), or when a provider returns the reserved rest-entry name.
+- `ctx.systemPrompt.section(section: PromptSection): () => Promise<void> | void` Contribute a section. The layer is the calling context's scope: `agent.ctx` contributes to that agent alone, shadowing a same-named global section there. Duplicate names within one layer and non-finite orders throw. `ownerFinal: true` restores this section's canonical definition after the complete waterfall and reserves a global section against scoped shadows. Disposed with the calling fiber.
+- `ctx.systemPrompt.tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise<void> | void` Contribute tool schemas, evaluated at each assembly with that assembly's context. `ToolProviderResult` = `{ schemas, knownNames?, ownerFinalNames? }`: `schemas` is the post-restriction visible set; `knownNames` is the pre-restriction universe used by `toolOrder`; `ownerFinalNames` makes those tools' canonical presence or absence survive the waterfall. A provider must not return a schema named `TOOL_ORDER_REST`. Scoped providers are consulted only for their scope's assemblies. Disposed with the calling fiber.
+- `ctx.systemPrompt.variable(name: string, provider: (context) => string | undefined): () => Promise<void> | void` Contribute a prompt variable, referenced from section text as `{{name}}`. Scoped variables shadow a same-named global for that agent. Duplicate-in-layer or unreferenceable names throw; `undefined` means "no value for this assembly". Disposed with the calling fiber.
+- `ctx.systemPrompt.assemble(context?: AssembleContext): Promise<PromptAssembly>` Assemble the prompt for one caller: the global layer merged with `context.scope`'s layer, with tool schemas detached before the transform seam. Runs through the scope-filtered `system-prompt/assemble` waterfall, then restores owner-final contributions from a private pre-waterfall snapshot. Restored entries keep canonical relative order without undoing listener reordering of ordinary entries. Rejects when a configured `toolOrder` names a tool outside the providers' `knownNames` universe, or when a provider returns the reserved rest-entry name.
 
 ### Live events
 
-Prompt assembly is the scope-filtered transformable seam; registry change is the deliberately unfiltered notification that an assembly input changed, possibly for one scope. Exact signatures, dispatch modes, and filtering contracts live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md). Named protections apply only after a successful assembly waterfall returns and are owned by the service rather than represented as another event listener.
+Prompt assembly is the scope-filtered transformable seam; registry change is the deliberately unfiltered notification that an assembly input changed, possibly for one scope. Exact signatures, dispatch modes, and filtering contracts live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md). Owner-final restoration applies only after a successful assembly waterfall returns.
 
 ### Key types
 
 - `AssembleContext` — what one `assemble()` call is FOR. Merge-extensible; declares `scope?: ScopeKey` (the layer selector) here, and `dsh-agent` declares `agent?: Agent` (the typed DX field — never set without `scope`; use `assembleContextFor(agent)`). Providers must tolerate absent fields (a bare `assemble()` carries an empty, scope-less context).
-- `PromptSection` — `{ name, order, text: string | ((context) => string) }`. Sections are concatenated in ascending `order`. Order bands: `-100` is the harness identity, `0` the deployment persona (both registered by this plugin), tool guidance uses `100–199`; other negative orders also render before the persona.
+- `PromptSection` — `{ name, order, text, ownerFinal? }`. Sections are concatenated in ascending `order`; `ownerFinal` is reserved for required protocol instructions. Order bands: `-100` is the harness identity, `0` the deployment persona, tool guidance uses `100–199`.
 - `PromptAssembly` — `{ sections: AssembledSection[], tools: ToolSchema[], variables: Record<string, string | undefined> }`. Section texts arrive resolved but not yet interpolated; `variables` holds every registered variable resolved against the context. Tool schemas are part of the assembly by design: "what the model is told it can do" is one coherent thing, even though adapters transmit schemas as a separate wire field.
-- `PromptProtection` — `{ sections?: readonly string[], tools?: readonly string[] }`. Named contributions whose canonical pre-waterfall state is restored after all listeners; protections compose by set union rather than callback order, and global section names are reserved against scoped shadows.
 - `renderPrompt(assembly)` — interpolates `{{variable}}` references in each section, drops empty sections, joins with blank lines. STRICT: an unknown reference (`Object.hasOwn` lookup — prototype names like `{{constructor}}` are unknown), a registered-but-valueless reference, a malformed complete `{{…}}` group, or a `{{` that opens no complete group while a `}}` still follows (`{{{model}}}`) throws — fail loud beats shipping a malformed prompt. A lone `{{` with no `}}` anywhere after it passes through verbatim; substituted values are never re-scanned.
 
 Merge-extensible: plugins can declare extra fields on `PromptAssembly` and `AssembleContext` via declaration merging.
@@ -39,7 +37,7 @@ Merge-extensible: plugins can declare extra fields on `PromptAssembly` and `Asse
 - Variable providers: the agent loop registers `model` and `cwd`; any plugin can register the facts it owns (a future `date`, git state, …).
 - Tool schema providers: `ToolRegistry` registers itself as a tool provider automatically.
 - The `system-prompt/assemble` waterfall: mutate or replace the assembly per caller (dynamic tool filtering, extra variables).
-- `systemPrompt.protect()`: reserve canonical section/tool contributions for invariants that ordinary waterfall listeners must not be able to remove or replace.
+- Owner-final contributions: protocol owners declare finality on the section or tool contribution itself; there is no independent protection registry.
 
 Design rationale: [the prompt-variables RFC](../../../docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md).
 
diff --git a/packages/core/system-prompt/src/index.ts b/packages/core/system-prompt/src/index.ts
index 6d3ed3af58..b1946c59e1 100644
--- a/packages/core/system-prompt/src/index.ts
+++ b/packages/core/system-prompt/src/index.ts
@@ -1,8 +1,8 @@
 /**
  * System prompt assembly registry. Plugins contribute ordered text sections,
- * tool schema providers, named prompt variables, and authoritative named
- * protections; `assemble(context)` collates them through a waterfall that
- * runs once per step, restores protected contributions, and `renderPrompt`
+ * tool schema providers, and named prompt variables; protocol contributions
+ * may declare themselves owner-final. `assemble(context)` collates them through a waterfall that
+ * runs once per step, restores owner-final contributions, and `renderPrompt`
  * interpolates `{{variable}}` references into the final text.
  *
  * The harness-owned prompt openers live here too: this plugin registers the
@@ -44,7 +44,7 @@ declare module 'cordis' {
      */
     'system-prompt/assemble'(this: Scoped<SystemPrompt>, assembly: PromptAssembly, context: AssembleContext, next: () => Promise<PromptAssembly>): Promise<PromptAssembly>
     /**
-     * A section, tool provider, variable provider, or protection was registered
+     * A section, tool provider, or variable provider was registered
      * or unregistered (the assembly inputs changed — possibly for one scope
      * only). An UNFILTERED registry-subject notification, deliberately not
      * scope-filtered dispatch: a global change concerns every agent's next
@@ -80,19 +80,25 @@ export interface AssembleContext {
 /** One contributed section of the system prompt (registry input). */
 export interface PromptSection {
   /** Unique name — a duplicate registration throws (see {@link SystemPrompt.section}). */
-  name: string
+  readonly name: string
   /**
    * Sections are concatenated in ascending order. Convention: `-100` is the
    * harness identity, `0` the deployment persona, tool guidance uses 100–199;
    * other negative orders also render before the persona.
    */
-  order: number
+  readonly order: number
   /**
    * Static text or a provider evaluated at each assembly with that assembly's
    * {@link AssembleContext}. The text may reference `{{variable}}`s — they are
    * interpolated later, by {@link renderPrompt}.
    */
-  text: string | ((context: AssembleContext) => string)
+  readonly text: string | ((context: AssembleContext) => string)
+  /**
+   * Whether this section's canonical presence and definition survive the
+   * complete assembly waterfall. Use this only for owner-required protocol
+   * instructions; ordinary sections remain transformable.
+   */
+  readonly ownerFinal?: boolean
 }
 
 /** One section of an assembly: {@link PromptSection} with its text resolved. */
@@ -117,30 +123,15 @@ export interface AssembledSection {
  */
 export interface ToolProviderResult {
   /** The schemas this provider contributes to THIS assembly. */
-  schemas: ToolSchema[]
+  readonly schemas: readonly ToolSchema[]
   /** The pre-restriction name universe for config validation (defaults to `schemas`' names). */
-  knownNames?: readonly string[]
-}
-
-/**
- * Canonical prompt contributions that survive the assembly waterfall.
- *
- * Protection is declarative by contribution name rather than an ordered
- * callback: after every `system-prompt/assemble` listener has finished, the
- * service restores each protected name to the exact presence and definition
- * produced by its registries before the waterfall. Restored entries keep
- * canonical order with one another and anchor before their first surviving
- * later unprotected canonical neighbor (or at the end); the service does not
- * undo a listener's reordering of unprotected entries. A name absent from that
- * canonical assembly is removed from the result. This makes mode-dependent
- * absence protectable too (for example, a native tool that intentionally stays
- * off the wire in Code Mode).
- */
-export interface PromptProtection {
-  /** Section names whose canonical registry output is authoritative. */
-  sections?: readonly string[]
-  /** Tool names whose canonical provider output is authoritative. */
-  tools?: readonly string[]
+  readonly knownNames?: readonly string[]
+  /**
+   * Tool names this provider owns finally. The names need not be present in
+   * `schemas`: naming a mode-hidden tool makes its canonical absence final, so
+   * an assembly listener cannot fabricate it onto the wire.
+   */
+  readonly ownerFinalNames?: readonly string[]
 }
 
 /**
@@ -233,24 +224,26 @@ function orderTools(tools: ToolSchema[], toolOrder: string[] | undefined, knownN
     name === TOOL_ORDER_REST ? rest : tools.filter(tool => tool.name === name))
 }
 
-/** Restore protected named entries from `canonical`, anchored before their next unprotected canonical neighbor. */
-function restoreProtected<T extends { name: string }>(
-  canonical: readonly T[], result: readonly T[], protectedNames: ReadonlySet<string>,
+/** Restore owner-final entries from `canonical`, anchored before their next ordinary canonical neighbor. */
+function restoreOwnerFinal<T extends { name: string }>(
+  canonical: readonly T[], result: readonly T[], ownerFinalNames: ReadonlySet<string>,
 ): T[] {
-  const restored = result.filter(entry => !protectedNames.has(entry.name))
+  const restored = result.filter(entry => !ownerFinalNames.has(entry.name))
   for (const [index, entry] of canonical.entries()) {
-    if (!protectedNames.has(entry.name)) continue
+    if (!ownerFinalNames.has(entry.name)) continue
     // Protected entries are inserted in canonical order. Anchor each one
     // before the first later UNPROTECTED canonical neighbor that survived the
     // waterfall; if none survived, it belongs at the end. Looking only at
-    // unprotected neighbors avoids reversing adjacent protected entries.
+    // ordinary neighbors avoids reversing adjacent owner-final entries.
     const following = new Set(
       canonical.slice(index + 1)
-        .filter(candidate => !protectedNames.has(candidate.name))
+        .filter(candidate => !ownerFinalNames.has(candidate.name))
         .map(candidate => candidate.name),
     )
     const next = restored.findIndex(candidate => following.has(candidate.name))
-    restored.splice(next < 0 ? restored.length : next, 0, structuredClone(entry))
+    // `canonical` is an owned snapshot made before the waterfall; no second
+    // clone is needed when moving its entries into the finalized assembly.
+    restored.splice(next < 0 ? restored.length : next, 0, entry)
   }
   return restored
 }
@@ -371,8 +364,8 @@ function interpolate(section: AssembledSection, variables: Record<string, string
 
 /**
  * Registry service (`ctx.systemPrompt`): plugins contribute ordered text
- * sections, tool-schema providers, named prompt variables, and authoritative
- * contribution protections; the agent loop calls `assemble(context)` once per
+ * sections, tool-schema providers, named prompt variables, and owner-final
+ * contributions; the agent loop calls `assemble(context)` once per
  * step. Registers the harness-owned `harness:identity` and
  * `deployment:persona` sections itself (see {@link Config.persona}).
  */
@@ -391,12 +384,10 @@ export class SystemPrompt extends Service {
   private sections: PromptSection[] = []
   private toolProviders: ((context: AssembleContext) => ToolProviderResult)[] = []
   private variableProviders = new Map<string, (context: AssembleContext) => string | undefined>()
-  private protections: PromptProtection[] = []
   /** Per-scope layers (`@deepseek-ai/dsh-scope`); entries drop when a layer empties, so a disposed scope leaves no residue. */
   private scopedSections = new Map<ScopeKey, PromptSection[]>()
   private scopedToolProviders = new Map<ScopeKey, ((context: AssembleContext) => ToolProviderResult)[]>()
   private scopedVariableProviders = new Map<ScopeKey, Map<string, (context: AssembleContext) => string | undefined>>()
-  private scopedProtections = new Map<ScopeKey, PromptProtection[]>()
   private readonly toolOrder: string[] | undefined
 
   constructor(ctx: Context, public config: Config) {
@@ -429,12 +420,11 @@ export class SystemPrompt extends Service {
    * scoped context (`agent.ctx`) contributes to that scope alone — and a
    * scoped section SHADOWS a same-named global section for that scope's
    * assemblies (most-specific-wins; this is how a per-agent persona overrides
-   * `deployment:persona`) unless that global name is protected: global
-   * protection reserves its section name against scoped shadows so the
+   * `deployment:persona`) unless that global contribution is owner-final: it
+   * reserves its section name against scoped shadows so the
    * registration owner—not a later scope—defines the canonical value. The
-   * registry snapshots `name`, `order`, and `text` before checking/storing, so
-   * later caller-object mutation cannot rename a contribution. Throws
-   * if the SAME layer already has the name (a
+   * readonly typed contribution is borrowed until disposal; only the semantic
+   * finite-order rule is checked at runtime. Throws if the SAME layer already has the name (a
    * duplicate would silently double prompt text — e.g. a double-loaded tool
    * plugin; the global-duplicate message names `agent.ctx` as the per-agent
    * alternative). Removed when the calling fiber is disposed. Emits
@@ -445,14 +435,20 @@ export class SystemPrompt extends Service {
    *   yield it directly — exact identity nests the teardown in order.
    */
   section(section: PromptSection): () => Promise<void> | void {
-    const scope = scopeOf(this.ctx)
-    const snapshot: PromptSection = {
-      name: section.name,
-      order: section.order,
-      text: section.text,
+    if (!Number.isFinite(section.order)) {
+      throw new TypeError(`prompt section "${section.name}" order must be a finite number`)
     }
-    if (scope !== undefined && this.protections.some(record => record.sections?.includes(snapshot.name))) {
-      throw new Error(`prompt section "${snapshot.name}" is globally protected and cannot be shadowed in an agent scope`)
+    const scope = scopeOf(this.ctx)
+    if (scope !== undefined
+      && this.sections.some(global => global.name === section.name && global.ownerFinal === true)) {
+      throw new Error(`prompt section "${section.name}" is globally owner-final and cannot be shadowed in an agent scope`)
+    }
+    if (scope === undefined && section.ownerFinal === true) {
+      const hasScopedShadow = [...this.scopedSections.values()]
+        .some(layer => layer.some(scoped => scoped.name === section.name))
+      if (hasScopedShadow) {
+        throw new Error(`owner-final prompt section "${section.name}" cannot be registered while a scoped shadow exists`)
+      }
     }
     const dispose = this.ctx.effect(function* (this: SystemPrompt) {
       const layer = scope === undefined
@@ -462,18 +458,18 @@ export class SystemPrompt extends Service {
           this.scopedSections.set(scope, created)
           return created
         })()
-      if (layer.some(existing => existing.name === snapshot.name)) {
+      if (layer.some(existing => existing.name === section.name)) {
         throw new Error(scope === undefined
-          ? `prompt section "${snapshot.name}" is already registered (for a per-agent override, register through that agent's \`agent.ctx\` instead)`
-          : `prompt section "${snapshot.name}" is already registered in this scope`)
+          ? `prompt section "${section.name}" is already registered (for a per-agent override, register through that agent's \`agent.ctx\` instead)`
+          : `prompt section "${section.name}" is already registered in this scope`)
       }
-      layer.push(snapshot)
+      layer.push(section)
       // Yield the rollback BEFORE emitting `system-prompt/change`: a generator
       // effect collects each yielded disposer before the next step runs, so a
       // throwing change listener removes the section instead of leaking it into
       // every future assembly.
       yield () => {
-        const index = layer.indexOf(snapshot)
+        const index = layer.indexOf(section)
         /* v8 ignore next 3 -- defensive: section was registered, so indexOf is guaranteed >= 0 */
         if (index >= 0) layer.splice(index, 1)
         if (scope !== undefined && layer.length === 0) this.scopedSections.delete(scope)
@@ -545,9 +541,9 @@ export class SystemPrompt extends Service {
    * by the calling context: a scoped variable (registered through
    * `agent.ctx`) resolves only for that scope's assemblies and SHADOWS a
    * same-named global variable there. Throws on a name that does not match
-   * `[a-z][a-z0-9_]*` (it could never be referenced) or one already
-   * registered in the SAME layer. Removed when the calling fiber is disposed;
-   * emits `system-prompt/change` on register/unregister.
+   * `[a-z][a-z0-9_]*` (it could never be referenced) or one already registered
+   * in the SAME layer. Removed when the calling fiber is disposed; emits
+   * `system-prompt/change` on register/unregister.
    * @param name - the reference name (matches `[a-z][a-z0-9_]*`).
    * @param provider - evaluated at every {@link assemble} for the value.
    * @returns the disposer that removes the variable. The exact
@@ -555,11 +551,11 @@ export class SystemPrompt extends Service {
    *   yield it directly — exact identity nests the teardown in order.
    */
   variable(name: string, provider: (context: AssembleContext) => string | undefined): () => Promise<void> | void {
+    if (!VARIABLE_NAME.test(name)) {
+      throw new Error(`invalid prompt variable name "${name}" (must match ${String(VARIABLE_NAME)})`)
+    }
     const scope = scopeOf(this.ctx)
     const dispose = this.ctx.effect(function* (this: SystemPrompt) {
-      if (!VARIABLE_NAME.test(name)) {
-        throw new Error(`invalid prompt variable name "${name}" (must match ${String(VARIABLE_NAME)})`)
-      }
       const layer = scope === undefined
         ? this.variableProviders
         : this.scopedVariableProviders.get(scope) ?? (() => {
@@ -590,73 +586,6 @@ export class SystemPrompt extends Service {
     return dispose
   }
 
-  /**
-   * Protect named section/tool contributions from the assembly waterfall.
-   * The layer is decided by the calling context: a global protection applies
-   * to every assembly, while one registered through `agent.ctx` applies only
-   * to that agent's scope. The name's canonical registry/provider output is
-   * restored AFTER the whole waterfall, so listener registration order cannot
-   * strip, replace, duplicate, or fabricate it. Canonical absence is restored
-   * too: if the protected name is intentionally absent for an assembly, a
-   * listener-injected entry with that name is removed. The input arrays are
-   * snapshotted; an empty protection throws because it cannot affect output.
-   * Removed with the calling fiber and emits `system-prompt/change` on
-   * registration/unregistration. A global section protection also reserves the
-   * name against scoped section shadows; registering protection when such a
-   * shadow already exists fails loudly instead of protecting the wrong owner.
-   * @param protection - section and/or tool names whose canonical presence and definitions are authoritative.
-   * @returns the exact Cordis effect disposer that removes the protection.
-   */
-  protect(protection: PromptProtection): () => Promise<void> | void {
-    const scope = scopeOf(this.ctx)
-    const snapshot: PromptProtection = {
-      ...protection.sections !== undefined ? { sections: [...new Set(protection.sections)] } : {},
-      ...protection.tools !== undefined ? { tools: [...new Set(protection.tools)] } : {},
-    }
-    if ((snapshot.sections?.length ?? 0) === 0 && (snapshot.tools?.length ?? 0) === 0) {
-      throw new Error('systemPrompt.protect() requires at least one section or tool name')
-    }
-    if (scope === undefined && snapshot.sections !== undefined) {
-      const protectedSections = new Set(snapshot.sections)
-      const conflicts = [...this.scopedSections.values()]
-        .flatMap(layer => layer.filter(section => protectedSections.has(section.name)).map(section => section.name))
-      if (conflicts.length > 0) {
-        throw new Error(`systemPrompt.protect() cannot globally protect section${conflicts.length > 1 ? 's' : ''} ${[...new Set(conflicts)].map(name => `"${name}"`).join(', ')} while scoped shadows are registered`)
-      }
-    }
-    const dispose = this.ctx.effect(function* (this: SystemPrompt) {
-      const layer = scope === undefined
-        ? this.protections
-        : this.scopedProtections.get(scope) ?? (() => {
-          const created: PromptProtection[] = []
-          this.scopedProtections.set(scope, created)
-          return created
-        })()
-      layer.push(snapshot)
-      yield () => {
-        const index = layer.indexOf(snapshot)
-        /* v8 ignore next 3 -- defensive: protection was registered, so indexOf is guaranteed >= 0 */
-        if (index >= 0) layer.splice(index, 1)
-        if (scope !== undefined && layer.length === 0) this.scopedProtections.delete(scope)
-        this.ctx.emit('system-prompt/change')
-      }
-      this.ctx.emit('system-prompt/change')
-    }.bind(this), 'systemPrompt.protect()')
-    return dispose
-  }
-
-  /** Resolve the authoritative names registered for one assembly scope. */
-  private protectedNames(scope: ScopeKey | undefined): { sections: Set<string>; tools: Set<string> } {
-    const records = [
-      ...this.protections,
-      ...(scope === undefined ? [] : this.scopedProtections.get(scope)) ?? [],
-    ]
-    return {
-      sections: new Set(records.flatMap(record => record.sections ?? [])),
-      tools: new Set(records.flatMap(record => record.tools ?? [])),
-    }
-  }
-
   /**
    * Assemble the current prompt for one caller: the global layer merged with
    * {@link AssembleContext.scope}'s layer (scoped sections/variables SHADOW
@@ -669,12 +598,12 @@ export class SystemPrompt extends Service {
    * the providers' `knownNames` universe rejects the assembly, while a known
    * name restricted away for this scope is a normal absence), and every
    * visible variable resolved against `context` into `assembly.variables`.
-   * Tool schemas are deep-cloned because adapters and request waterfalls may
-   * mutate schema objects. Runs through the `system-prompt/assemble`
+   * Tool schemas are detached because assembly waterfalls may mutate them.
+   * Runs through the `system-prompt/assemble`
    * waterfall, giving listeners the opportunity to mutate or replace the
-   * assembly, then restores every visible {@link PromptProtection} from the
-   * pre-waterfall canonical assembly. Like the sections' `order` sort, tool
-   * canonicalization happens on the initial assembly; unprotected listener
+   * assembly, then restores every contribution whose owner declared it final
+   * from the pre-waterfall canonical assembly. Like the sections' `order` sort, tool
+   * canonicalization happens on the initial assembly; ordinary listener
    * output owns its own determinism. Await the result before reading the
    * assembly values — waterfall listeners may be async.
    * Interpolation happens later, in {@link renderPrompt}.
@@ -687,10 +616,6 @@ export class SystemPrompt extends Service {
   // (`assemble().catch(...)` would miss it).
   async assemble(context: AssembleContext = {}): Promise<PromptAssembly> {
     const scope = context.scope
-    // Protection is a registry input too: snapshot which names are protected
-    // at assembly start. Registrations that land while an async waterfall is
-    // in flight affect the NEXT assembly, matching the other registries.
-    const protectedNames = this.protectedNames(scope)
     // Variables: global layer first, then the scope's layer OVERWRITES
     // same-named entries (shadowing — a per-agent value wins for that agent).
     const variables: Record<string, string | undefined> = {}
@@ -710,6 +635,11 @@ export class SystemPrompt extends Service {
     for (const section of (scope === undefined ? [] : this.scopedSections.get(scope)) ?? []) {
       sectionByName.set(section.name, section)
     }
+    const ownerFinalSections = new Set(
+      [...sectionByName.values()]
+        .filter(section => section.ownerFinal === true)
+        .map(section => section.name),
+    )
     // Tools: consult the global providers plus the scope's, each with this
     // assembly's context. `schemas` are what the model may see (already
     // post-restriction, per provider); `knownNames` (defaulting to the
@@ -722,14 +652,18 @@ export class SystemPrompt extends Service {
     ]
     const collected: ToolSchema[] = []
     const knownNames = new Set<string>()
+    const ownerFinalTools = new Set<string>()
     for (const provider of providers) {
       const result = provider(context)
-      for (const tool of result.schemas) {
-        collected.push({ ...tool, parameters: structuredClone(tool.parameters) })
-      }
-      for (const name of result.knownNames ?? result.schemas.map(tool => tool.name)) {
-        knownNames.add(name)
-      }
+      const schemas = result.schemas.map(({ name, description, parameters }): ToolSchema => ({
+        name,
+        description,
+        parameters: structuredClone(parameters),
+      }))
+      const acceptedKnownNames = result.knownNames ?? schemas.map(tool => tool.name)
+      collected.push(...schemas)
+      for (const name of acceptedKnownNames) knownNames.add(name)
+      for (const name of result.ownerFinalNames ?? []) ownerFinalTools.add(name)
     }
     const assembly: PromptAssembly = {
       sections: [...sectionByName.values()]
@@ -742,11 +676,11 @@ export class SystemPrompt extends Service {
       tools: orderTools(collected, this.toolOrder, knownNames),
       variables,
     }
-    // Snapshot only the fields protection can restore. The waterfall receives
+    // Snapshot only the owner-final fields. The waterfall receives
     // `assembly` by reference and may mutate it or return a replacement; these
     // independent snapshots remain the authoritative registry product.
-    const canonicalSections = protectedNames.sections.size > 0 ? structuredClone(assembly.sections) : undefined
-    const canonicalTools = protectedNames.tools.size > 0 ? structuredClone(assembly.tools) : undefined
+    const canonicalSections = ownerFinalSections.size > 0 ? structuredClone(assembly.sections) : undefined
+    const canonicalTools = ownerFinalTools.size > 0 ? structuredClone(assembly.tools) : undefined
     const result = await this.ctx.waterfall(
       scopeTarget(this, scope), 'system-prompt/assemble', assembly, context,
       () => Promise.resolve(assembly),
@@ -757,10 +691,10 @@ export class SystemPrompt extends Service {
     return {
       ...result,
       ...canonicalSections !== undefined
-        ? { sections: restoreProtected(canonicalSections, result.sections, protectedNames.sections) }
+        ? { sections: restoreOwnerFinal(canonicalSections, result.sections, ownerFinalSections) }
         : {},
       ...canonicalTools !== undefined
-        ? { tools: restoreProtected(canonicalTools, result.tools, protectedNames.tools) }
+        ? { tools: restoreOwnerFinal(canonicalTools, result.tools, ownerFinalTools) }
         : {},
     }
   }
diff --git a/packages/core/system-prompt/tests/scoped.spec.ts b/packages/core/system-prompt/tests/scoped.spec.ts
index d59e3a234a..329a66813f 100644
--- a/packages/core/system-prompt/tests/scoped.spec.ts
+++ b/packages/core/system-prompt/tests/scoped.spec.ts
@@ -63,19 +63,16 @@ describe('scoped sections', () => {
     expect(() => scope.ctx.systemPrompt.section({ name: 'y', order: 1, text: 'b' })).toThrow(/already registered in this scope/)
   })
 
-  it.each([
-    [['reserved'], 'section "reserved"'],
-    [['first', 'second'], 'sections "first", "second"'],
-  ])('rejects global protection added after scoped shadows (%j)', async (names, message) => {
+  it('rejects a global owner-final section added after a scoped shadow', async () => {
     const ctx = await mount()
     const scope = await mintScope(ctx, 'child')
-    for (const name of names) {
-      scope.ctx.systemPrompt.section({ name, order: 1, text: `scoped ${name}` })
-    }
+    scope.ctx.systemPrompt.section({ name: 'reserved', order: 1, text: 'scoped reserved' })
 
-    expect(() => ctx.systemPrompt.protect({ sections: names })).toThrow(message)
+    expect(() => ctx.systemPrompt.section({
+      name: 'reserved', order: 1, text: 'global reserved', ownerFinal: true,
+    })).toThrow('owner-final prompt section "reserved"')
     expect(renderPrompt(await ctx.systemPrompt.assemble({ scope: scopeKeyOf(scope) })))
-      .toContain(`scoped ${names[0]}`)
+      .toContain('scoped reserved')
   })
 })
 
@@ -164,13 +161,18 @@ describe('scoped assemble dispatch', () => {
     expect(shaped).toHaveLength(1)
   })
 
-  it('a scoped protection finalizes only its own assemblies and disappears with the scope', async () => {
+  it('scoped owner-final contributions finalize only their assemblies and disappear with the scope', async () => {
     const ctx = await mount()
     const scope = await mintScope(ctx, 'child')
     const key = scopeKeyOf(scope)
     ctx.systemPrompt.section({ name: 'required', order: 10, text: 'required' })
     ctx.systemPrompt.tools(() => ({ schemas: [schema('required')] }))
-    scope.ctx.systemPrompt.protect({ sections: ['required'], tools: ['required'] })
+    scope.ctx.systemPrompt.section({
+      name: 'required', order: 10, text: 'scoped required', ownerFinal: true,
+    })
+    scope.ctx.systemPrompt.tools(() => ({
+      schemas: [schema('required')], ownerFinalNames: ['required'],
+    }))
     ctx.on('system-prompt/assemble', async (_assembly, _context, next) => {
       const result = await next()
       result.sections = result.sections.filter(section => section.name !== 'required')
diff --git a/packages/core/system-prompt/tests/system-prompt.spec.ts b/packages/core/system-prompt/tests/system-prompt.spec.ts
index 95d46b705e..3417364613 100644
--- a/packages/core/system-prompt/tests/system-prompt.spec.ts
+++ b/packages/core/system-prompt/tests/system-prompt.spec.ts
@@ -111,6 +111,14 @@ describe('SystemPrompt', () => {
     expect(contributed(assembly).map(s => s.text)).toEqual(['first'])
   })
 
+  it('rejects a non-finite section order', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SystemPrompt)
+    expect(() => ctx.systemPrompt.section({ name: 'bad-order', order: Number.NaN, text: 'x' }))
+      .toThrow('order must be a finite number')
+    expect(contributed(await ctx.systemPrompt.assemble())).toEqual([])
+  })
+
   it('rolls back a section when a system-prompt/change listener throws (P1-1)', async () => {
     const ctx = new Context()
     await ctx.plugin(SystemPrompt)
@@ -205,28 +213,21 @@ describe('SystemPrompt', () => {
     expect(assembly.sections).toHaveLength(0)
   })
 
-  describe('canonical contribution protection', () => {
-    it('restores exact protected definitions after every listener, in canonical relative order', async () => {
+  describe('owner-final contributions', () => {
+    it('restores exact owner-final definitions after every listener, in canonical relative order', async () => {
       const ctx = new Context()
       await ctx.plugin(SystemPrompt)
       ctx.systemPrompt.section({ name: 'before', order: 10, text: 'before' })
-      ctx.systemPrompt.section({ name: 'protected', order: 20, text: 'canonical section' })
+      ctx.systemPrompt.section({ name: 'protected', order: 20, text: 'canonical section', ownerFinal: true })
       ctx.systemPrompt.section({ name: 'after', order: 30, text: 'after' })
       ctx.systemPrompt.tools(() => ({ schemas: [
         { name: 'alpha', description: 'alpha', parameters: {} },
         { name: 'protected', description: 'canonical tool', parameters: { type: 'object', properties: { answer: { type: 'number' } } } },
         { name: 'zulu', description: 'zulu', parameters: {} },
-      ] }))
-      const protection = { sections: ['protected'], tools: ['protected'] }
-      ctx.systemPrompt.protect(protection)
-      // Registration snapshots its arrays; caller mutation cannot change what
-      // the service makes authoritative.
-      protection.sections[0] = 'after'
-      protection.tools[0] = 'zulu'
+      ], ownerFinalNames: ['protected'] }))
 
-      // Registered AFTER the protection and prepended: it is outside every
-      // ordinary listener that existed when protect() ran, but service-level
-      // finalization still restores the canonical entries after it returns.
+      // Service-level finalization restores the canonical entries after the
+      // complete listener chain returns.
       ctx.on('system-prompt/assemble', async (_assembly, _context, next) => {
         const result = await next()
         return Object.freeze({
@@ -258,47 +259,18 @@ describe('SystemPrompt', () => {
       expect(assembly.tools.map(tool => tool.name)).toEqual(['alpha', 'protected', 'zulu'])
     })
 
-    it('protects canonical absence and rejects an empty protection', async () => {
+    it('makes an owner-final tool\'s canonical absence survive the waterfall', async () => {
       const ctx = new Context()
       await ctx.plugin(SystemPrompt)
-      // Separate registrations exercise the set-union contract: protections
-      // may name only sections or only tools and still compose.
-      ctx.systemPrompt.protect({ sections: ['mode-hidden'] })
-      ctx.systemPrompt.protect({ tools: ['mode-hidden'] })
+      ctx.systemPrompt.tools(() => ({ schemas: [], ownerFinalNames: ['mode-hidden'] }))
       ctx.on('system-prompt/assemble', async (_assembly, _context, next) => {
         const result = await next()
-        result.sections.push({ name: 'mode-hidden', order: 100, text: 'fabricated' })
         result.tools.push({ name: 'mode-hidden', description: 'fabricated', parameters: {} })
         return result
       })
 
       const assembly = await ctx.systemPrompt.assemble()
-      expect(assembly.sections.some(section => section.name === 'mode-hidden')).toBe(false)
       expect(assembly.tools.some(tool => tool.name === 'mode-hidden')).toBe(false)
-      expect(() => ctx.systemPrompt.protect({})).toThrow(/at least one section or tool name/)
-      expect(() => ctx.systemPrompt.protect({ sections: [], tools: [] })).toThrow(/at least one section or tool name/)
-    })
-
-    it('removes a protection with its contributing fiber (HMR safety)', async () => {
-      const ctx = new Context()
-      await ctx.plugin(SystemPrompt)
-      ctx.systemPrompt.section({ name: 'protected', order: 10, text: 'canonical' })
-      ctx.on('system-prompt/assemble', async (_assembly, _context, next) => {
-        const result = await next()
-        result.sections = result.sections.filter(section => section.name !== 'protected')
-        return result
-      })
-      let changes = 0
-      ctx.on('system-prompt/change', () => { changes++ })
-      const fiber = await ctx.plugin(Object.assign((inner: Context) => {
-        inner.systemPrompt.protect({ sections: ['protected'] })
-      }, { inject: ['systemPrompt'] }))
-
-      expect((await ctx.systemPrompt.assemble()).sections.some(section => section.name === 'protected')).toBe(true)
-      expect(changes).toBe(1)
-      await fiber.dispose()
-      expect((await ctx.systemPrompt.assemble()).sections.some(section => section.name === 'protected')).toBe(false)
-      expect(changes).toBe(2)
     })
   })
 
diff --git a/packages/core/tools/README.md b/packages/core/tools/README.md
index 63a094ce97..82c67df38c 100644
--- a/packages/core/tools/README.md
+++ b/packages/core/tools/README.md
@@ -11,18 +11,16 @@ tools:
   mode: native   # native (default) | code | both
 ```
 
-`native` contributes the calling agent's visible end capabilities as wire function definitions. Under `code`, this registry's canonical contribution is the reserved `run_code` transport plus the generated `tools:sdk` prompt section (see [Code Mode](#code-mode)); an assembly listener may still deliberately add unrelated schemas. `both` contributes the visible native definitions, `run_code`, and the SDK section. In non-native modes both infrastructure pieces are protected rather than filterable capabilities: restrictions and assembly listeners cannot remove them, a scoped section cannot shadow the globally protected `tools:sdk`, and registering, shadowing, or explicitly filtering `run_code` fails loudly. Non-native modes require a loaded `ctx.codeRuntime` with `language: 'typescript'`; a missing or mismatched runtime rejects every prompt assembly with an actionable error, and a `systemPrompt.toolOrder` naming tools the mode no longer contributes rejects the assembly the same way.
+`native` contributes the calling agent's visible end capabilities as wire function definitions. Under `code`, this registry's canonical contribution is the reserved `run_code` transport plus the generated `tools:sdk` prompt section (see [Code Mode](#code-mode)); an assembly listener may still deliberately add unrelated schemas. `both` contributes the visible native definitions, `run_code`, and the SDK section. In non-native modes both infrastructure pieces are owner-final rather than filterable capabilities: restrictions and assembly listeners cannot remove them, a scoped section cannot shadow the globally owner-final `tools:sdk`, and registering, shadowing, or explicitly filtering `run_code` fails loudly. Non-native modes require a loaded `ctx.codeRuntime` with `language: 'typescript'`; a missing or mismatched runtime rejects every prompt assembly with an actionable error, and a `systemPrompt.toolOrder` naming tools the mode no longer contributes rejects the assembly the same way.
 
 ### Public API
 
-- `ctx.tools.register(definition: ToolDefinition): () => Promise<void> | void` Register a tool as a frozen snapshot. Parameters must survive lossless-JSON validation before and after cloning; scalar fields are copied, and execute/presentation callbacks are bound once to the original definition as their method receiver, so later callback-property replacement cannot change dispatch. The layer is the CALLING context's scope (`dsh-scope`): a plain plugin context registers globally; an agent's `agent.ctx` registers for that agent alone, SHADOWING a same-named global tool there (per-agent tool variants). Duplicate names within one layer throw; non-native modes also reject the reserved `run_code` transport name. Disposed with the calling fiber (= the agent, for scoped registrations).
-- `ctx.tools.restrict(filter: ToolRestriction): () => Promise<void> | void` Scoped-only (throws on a plain context): mask the GLOBAL end-capability surface for the calling agent — `allow` keeps only the listed tools, `deny` removes them; multiple restrictions intersect; scoped registrations bypass restriction as explicit grants. The reserved `run_code` transport remains available automatically and cannot be named explicitly. Snapshot-at-registration, loud unknown-name validation, `restrict({})` rejects (the materialized-empty-config trap).
-- `ctx.tools.get(name: string, scope?: ScopeKey): ToolDefinition | undefined` Resolution as one scope sees it (shadowing applied; a restricted-away global reads as absent) — presenters pass the calling agent so the card matches what executed. Returned definitions are the registry's frozen snapshots.
-- `ctx.tools.visible(scope?: ScopeKey): ToolDefinition[]` The canonical executable view — restricted global layer ∪ the scope's own layer, plus the reserved transport in non-native modes — feeding prompt assembly, `get`, and `execute`, so presentation and dispatch resolve the same frozen definitions.
-- `ctx.tools.knownNames(scope?: ScopeKey): string[]` The PRE-restriction end-capability name universe `restrict` validates against: a typo fails loud while a restricted-away tool stays a normal absence. Presentation providers add reserved transport names separately when validating `toolOrder`.
+- `ctx.tools.register(definition: ToolDefinition): () => Promise<void> | void` Register a trusted typed same-process definition. The layer is the calling context's scope: a plain plugin context registers globally; an agent's `agent.ctx` registers for that agent alone, shadowing a same-named global tool there. Duplicate names within one layer throw; non-native modes also reject the reserved `run_code` transport name. `timeoutMs`, when present, must be positive and finite. `ownerFinal: true` makes the tool's canonical wire presence or absence survive prompt assembly listeners. Disposed with the calling fiber.
+- `ctx.tools.restrict(filter: ToolRestriction): () => Promise<void> | void` Scoped-only (throws on a plain context): mask the global end-capability surface for the calling agent — `allow` keeps only the listed global tools, `deny` removes them; multiple restrictions intersect; scope-local registrations are merged afterward. The readonly arrays compile once into private sets. Every listed name must exist in the current pre-restriction global registry; scope-local, unknown, and reserved `run_code` names fail loudly. A deny-list admits a later global tool unless it names that tool; an allow-list excludes later names; neither filters a later scope-local registration. `restrict({})` rejects. This is live registration composition, not a parent-derived authority ceiling; see the [agent-scope security non-goal](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals).
+- `ctx.tools.get(name: string, scope?: ScopeKey): ToolDefinition | undefined` Resolution as one scope sees it (shadowing applied; a restricted-away global reads as absent) — presenters pass the calling agent so the card matches what executed.
 - `ctx.tools.schemas(scope?: ScopeKey): ToolSchema[]` Schemas of everything the scope can see (without the `execute` functions). The shipped tools' schemas are catalogued in [docs/tool-catalog.md](../../../docs/tool-catalog.md), generated by booting each tool plugin and harvesting this method (see [the tool-schema-catalog RFC](../../../docs/rfc/implemented/process/2026-07-02-tool-schema-catalog.md)).
 - `ctx.tools.guard(guard: ToolGuard): () => Promise<void> | void` Register a monotonic synchronous execution guard after `tools/pre-execute`: returning a reason denies the call, while `undefined` leaves it unchanged. A plain-context guard applies globally; an `agent.ctx` guard applies only to that agent. Later waterfall listeners cannot turn a guard denial back into permission. Disposed with the calling fiber.
-- `ctx.tools.execute(exec: ToolExecutionInput): Promise<ToolExecutionResult>` Snapshot one single-use call input into a pipeline-owned execution, assign its opaque correlation token, require `arguments` to be losslessly JSON-serializable before and after cloning, deep-freeze the detached arguments, and protect its identity before running `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute`; optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove. Validate the final result as losslessly JSON-serializable and freeze the complete execution before `tools/result` observers run. Invalid or unstable input—including cloneable mutable exotics—and malformed or non-JSON listener/tool results normalize to `isError` outcomes rather than bypassing policy or failing later at the session log.
+- `ctx.tools.execute(exec: ToolExecutionInput): Promise<ToolExecutionResult>` Assign a fresh opaque correlation token, losslessly materialize and deep-freeze arguments once at the model/tool boundary, then run the call through `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute`. Invalid arguments normalize through the same authoritative result path without reaching policy or the body. The final outcome is independently materialized and deep-frozen once before `tools/result`. Optional `signal` remains the operational field an around-dispatch wrapper may replace.
 
 ### Injected services
 
@@ -34,12 +32,12 @@ The live registry pipeline has three transformable waterfalls followed by the ow
 
 ### Key types
 
-- `ToolDefinition` — `ToolSchema` + `execute(args, exec): Promise<ContentBlock[] | { content: ContentBlock[]; meta? }>` (the bare array is the model-facing content; the object form additionally attaches an opaque, JSON-serializable `meta` presentation payload persisted on the `tool/result` event and handed back to `presentResult`), plus optional `presentCall(args)` / `presentResult(args, result)` for tool-owned UI presentation (see below). It also carries an optional cooperative timeout budget `timeoutMs?: number` (ms) enforced by `@deepseek-ai/dsh-timeout-policy`, never sent to the model. Registration stores a frozen snapshot with detached JSON parameters and once-bound callback identities.
-- `ToolExecutionInput` — the caller-supplied call description: `{ callId, name, arguments, agent?, parent?, signal? }`; `arguments` must be losslessly JSON-serializable, and callers may pass an enclosing execution's opaque token as `parent` but never choose the new execution's own token.
-- `ToolExecutionToken` — a frozen, property-free identity value assigned by the registry. It supports equality correlation only and exposes no live outer execution state.
+- `ToolDefinition` — `ToolSchema` + `execute(args, exec)`, optional presentation callbacks, cooperative `timeoutMs`, and optional `ownerFinal`. `ownerFinal` is reserved for protocol tools such as `run_code` and structured-output capture whose canonical wire state must survive assembly listeners.
+- `ToolExecutionInput` — the caller-supplied call description: `{ callId, name, arguments, agent?, parent?, signal? }`; callers may pass an enclosing execution's opaque token as `parent` but never choose the new execution's own token.
+- `ToolExecutionToken` — a fresh branded `Symbol` assigned by the registry. It supports equality correlation only and never crosses a model, log, or worker boundary.
 - `ToolExecution` — the pipeline-owned call: immutable `{ token, callId, name, arguments, agent?, parent? }` identity plus optional operational `signal`, which an around wrapper may add, replace, remove, and restore. A nested call's `parent` is a `ToolExecutionToken`, not an execution object.
-- `ToolExecutionResult` — losslessly JSON-serializable outcome: `{ callId, content, isError, error?, additionalContext?, meta? }`. The registry validates the complete post-policy value before final observation. On failure with a `HarnessError`, `error: { name, code }` carries the structured failure class alongside the model-facing text (the loop forwards it onto the `tool/result` session event for retry/sandbox plugins and replay). `additionalContext` (a `HookContext`) ferries any `tools/post-execute` context up to the loop, which buffers it and appends it as a `context/message` after all `tool/result`s in the step. `meta` is the tool's opaque presentation payload from a successful `execute` (the object return form); the loop forwards it onto the `tool/result` session event for result-card rendering.
-- `PreToolDecision` — `{kind:'allow'}` | `{kind:'deny', reason}` | `{kind:'ask', reason?}`. The registry validates this exact union at runtime: a JavaScript/casted value with an unknown kind, a malformed reason, or extra fields fails closed as an `isError`; the tool body does not run and final observers still receive one result. Input rewrite (changing `arguments`) is deliberately NOT offered (it would desync the pre-execution audit/history/UI from what ran — its own proposed RFC); `ask` is serviced by [`ctx.approval`](../../ui/user-approval/README.md) when a deployment mounts it (`allowed-once` proceeds to dispatch; `rejected`/`cancelled`/`unavailable` deny with distinct reasons) and degrades to `deny` when none is mounted or the execution carries no agent.
+- `ToolExecutionResult` — losslessly JSON-serializable outcome: `{ callId, content, isError, error?, additionalContext?, meta? }`. The registry materializes and freezes the complete post-policy value before final observation. On failure with a `HarnessError`, `error: { name, code }` carries the structured failure class alongside the model-facing text.
+- `PreToolDecision` — `{kind:'allow'}` | `{kind:'deny', reason}` | `{kind:'ask', reason?}`. Input rewrite is deliberately not offered; `ask` is serviced by [`ctx.approval`](../../ui/user-approval/README.md) when mounted and otherwise degrades to deny.
 - `PostToolDecision` — `{kind:'accept', content?, additionalContext?}` (keep the call successful, optionally replacing the model-facing content) | `{kind:'block', feedback, additionalContext?}` (turn it into an `isError` whose content is the corrective feedback). Output replacement is clean because `tool/result` is logged AFTER `execute()` returns.
 - `ToolGuard` — `(execution) => string | undefined`; the returned string is a final monotonic denial reason evaluated after the reorderable pre-execute waterfall and before dispatch.
 - `ToolCallView` / `ToolResultView` — provider-neutral `card`-tagged render intents a tool returns from `presentCall` / `presentResult` to own how a UI renders ITS calls (see "Tool-owned UI presentation").
@@ -77,7 +75,7 @@ ctx.tools.register(defineTool({
 }))
 ```
 
-The helper converts the author-facing `SchemaSpec` (with `required: true` as a per-property boolean) to standard JSON Schema for the wire format. Raw JSON-Schema tool definitions (from MCP servers) are still accepted by the registry directly.
+The helper converts the author-facing `SchemaSpec` (with `required: true` as a per-property boolean) to standard JSON Schema for the wire format and uses the same typed spec for execute/presentation validation. Raw JSON-Schema tool definitions (from MCP servers) are still accepted by the registry directly.
 
 A `defineTool` tool also **validates the model-generated arguments against its `SchemaSpec` before `execute` runs** (`validateArgs`). The model's JSON is untrusted — `InferArgs<S>` is a compile-time claim, not a runtime guarantee — so on a mismatch (missing required key, wrong primitive, bad enum member, nested violation) the tool throws a `ToolArgsError` (`code: 'INVALID_ARGS'`); the registry turns it into an `isError` result whose text lists the violations, which the model sees and self-corrects from. Validation mirrors the JSON Schema conversion exactly: extra keys are allowed, `default` is not applied, and an `object`/`array` prop without `properties`/`items` only type-checks. Raw-registered tools (MCP) are **not** validated by the harness — they validate their own input.
 
@@ -138,7 +136,7 @@ Under `mode: code` (or `both`) the registry turns the tool surface into a progra
 - **The dispatch bridge** (`run_code`'s execute): every binding call is JSON-normalized before dispatch (a value that does not survive — `BigInt`, circulars — rejects that one call, so the dispatched form and logged form are the same JSON value by construction), serialized through a per-run queue (even `Promise.all` executes underlying calls one at a time in submission order), given the outer execution's opaque token as `parent`, and run through the complete pre-execute → guards → execute → post-execute → result pipeline. A denial reaches the program as a binding rejection, and each sub-call is logged as a `tool/code-dispatch` session event with deterministic id `<parent>:code:<n>`; `deriveMessages()` does not surface that event. Token correlation lets commit-style observers defer an inner success until the final `run_code` result without exposing the live outer execution; ordinary tool side effects are not rolled back. A sub-call's `additionalContext` is deliberately dropped because inserting it inside a running parent call would break tool-call/result adjacency.
 - **Settlement discipline**: the bridge owns a run-scoped abort that follows the outer signal in and fires when the run settles for any reason, so a budget expiry aborts an in-flight sub-tool instead of orphaning it; the bridge then drains its queue BEFORE returning, so every `tool/code-dispatch` lands inside the open turn. A failed run throws `CodeRunFailedError` (`code: 'CODE_RUN_FAILED'`, message = the failure kind + captured logs), which the pipeline converts to a structured `isError` the model self-corrects from.
 
-The wire collapse is the registry's own contribution (`systemPrompt.tools()` is mode-aware), so the logged `request/header` records it for free. With no deliberate schema-adding assembly listener, `code` assembles exactly `[run_code]`, pinned by tests and the snapshot goldens; protection guarantees that `run_code` and `tools:sdk` remain present, not that unrelated listener additions are erased. Try it: `pnpm run demo:code-mode` ([the coding-agent example's Code Mode overlay](../../../examples/coding-agent/README.md#code-mode)); `pnpm run demo:code-mode acp` serves the same mode over ACP instead of the REPL.
+The wire collapse is the registry's own contribution (`systemPrompt.tools()` is mode-aware), so the logged `request/header` records it for free. With no deliberate schema-adding assembly listener, `code` assembles exactly `[run_code]`, pinned by tests and the snapshot goldens; contribution-owned finality guarantees that `run_code` and `tools:sdk` remain present, not that unrelated listener additions are erased. Try it: `pnpm run demo:code-mode` ([the coding-agent example's Code Mode overlay](../../../examples/coding-agent/README.md#code-mode)); `pnpm run demo:code-mode acp` serves the same mode over ACP instead of the REPL.
 
 ## Known Limitations and Deferred Work
 
diff --git a/packages/core/tools/src/code-mode.ts b/packages/core/tools/src/code-mode.ts
index 323fbeed2b..702a403b03 100644
--- a/packages/core/tools/src/code-mode.ts
+++ b/packages/core/tools/src/code-mode.ts
@@ -151,6 +151,7 @@ function asRunCodeMeta(meta: unknown): RunCodeMeta | undefined {
 export function createRunCodeTool(registry: ToolRegistry, requireRuntime: () => CodeRuntime): ToolDefinition {
   return defineTool({
     name: RUN_CODE_NAME,
+    ownerFinal: true,
     description:
       'Execute a TypeScript program against the available tools. Write the BODY of an '
       + 'async function (erasable syntax only; top-level `await` and `return` work) and '
diff --git a/packages/core/tools/src/index.ts b/packages/core/tools/src/index.ts
index 71dd465dd6..84a1ec3c51 100644
--- a/packages/core/tools/src/index.ts
+++ b/packages/core/tools/src/index.ts
@@ -23,7 +23,7 @@ import type { ScopeKey, Scoped } from '@deepseek-ai/dsh-scope'
 import type { CallId, ContentBlock, ToolSchema } from '@deepseek-ai/dsh-llm'
 import { assertNever, deepFreeze, HarnessError } from '@deepseek-ai/dsh-llm'
 import type { Agent, HookContext } from '@deepseek-ai/dsh-agent'
-import { isJsonValue } from '@deepseek-ai/dsh-session'
+import { snapshotJsonValue } from '@deepseek-ai/dsh-session'
 import type { ToolProviderResult } from '@deepseek-ai/dsh-system-prompt'
 import type { CodeRuntime } from '@deepseek-ai/dsh-code-runtime'
 // Type-only: makes `ctx.get('approval')` resolve to the ApprovalService
@@ -91,9 +91,6 @@ declare module 'cordis' {
      * tool body never runs. Input rewrite is deliberately NOT offered here (see
      * {@link PreToolDecision}); `ask` is serviced by the `ctx.approval` seam
      * when one is mounted, and degrades to deny otherwise.
-     * The returned union is validated as an exact runtime shape before approval
-     * or guards run; a malformed JavaScript/casted decision fails closed as an
-     * `isError` result and the tool body never runs.
      * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`) keys the carrier by `exec.agent`: a
      * listener registered through `agent.ctx` fires only for that agent's
      * calls, while a plain plugin listener fires for every call (including
@@ -115,8 +112,8 @@ declare module 'cordis' {
      * set or replace the one mutable field, `exec.signal` (e.g. with a per-call
      * deadline), BEFORE `next()`, restore/delete it afterward, and inspect the result AFTER. Call identity
      * (`token`, `callId`, `name`, `arguments`, `agent`, and `parent`) is immutable throughout the
-     * pipeline so a wrapper cannot change which capability or scope was
-     * authorized. (Cordis `next()` ignores passed arguments and re-invokes
+     * pipeline so a wrapper cannot change which tool and scope the pipeline
+     * accepted. (Cordis `next()` ignores passed arguments and re-invokes
      * downstream with the shared payload, so a wrapper changes `exec.signal` in
      * place rather than passing a new object to `next()`.)
      * Multiple listeners compose by registration order — an outer one wraps the
@@ -148,7 +145,7 @@ declare module 'cordis' {
      * @param result - the dispatch outcome a listener may accept, replace, or block.
      * @mode waterfall
      */
-    'tools/post-execute'(this: Scoped<ToolRegistry>, exec: ToolExecution, result: ToolExecutionResult, next: () => Promise<PostToolDecision>): Promise<PostToolDecision>
+    'tools/post-execute'(this: Scoped<ToolRegistry>, exec: ToolExecution, result: Readonly<ToolExecutionResult>, next: () => Promise<PostToolDecision>): Promise<PostToolDecision>
     /**
      * Awaited notification of the authoritative FINAL tool outcome, after the
      * complete pre/execute/post pipeline, final lossless-JSON validation, and
@@ -202,6 +199,12 @@ export interface ToolDefinition extends ToolSchema {
    * cooperative implementation that can reach quiescence when the signal aborts.
    */
   timeoutMs?: number
+  /**
+   * Whether this tool name's canonical wire presence or absence survives the
+   * complete system-prompt assembly waterfall. Reserved for protocol tools
+   * whose owner must retain the final definition.
+   */
+  readonly ownerFinal?: boolean
   /**
    * Optional: how to present the PENDING state of one call in a UI, derived from
    * the call's `args` (parsed arguments, `unknown` — the tool validates/narrows
@@ -239,23 +242,18 @@ export interface ToolResult {
 
 declare const toolExecutionTokenBrand: unique symbol
 
-/** Tokens minted in this module; a cast or JavaScript object cannot forge membership. */
-const executionTokens = new WeakSet<object>()
-
 /**
- * Opaque, immutable identity for one trip through the tool pipeline. Nested
+ * Opaque identity for one trip through the tool pipeline. Nested
  * transports carry the enclosing execution's token instead of its live object,
  * so observe-only result listeners can correlate calls without gaining a
  * mutation path into an outer around-dispatch wrapper.
  */
-export interface ToolExecutionToken {
-  readonly [toolExecutionTokenBrand]: true
-}
+export type ToolExecutionToken = symbol & { readonly [toolExecutionTokenBrand]: true }
 
 /**
  * Caller-supplied description of one tool call. {@link ToolRegistry.execute}
- * snapshots this input into a pipeline-owned {@link ToolExecution}; callers do
- * not choose the execution token.
+ * adds the registry-owned token to form a pipeline {@link ToolExecution};
+ * callers do not choose that token.
  */
 export interface ToolExecutionInput {
   readonly callId: CallId
@@ -274,11 +272,11 @@ export interface ToolExecutionInput {
 }
 
 /**
- * One pending tool call inside the registry pipeline. Call identity, the
- * registry-assigned {@link token}, and a lossless-JSON-validated, deep-frozen
- * clone of the parsed arguments are immutable from the first policy listener onward, while an
- * around-dispatch wrapper may set, replace, or remove only `signal`. The
- * registry freezes the complete object before `tools/result` observers run.
+ * One pending tool call inside the registry pipeline. Parsed arguments cross
+ * one lossless-JSON materialization boundary before policy and are deep-frozen;
+ * call identity and the registry-assigned {@link token} are readonly. An
+ * around-dispatch wrapper may set, replace, or remove `signal`. The registry
+ * freezes the complete object before `tools/result` observers run.
  */
 export interface ToolExecution extends ToolExecutionInput {
   /** Registry-assigned identity shared with nested calls only as their opaque `parent` token. */
@@ -429,17 +427,38 @@ export interface Config {
  * {@link ToolRegistry.restrict}. `allow` keeps only the listed global tools;
  * `deny` removes the listed ones; both present = allow first, then deny.
  * Restrictions never touch scoped registrations — a tool registered through
- * the same scope is an explicit grant that bypasses them (which is what keeps
- * e.g. a structured-output capture tool alive under an allow-list). The
+ * the same scope is merged after the global filter (which is what keeps e.g. a
+ * structured-output capture tool alive under an allow-list). The readonly
+ * filter values compile to private sets at registration, but resolution uses the live global registry:
+ * a later global name passes a deny-only filter unless explicitly denied and
+ * fails an allow-list unless explicitly allowed. The
  * reserved `run_code` presentation transport is likewise outside capability
  * filtering, and naming it explicitly is rejected. Multiple restrictions on
  * one scope compose by intersection: every one must admit.
  */
 export interface ToolRestriction {
   /** Global tool names that stay visible; everything else is removed. */
-  allow?: string[]
+  readonly allow?: readonly string[]
   /** Global tool names removed from visibility. */
-  deny?: string[]
+  readonly deny?: readonly string[]
+}
+
+/** One restriction compiled at registration for repeated live-global lookup. */
+interface CompiledToolRestriction {
+  readonly allow?: ReadonlySet<string>
+  readonly deny?: ReadonlySet<string>
+}
+
+/** One scope's complete registry view, derived in a single layer traversal. */
+interface ToolView {
+  /** Visible definitions after restrictions, scoped shadowing, and transport insertion. */
+  readonly visible: ReadonlyMap<string, ToolDefinition>
+  /** Pre-restriction capability names used by prompt-order validation. */
+  readonly knownNames: ReadonlySet<string>
+  /** Current global names that a scoped restriction may name. */
+  readonly restrictableNames: ReadonlySet<string>
+  /** Canonical names whose wire presence or absence is owner-final. */
+  readonly ownerFinalNames: ReadonlySet<string>
 }
 
 /**
@@ -472,7 +491,7 @@ interface ToolGuardRegistration {
  * that agent alone, disposed with the scope, and SHADOWING a global tool of
  * the same name for that agent (most-specific-wins; within one layer a
  * duplicate name still throws). {@link restrict} masks the global layer per
- * scope. One visibility function ({@link visible}) feeds prompt assembly,
+ * scope. One private visibility resolver feeds prompt assembly,
  * {@link get}, and {@link execute} — and, under a non-native mode, the SDK
  * section and `run_code`'s bindings — so what the model is shown, what a
  * presenter renders, what a program can call, and what dispatches can never
@@ -487,8 +506,8 @@ export class ToolRegistry extends Service {
 
   private global = new Map<string, ToolDefinition>()
   private scoped = new Map<ScopeKey, Map<string, ToolDefinition>>()
-  /** Snapshot-at-registration restriction filters, per scope (see {@link restrict}). */
-  private restrictions = new Map<ScopeKey, ToolRestriction[]>()
+  /** Compiled restriction filters, per scope (see {@link restrict}). */
+  private restrictions = new Map<ScopeKey, CompiledToolRestriction[]>()
   /** Monotonic post-policy guards, split into global and per-agent layers. */
   private globalGuards = new Set<ToolGuardRegistration>()
   private scopedGuards = new Map<ScopeKey, Set<ToolGuardRegistration>>()
@@ -508,12 +527,13 @@ export class ToolRegistry extends Service {
     // the filterable global/scoped capability layers.
     this.codeTransport = this.mode === 'native'
       ? undefined
-      : deepFreeze(createRunCodeTool(this, () => this.requireCodeRuntime()))
+      : createRunCodeTool(this, () => this.requireCodeRuntime())
     ctx.systemPrompt.tools(context => this.wireSchemas(context.scope))
     if (this.mode !== 'native') {
       ctx.systemPrompt.section({
         name: 'tools:sdk',
         order: SDK_SECTION_ORDER,
+        ownerFinal: true,
         // A lazy thunk over the live registry, per assembly CONTEXT:
         // regenerated at each assembly over the CALLING SCOPE's visible set
         // (scoped tools join, restricted globals vanish — the SDK declares
@@ -526,11 +546,6 @@ export class ToolRegistry extends Service {
           return renderToolsSdk(this.schemas(context.scope).filter(schema => schema.name !== RUN_CODE_NAME))
         },
       })
-      // These are presentation infrastructure, not optional end capabilities.
-      // Protect them at their owner: assembly listeners may still transform
-      // ordinary tools and prose, but cannot silently leave Code Mode without
-      // its only wire transport or the SDK that tells the model how to use it.
-      ctx.systemPrompt.protect({ sections: ['tools:sdk'], tools: [RUN_CODE_NAME] })
     }
   }
 
@@ -550,16 +565,24 @@ export class ToolRegistry extends Service {
    * `mode: 'code'` the universe is `[run_code]` and a `toolOrder` naming a
    * native tool is dead configuration that fails every assembly loud. Under
    * `mode: 'both'`, the provider adds the reserved transport to the
-   * capability-only {@link knownNames} universe for `toolOrder` validation.
+   * capability-only known-name universe for `toolOrder` validation.
    */
   private wireSchemas(scope?: ScopeKey): ToolProviderResult {
-    if (this.mode === 'native') return { schemas: this.schemas(scope), knownNames: this.knownNames(scope) }
-    this.requireCodeRuntime()
-    const all = this.schemas(scope)
-    if (this.mode === 'code') {
-      return { schemas: all.filter(schema => schema.name === RUN_CODE_NAME), knownNames: [RUN_CODE_NAME] }
+    const view = this.view(scope)
+    const schemas = [...view.visible.values()].map(definition => this.schemaOf(definition, false))
+    const ownerFinalNames = [...view.ownerFinalNames]
+    if (this.mode === 'native') {
+      return { schemas, knownNames: [...view.knownNames], ownerFinalNames }
     }
-    return { schemas: all, knownNames: [...this.knownNames(scope), RUN_CODE_NAME] }
+    this.requireCodeRuntime()
+    if (this.mode === 'code') {
+      return {
+        schemas: schemas.filter(schema => schema.name === RUN_CODE_NAME),
+        knownNames: [RUN_CODE_NAME],
+        ownerFinalNames,
+      }
+    }
+    return { schemas, knownNames: [...view.knownNames, RUN_CODE_NAME], ownerFinalNames }
   }
 
   /**
@@ -590,12 +613,10 @@ export class ToolRegistry extends Service {
    * the shadowing feature, not an error; the global-duplicate message names
    * `agent.ctx` as the per-agent alternative), or if a non-native mode reserves
    * the `run_code` name for its presentation transport. The visible schema set
-   * flows into prompt assembly automatically. Registration validates and
-   * clones the JSON parameters, copies scalar fields, binds each callback once
-   * to the caller's definition as its method receiver, and freezes the stored
-   * snapshot; later mutation or callback replacement on the input object does
-   * not rewrite the registry. Disposed with the calling fiber. Emits
-   * `tools/change` on register/unregister.
+   * flows into prompt assembly automatically. Definitions are trusted typed
+   * same-process contributions; JSON materialization happens when the schema or
+   * result reaches its model/log boundary. Emits `tools/change` on
+   * register/unregister.
    * @param definition - the tool's schema plus its execute (and optional
    *   presentation) functions.
    * @returns the disposer that unregisters the tool. The exact
@@ -604,52 +625,39 @@ export class ToolRegistry extends Service {
    */
   register(definition: ToolDefinition): () => Promise<void> | void {
     const scope = scopeOf(this.ctx)
-    // A schema crosses the same model/log boundary as execution arguments.
-    // Validate BEFORE cloning because structuredClone silently turns some
-    // forbidden values (for example class instances) into plain records, then
-    // validate the detached value again to contain hostile getters that change
-    // between inspection and snapshotting. A frozen Map is still mutable, so
-    // deepFreeze alone is not a sufficient registration boundary.
-    if (!isJsonValue(definition.parameters)) {
-      throw new TypeError('tool parameters must be losslessly JSON-serializable')
+    const name = definition.name
+    const timeoutMs = definition.timeoutMs
+    if (timeoutMs !== undefined
+      && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
+      throw new TypeError(`tool "${name}" timeoutMs must be a positive finite number`)
     }
-    const parameters = structuredClone(definition.parameters)
-    if (!isJsonValue(parameters)) {
-      throw new TypeError('tool parameters must be stable losslessly JSON-serializable data')
-    }
-    // Bind once so replacing a callback on the caller-owned definition after
-    // registration cannot change dispatch, while preserving the historical
-    // method receiver (`this === definition`) for callbacks that use it.
-    const execute = definition.execute.bind(definition)
-    const presentCall = definition.presentCall?.bind(definition)
-    const presentResult = definition.presentResult?.bind(definition)
-    const snapshot: ToolDefinition = deepFreeze({
-      name: definition.name,
-      description: definition.description,
-      parameters,
-      execute,
-      ...definition.timeoutMs !== undefined ? { timeoutMs: definition.timeoutMs } : {},
-      ...presentCall !== undefined ? { presentCall } : {},
-      ...presentResult !== undefined ? { presentResult } : {},
-    })
-    if (this.codeTransport !== undefined && snapshot.name === RUN_CODE_NAME) {
+    if (this.codeTransport !== undefined && name === RUN_CODE_NAME) {
       throw new Error(`tool name "${RUN_CODE_NAME}" is reserved for the Code Mode presentation transport and cannot be registered or shadowed`)
     }
+    if (scope !== undefined && this.global.get(name)?.ownerFinal === true) {
+      throw new Error(`tool "${name}" is globally owner-final and cannot be shadowed in an agent scope`)
+    }
+    if (scope === undefined && definition.ownerFinal === true) {
+      const hasScopedShadow = [...this.scoped.values()].some(layer => layer.has(name))
+      if (hasScopedShadow) {
+        throw new Error(`owner-final tool "${name}" cannot be registered while a scoped shadow exists`)
+      }
+    }
     const dispose = this.ctx.effect(function* (this: ToolRegistry) {
       const layer = scope === undefined ? this.global : this.layerFor(scope)
-      if (layer.has(snapshot.name)) {
+      if (layer.has(name)) {
         throw new Error(scope === undefined
-          ? `tool "${snapshot.name}" is already registered (for a per-agent variant, register through that agent's \`agent.ctx\` instead)`
-          : `tool "${snapshot.name}" is already registered in this scope`)
+          ? `tool "${name}" is already registered (for a per-agent variant, register through that agent's \`agent.ctx\` instead)`
+          : `tool "${name}" is already registered in this scope`)
       }
-      layer.set(snapshot.name, snapshot)
+      layer.set(name, definition)
       // Yield the rollback BEFORE emitting `tools/change`: a generator effect
       // collects each yielded disposer before the next step runs, so a throwing
       // `tools/change` listener removes the tool instead of leaking it (a leak
       // would wedge the duplicate-name check until restart). The duplicate
       // throw above fires before any mutation — it leaks nothing.
       yield () => {
-        layer.delete(snapshot.name)
+        layer.delete(name)
         // An emptied scope layer is dropped so a disposed scope leaves no
         // residue keyed by its (dead) key.
         if (scope !== undefined && layer.size === 0) this.scoped.delete(scope)
@@ -671,17 +679,19 @@ export class ToolRegistry extends Service {
    * through a scoped context (`agent.ctx`) — restricting "everyone" is not a
    * thing (throw), and an empty filter (neither `allow` nor `deny`) is a no-op
    * that can only be a bug (throw — the materialized-empty-config trap).
-   * Validates every listed name against the scope's CURRENT pre-restriction
-   * name universe ({@link knownNames}) and throws on an unknown one (fail loud
+   * Validates every listed name against the CURRENT global end-capability
+   * universe and throws on an unknown or scope-local name (fail loud
    * beats a typo silently filtering nothing) — register restrictions after the
    * global tools they mask exist (the agent-creation `setup` window satisfies
    * this). A non-native mode's reserved `run_code` presentation transport is
    * not a filterable capability; naming it explicitly throws, while omitting
-   * it from an allow-list cannot remove it. The filter is SNAPSHOT at
-   * registration: later caller mutation of the arrays changes nothing.
-   * Multiple restrictions compose by intersection. Scoped registrations
-   * bypass restrictions (explicit grants win). Disposed with the calling
-   * fiber (revocable independently); emits `tools/change`.
+   * it from an allow-list cannot remove it. The readonly arrays are compiled to
+   * private sets at registration. Resolution still uses the live global registry, so a later
+   * global name passes a deny-only filter unless named and fails an allow-list
+   * unless named. Multiple restrictions compose by intersection. Scoped
+   * registrations are merged after restrictions and therefore remain visible.
+   * Disposed with the calling fiber (revocable independently); emits
+   * `tools/change`.
    * @param filter - global-surface mask: `allow` (keep only) and/or `deny` (remove).
    * @returns the disposer that lifts this restriction. The exact
    *   Cordis effect disposer (single-shot): composite (generator) effects may
@@ -692,30 +702,31 @@ export class ToolRegistry extends Service {
     if (scope === undefined) {
       throw new Error('tools.restrict() requires a scoped context (agent.ctx): a context-global restriction would mask every agent — deny the tool for the intended agent instead')
     }
-    if (filter.allow === undefined && filter.deny === undefined) {
+    const allow = filter.allow
+    const deny = filter.deny
+    if (allow === undefined && deny === undefined) {
       throw new Error('tools.restrict({}) is a no-op: pass `allow` and/or `deny` (an empty filter is almost always a materialized-empty-config bug)')
     }
-    // Snapshot BEFORE validation so what was checked is what is enforced.
-    const snapshot: ToolRestriction = {
-      ...filter.allow !== undefined ? { allow: [...filter.allow] } : {},
-      ...filter.deny !== undefined ? { deny: [...filter.deny] } : {},
+    const compiled: CompiledToolRestriction = {
+      ...allow !== undefined ? { allow: new Set(allow) } : {},
+      ...deny !== undefined ? { deny: new Set(deny) } : {},
     }
     if (this.codeTransport !== undefined
-      && [...snapshot.allow ?? [], ...snapshot.deny ?? []].includes(RUN_CODE_NAME)) {
+      && [...allow ?? [], ...deny ?? []].includes(RUN_CODE_NAME)) {
       throw new Error(`tools.restrict() cannot name reserved Code Mode presentation transport "${RUN_CODE_NAME}"; restrict end-capability tools instead`)
     }
-    const known = new Set(this.knownNames(scope))
-    const unknown = [...snapshot.allow ?? [], ...snapshot.deny ?? []].filter(name => !known.has(name))
+    const known = this.view(scope).restrictableNames
+    const unknown = [...allow ?? [], ...deny ?? []].filter(name => !known.has(name))
     if (unknown.length > 0) {
-      throw new Error(`tools.restrict() names unknown tool${unknown.length > 1 ? 's' : ''} ${unknown.map(n => `"${n}"`).join(', ')}; known tools for this scope: ${[...known].sort().join(', ') || '(none)'}`)
+      throw new Error(`tools.restrict() names unknown global tool${unknown.length > 1 ? 's' : ''} ${unknown.map(n => `"${n}"`).join(', ')}; known global tools: ${[...known].sort().join(', ') || '(none)'}`)
     }
     const dispose = this.ctx.effect(function* (this: ToolRegistry) {
       const list = this.restrictions.get(scope) ?? []
       this.restrictions.set(scope, list)
-      list.push(snapshot)
+      list.push(compiled)
       yield () => {
-        const index = list.indexOf(snapshot)
-        /* v8 ignore next 3 -- defensive: the snapshot was pushed, so indexOf is guaranteed >= 0 */
+        const index = list.indexOf(compiled)
+        /* v8 ignore next 3 -- defensive: the compiled restriction was pushed, so indexOf is guaranteed >= 0 */
         if (index >= 0) list.splice(index, 1)
         if (list.length === 0) this.restrictions.delete(scope)
         this.ctx.emit('tools/change')
@@ -777,69 +788,69 @@ export class ToolRegistry extends Service {
 
   /** First monotonic denial from the global then matching scoped guard layers. */
   private guardReason(exec: ToolExecution): string | undefined {
-    // Guards are policy, not another transform seam. The pipeline execution's
-    // identity and arguments are already protected; freeze a detached view so
-    // an untyped guard cannot replace the wrapper-mutable signal either.
-    const view: Readonly<ToolExecution> = Object.freeze({ ...exec })
     for (const { guard } of this.globalGuards) {
-      const reason = guard(view)
-      if (reason !== undefined) return this.assertGuardReason(reason)
+      const reason = guard(exec)
+      if (reason !== undefined) return reason
     }
     if (exec.agent !== undefined) {
       for (const { guard } of this.scopedGuards.get(exec.agent) ?? []) {
-        const reason = guard(view)
-        if (reason !== undefined) return this.assertGuardReason(reason)
+        const reason = guard(exec)
+        if (reason !== undefined) return reason
       }
     }
     return undefined
   }
 
-  /** Runtime boundary for JavaScript/casted guards: only strings can deny. */
-  private assertGuardReason(reason: unknown): string {
-    if (typeof reason !== 'string') {
-      throw new TypeError(`tools.guard() must return a denial string or undefined, got ${typeof reason}`)
-    }
-    return reason
-  }
-
   /** Whether every restriction registered for `scope` admits the global tool `name` (intersection semantics). */
   private admits(scope: ScopeKey | undefined, name: string): boolean {
     if (scope === undefined) return true
     const filters = this.restrictions.get(scope)
     if (!filters) return true
     return filters.every(filter =>
-      (filter.allow === undefined || filter.allow.includes(name))
-      && (filter.deny === undefined || !filter.deny.includes(name)))
+      (filter.allow === undefined || filter.allow.has(name))
+      && (filter.deny === undefined || !filter.deny.has(name)))
   }
 
   /**
-   * THE visibility function — one resolution feeding prompt assembly,
-   * {@link get}, and {@link execute}: the global layer masked by the scope's
-   * restrictions, unioned with the scope's own layer, scoped shadowing global
-   * on a name conflict, then the non-native mode's reserved `run_code`
-   * presentation transport. No scope = the unrestricted global view.
+   * Resolve every registry fact one scope needs in one layer traversal. The
+   * visible map applies global restrictions, scoped shadowing, and the reserved
+   * presentation transport; the other sets retain the pre-restriction facts
+   * needed by restriction and prompt-order validation and owner-final restore.
    * @param scope - the viewing scope (the agent), or undefined for the global view.
-   * @returns the visible definitions (scoped shadows applied), in per-layer
-   *   registration order, global layer first.
+   * @returns the complete derived view for that scope.
    */
-  visible(scope?: ScopeKey): ToolDefinition[] {
+  private view(scope?: ScopeKey): ToolView {
     const layer = scope === undefined ? undefined : this.scoped.get(scope)
-    const result = new Map<string, ToolDefinition>()
+    const visible = new Map<string, ToolDefinition>()
+    const knownNames = new Set<string>()
+    const restrictableNames = new Set<string>()
+    const ownerFinalNames = new Set<string>()
     for (const [name, definition] of this.global) {
-      if (this.admits(scope, name)) result.set(name, definition)
+      knownNames.add(name)
+      restrictableNames.add(name)
+      if (definition.ownerFinal === true) ownerFinalNames.add(name)
+      if (this.admits(scope, name)) visible.set(name, definition)
     }
     // Scoped layer second: same-name entries REPLACE (shadow) the global ones,
-    // and grants bypass restrictions by construction (never filtered above).
-    for (const [name, definition] of layer ?? []) result.set(name, definition)
+    // and scope-local registrations are never part of the global filter above.
+    for (const [name, definition] of layer ?? []) {
+      knownNames.add(name)
+      if (definition.ownerFinal === true) ownerFinalNames.add(name)
+      visible.set(name, definition)
+    }
     // Presentation infrastructure is resolved last and outside capability
     // filtering. Registration rejects this reserved name, so this set is an
     // invariant assertion as well as protection against future layer changes.
-    if (this.codeTransport !== undefined) result.set(RUN_CODE_NAME, this.codeTransport)
-    return [...result.values()]
+    if (this.codeTransport !== undefined) {
+      visible.set(RUN_CODE_NAME, this.codeTransport)
+      // createRunCodeTool() owns this internal transport and always marks it owner-final.
+      ownerFinalNames.add(RUN_CODE_NAME)
+    }
+    return { visible, knownNames, restrictableNames, ownerFinalNames }
   }
 
   /**
-   * Look up a tool as one scope sees it ({@link visible} semantics: scoped
+   * Look up a tool as one scope sees it (scoped
    * shadows global; a restricted-away global reads as absent). Presenters pass
    * the calling agent so the rendered card matches the definition that
    * actually executed.
@@ -848,11 +859,7 @@ export class ToolRegistry extends Service {
    * @returns the definition the scope resolves, or undefined when none is visible.
    */
   get(name: string, scope?: ScopeKey): ToolDefinition | undefined {
-    if (name === RUN_CODE_NAME && this.codeTransport !== undefined) return this.codeTransport
-    const shadowed = scope === undefined ? undefined : this.scoped.get(scope)?.get(name)
-    if (shadowed) return shadowed
-    if (!this.admits(scope, name)) return undefined
-    return this.global.get(name)
+    return this.view(scope).visible.get(name)
   }
 
   /**
@@ -868,30 +875,17 @@ export class ToolRegistry extends Service {
    * @returns one deep-cloned schema per visible tool.
    */
   schemas(scope?: ScopeKey): ToolSchema[] {
-    return this.visible(scope).map(({ name, description, parameters }): ToolSchema => ({
-      name,
-      description,
-      parameters: structuredClone(parameters),
-    }))
+    return [...this.view(scope).visible.values()].map(definition => this.schemaOf(definition, true))
   }
 
-  /**
-   * The PRE-restriction END-CAPABILITY name universe for `scope`: every global
-   * name plus the scope's own layer, ignoring restrictions. This is the set
-   * `restrict()` validates against, so a typo fails loud while a
-   * restricted-away tool remains a normal, non-erroneous absence. Reserved
-   * presentation transports are deliberately absent: `restrict()` rejects
-   * naming one, while {@link wireSchemas} adds it to the separate `toolOrder`
-   * validation universe when its presentation mode contributes it.
-   * @param scope - the viewing scope (the agent); omitted = global names only.
-   * @returns the known names, deduplicated.
-   */
-  knownNames(scope?: ScopeKey): string[] {
-    const names = new Set(this.global.keys())
-    if (scope !== undefined) {
-      for (const name of this.scoped.get(scope)?.keys() ?? []) names.add(name)
+  /** Project one definition onto the model-facing schema fields. */
+  private schemaOf(definition: ToolDefinition, detachParameters: boolean): ToolSchema {
+    const { name, description, parameters } = definition
+    return {
+      name,
+      description,
+      parameters: detachParameters ? structuredClone(parameters) : parameters,
     }
-    return [...names]
   }
 
   /**
@@ -909,97 +903,57 @@ export class ToolRegistry extends Service {
    * restricted-away global is exactly as absent as a nonexistent one), the
    * result is an `isError` carrying a `UNKNOWN_TOOL` structured error. A thrown
    * {@link HarnessError} surfaces its `{ name, code }` on the result. Before
-   * the final observe-only notification, the authoritative outcome must survive
-   * a lossless JSON round trip; an invalid outcome is normalized to an error.
-   * A malformed runtime/casted `tools/pre-execute` decision likewise normalizes
-   * to an error before approval, guards, or the tool body.
-   * Caller-owned arguments must survive lossless-JSON validation before and
-   * after cloning; a violation normalizes to an error before policy or dispatch.
-   * @param exec - the single-use call input; its identity is snapshotted and
-   *   protected before policy runs.
-   * @returns the final result after every waterfall; failures resolve as
-   *   `isError` results, never rejections.
+   * the final observe-only notification, the authoritative outcome is
+   * materialized as a detached lossless-JSON snapshot; an invalid outcome is
+   * normalized to an error.
+   * @param exec - the typed same-process call input. The registry assigns its
+   *   correlation token before policy begins.
+   * @returns the materialized final result after every waterfall; listener and
+   *   tool failures resolve as `isError` results rather than rejections.
    */
   async execute(exec: ToolExecutionInput): Promise<ToolExecutionResult> {
+    const token = createExecutionToken()
+    const callId = exec.callId
+    const name = exec.name
+    const agent = exec.agent
+    const parent = exec.parent
+    const signal = exec.signal
+    const base = {
+      token,
+      callId,
+      name,
+      ...agent !== undefined ? { agent } : {},
+      ...parent !== undefined ? { parent } : {},
+      ...signal !== undefined ? { signal } : {},
+    }
     let execution: ToolExecution
     try {
-      execution = this.prepareExecution(exec)
+      const detached = snapshotJsonValue(exec.arguments)
+      if (detached === undefined) {
+        throw new TypeError('tool execution arguments must be losslessly JSON-serializable')
+      }
+      execution = {
+        ...base,
+        arguments: deepFreeze(detached),
+      }
     } catch (error: unknown) {
-      // Contract-violating non-JSON or non-cloneable arguments cannot enter a
-      // pipeline whose logged and executed forms must agree. Still publish one
-      // scoped final outcome, using an immutable identity shell, so result
-      // observers retain their every-call guarantee without seeing the invalid
-      // value.
-      execution = Object.freeze({
-        token: createExecutionToken(),
-        callId: exec.callId,
-        name: exec.name,
-        arguments: undefined,
-        ...exec.agent !== undefined ? { agent: exec.agent } : {},
-        ...isExecutionToken(exec.parent) ? { parent: exec.parent } : {},
-        ...exec.signal !== undefined ? { signal: exec.signal } : {},
-      })
-      const result = toolErrorResult(execution.callId, error)
+      execution = { ...base, arguments: undefined }
+      const result = this.materializeFinalResult(toolErrorResult(callId, error))
       await this.notifyResult(execution, result)
       return result
     }
     let result: ToolExecutionResult
     try {
-      // Validate the authoritative FINAL result, not merely the tool body's
-      // intermediate return. Post-policy may replace content or attach context,
-      // and every one of these fields is session-bound. Reject anything that
-      // cannot round-trip losslessly through the durable JSON log before the
-      // observe-only `tools/result` commit point sees success.
-      result = this.snapshotExecutionResult(execution, await this.executePipeline(execution))
+      result = this.materializeFinalResult(await this.executePipeline(execution))
     } catch (error: unknown) {
       // Outer backstop: a throwing pre/post-execute listener, guard, or the
       // waterfall machinery becomes an isError result, never a turn failure.
-      result = toolErrorResult(execution.callId, error)
+      result = this.materializeFinalResult(toolErrorResult(execution.callId, error))
     }
     await this.notifyResult(execution, result)
     return result
   }
 
-  /** Snapshot one call into a shared pipeline object with immutable identity and mutable cancellation. */
-  private prepareExecution(input: ToolExecutionInput): ToolExecution {
-    if (input.parent !== undefined && !isExecutionToken(input.parent)) {
-      throw new TypeError('tool execution parent must be a registry-minted opaque token')
-    }
-    if (!isJsonValue(input.arguments)) {
-      throw new TypeError('tool execution arguments must be losslessly JSON-serializable')
-    }
-    const args = structuredClone(input.arguments)
-    if (!isJsonValue(args)) {
-      throw new TypeError('tool execution arguments must be stable losslessly JSON-serializable data')
-    }
-    const execution: ToolExecution = {
-      token: createExecutionToken(),
-      callId: input.callId,
-      name: input.name,
-      arguments: deepFreeze(args),
-      ...input.agent !== undefined ? { agent: input.agent } : {},
-      ...input.parent !== undefined ? { parent: input.parent } : {},
-      ...input.signal !== undefined ? { signal: input.signal } : {},
-    }
-    Object.defineProperties(execution, {
-      token: { value: execution.token, enumerable: true, writable: false, configurable: false },
-      callId: { value: execution.callId, enumerable: true, writable: false, configurable: false },
-      name: { value: execution.name, enumerable: true, writable: false, configurable: false },
-      arguments: { value: execution.arguments, enumerable: true, writable: false, configurable: false },
-      agent: { value: input.agent, enumerable: true, writable: false, configurable: false },
-      parent: { value: input.parent, enumerable: true, writable: false, configurable: false },
-    })
-    if (input.signal !== undefined) {
-      Object.defineProperty(execution, 'signal', {
-        value: input.signal,
-        enumerable: true,
-        writable: true,
-        configurable: true,
-      })
-    }
-    return execution
-  }
-
   /** Run the transformable pipeline; {@link execute} owns final normalization and notification. */
   private async executePipeline(exec: ToolExecution): Promise<ToolExecutionResult> {
     // --- Gate: tools/pre-execute. An `ask` resolves through the optional
@@ -1007,10 +961,10 @@ export class ToolRegistry extends Service {
     // carrier keys dispatch by exec.agent, so an `agent.ctx` listener gates only
     // its own agent's calls (agent-less calls are subject-less).
     const carrier = scopeTarget(this, exec.agent)
-    const gate = this.snapshotPreDecision(await this.ctx.waterfall(
+    const gate = await this.ctx.waterfall(
       carrier, 'tools/pre-execute', exec,
       () => Promise.resolve<PreToolDecision>({ kind: 'allow' }),
-    ))
+    )
     const decision = gate.kind === 'ask' ? await this.serviceAsk(exec, gate) : gate
     const denialReason = decision.kind === 'allow'
       ? this.guardReason(exec)
@@ -1034,7 +988,7 @@ export class ToolRegistry extends Service {
     // before delegating and inspect the normalized result after. Dispatched with the
     // same carrier as the gate, so an `agent.ctx` wrapper wraps only its own
     // agent's calls. ---
-    const result = this.snapshotExecutionResult(exec, await this.ctx.waterfall(
+    const result = await this.ctx.waterfall(
       carrier, 'tools/execute', exec,
       async (): Promise<ToolExecutionResult> => {
         try {
@@ -1055,61 +1009,25 @@ export class ToolRegistry extends Service {
           return toolErrorResult(exec.callId, error)
         }
       },
-    ))
+    )
+    if (result.callId !== exec.callId) {
+      throw new TypeError(`tools/execute returned callId "${String(result.callId)}" for authoritative call "${exec.callId}"`)
+    }
 
     return await this.postExecute(exec, result)
   }
 
-  /** Validate and detach the extensible gate's decision before any grant can dispatch. */
-  private snapshotPreDecision(value: unknown): PreToolDecision {
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-      throw new TypeError('tools/pre-execute must return a PreToolDecision object')
-    }
-    const decision = value as { kind?: unknown; reason?: unknown }
-    const keys = Reflect.ownKeys(decision)
-    const hasExactKeys = (...expected: string[]): boolean =>
-      keys.length === expected.length && expected.every(key => Object.hasOwn(decision, key))
-    switch (decision.kind) {
-      case 'allow':
-        if (!hasExactKeys('kind')) {
-          throw new TypeError('tools/pre-execute allow decision must contain only kind')
-        }
-        return { kind: 'allow' }
-      case 'deny': {
-        const reason = decision.reason
-        if (!hasExactKeys('kind', 'reason') || typeof reason !== 'string') {
-          throw new TypeError('tools/pre-execute deny decision must contain only kind and a string reason')
-        }
-        return { kind: 'deny', reason }
-      }
-      case 'ask': {
-        const reason = decision.reason
-        if (!(hasExactKeys('kind') || hasExactKeys('kind', 'reason'))
-          || (reason !== undefined && typeof reason !== 'string')) {
-          throw new TypeError('tools/pre-execute ask decision must contain only kind and an optional string reason')
-        }
-        return { kind: 'ask', ...reason !== undefined ? { reason } : {} }
-      }
-      default:
-        throw new TypeError('tools/pre-execute must return an allow, deny, or ask decision')
-    }
-  }
-
   /** Notify final-result observers without giving them a mutation/error channel into the outcome. */
   private async notifyResult(exec: ToolExecution, result: ToolExecutionResult): Promise<void> {
     // The pipeline is over: freeze the remaining mutable signal slot so every
     // observer sees the SAME WeakMap-keyable execution without a mutation race.
     Object.freeze(exec)
-    // postExecute clones every accepted result/decision before rebuilding the
-    // outcome; all error paths construct plain data. The final result is thus
-    // structurally cloneable before it reaches this observe-only boundary.
-    const snapshot = deepFreeze(structuredClone(result))
     const callbacks = this.ctx.events.dispatch('parallel', [
-      scopeTarget(this, exec.agent), 'tools/result', exec, snapshot,
+      scopeTarget(this, exec.agent), 'tools/result', exec, result,
     ])
     await Promise.all(callbacks.map(async (callback) => {
       try {
-        await callback(exec, snapshot)
+        await callback(exec, result)
       } catch (error: unknown) {
         this.ctx.logger.warn(`tool "${exec.name}" (${exec.callId}): tools/result observer failed: ${errorMessage(error)}`)
       }
@@ -1163,104 +1081,40 @@ export class ToolRegistry extends Service {
    * Runs inside `execute`'s outer try/catch (a throwing listener → isError).
    */
   private async postExecute(exec: ToolExecution, result: ToolExecutionResult): Promise<ToolExecutionResult> {
-    // Snapshot the protected outcome BEFORE the waterfall. A listener receives
-    // the same `result` reference, so a post-waterfall read of `result.callId`/
-    // `.isError`/`.error` could carry a listener's mutation — violating the
-    // authoritative-call-id requirement and the "preserve the dispatched
-    // isError/error" contract. The decision is the ONLY sanctioned channel for a
-    // listener to change the outcome (block, or accept-with-replacement); the
-    // call id is always the authoritative `exec.callId`. Deep cloning protects
-    // nested content, error, and meta data from in-place listener mutation.
-    const dispatched = this.snapshotExecutionResult(exec, result)
-    const decision = structuredClone(await this.ctx.waterfall(
+    const decision = await this.ctx.waterfall(
       scopeTarget(this, exec.agent), 'tools/post-execute', exec, result,
       () => Promise.resolve<PostToolDecision>({ kind: 'accept' }),
-    ))
-    this.assertPostDecision(decision)
+    )
     const additionalContext = decision.additionalContext
     if (decision.kind === 'block') {
       return {
-        callId: dispatched.callId,
+        callId: result.callId,
         content: decision.feedback,
         isError: true,
         ...additionalContext ? { additionalContext } : {},
       }
     }
-    // accept: replace content if supplied, preserve the dispatched isError/error.
+    // Accept: replace content if supplied and preserve the dispatched outcome.
     return {
-      ...dispatched,
+      ...result,
       ...decision.content ? { content: decision.content } : {},
       ...additionalContext ? { additionalContext } : {},
     }
   }
 
-  /** Validate and detach an around-dispatch result before policy can observe or mutate it. */
-  private snapshotExecutionResult(exec: ToolExecution, value: unknown): ToolExecutionResult {
-    if (typeof value !== 'object' || value === null) {
-      throw new TypeError('tools/execute must return a ToolExecutionResult object')
-    }
-    const result = value as Partial<ToolExecutionResult>
-    if (!Array.isArray(result.content) || typeof result.isError !== 'boolean') {
-      throw new TypeError('tools/execute must return a ToolExecutionResult with content[] and boolean isError')
-    }
-    if (result.callId !== exec.callId) {
-      throw new TypeError(`tools/execute returned callId "${String(result.callId)}" for authoritative call "${exec.callId}"`)
-    }
-    const candidate = {
-      callId: exec.callId,
-      content: result.content,
-      isError: result.isError,
-      ...result.error !== undefined ? { error: result.error } : {},
-      ...result.additionalContext !== undefined ? { additionalContext: result.additionalContext } : {},
-      ...result.meta !== undefined ? { meta: result.meta } : {},
-    }
-    // Validate BEFORE cloning: structuredClone turns some forbidden exotic or
-    // class instances into plain objects, which would hide a lossy JSON
-    // boundary violation. Validate the detached clone again to contain hostile
-    // getters whose value changes between inspection and snapshotting.
-    if (!isJsonValue(candidate)) {
-      throw new TypeError('tools/execute must return a losslessly JSON-serializable ToolExecutionResult')
-    }
-    const snapshot = structuredClone(candidate)
-    if (!isJsonValue(snapshot)) {
-      throw new TypeError('tools/execute must return a stable losslessly JSON-serializable ToolExecutionResult')
-    }
-    return snapshot
-  }
-
-  /** Reject malformed JavaScript/casted post decisions at the public event boundary. */
-  private assertPostDecision(value: unknown): asserts value is PostToolDecision {
-    if (typeof value !== 'object' || value === null) {
-      throw new TypeError('tools/post-execute must return a PostToolDecision object')
-    }
-    const decision = value as Partial<PostToolDecision>
-    switch (decision.kind) {
-      case 'accept':
-        if (decision.content !== undefined && !Array.isArray(decision.content)) {
-          throw new TypeError('tools/post-execute accept content must be an array')
-        }
-        return
-      case 'block':
-        if (!Array.isArray(decision.feedback)) {
-          throw new TypeError('tools/post-execute block feedback must be an array')
-        }
-        return
-      default:
-        throw new TypeError('tools/post-execute must return an accept or block decision')
+  /** Materialize the authoritative commit outcome once, immediately before `tools/result`. */
+  private materializeFinalResult(result: ToolExecutionResult): ToolExecutionResult {
+    const detached = snapshotJsonValue(result)
+    if (detached === undefined) {
+      throw new TypeError('tool result must be losslessly JSON-serializable')
     }
+    return deepFreeze(detached)
   }
 }
 
-/** Mint a frozen, property-free correlation token whose identity is its value. */
+/** Mint a same-process correlation token whose identity is its value. */
 function createExecutionToken(): ToolExecutionToken {
-  const token = Object.freeze(Object.create(null)) as ToolExecutionToken
-  executionTokens.add(token)
-  return token
-}
-
-/** Runtime counterpart of the opaque token type, including `undefined` input. */
-function isExecutionToken(value: unknown): value is ToolExecutionToken {
-  return typeof value === 'object' && value !== null && executionTokens.has(value)
+  return Symbol('dsh.tool.execution') as ToolExecutionToken
 }
 
 function toolErrorResult(callId: ToolExecution['callId'], error: unknown): ToolExecutionResult {
diff --git a/packages/core/tools/src/schema.ts b/packages/core/tools/src/schema.ts
index 1a428ffd40..dc33a97299 100644
--- a/packages/core/tools/src/schema.ts
+++ b/packages/core/tools/src/schema.ts
@@ -287,21 +287,23 @@ export function validateArgs(spec: SchemaSpec, args: unknown): string[] {
 /** Options for {@link defineTool}. */
 export interface DefineToolOptions<S extends SchemaSpec> {
   /** Tool name (must be unique). */
-  name: string
+  readonly name: string
   /** Human-readable description sent to the model. */
-  description: string
+  readonly description: string
   /**
    * Parameter schema using the per-property-required DSL. Converted to
    * standard JSON Schema at runtime.
    */
-  parameters: S
+  readonly parameters: S
   /**
    * Optional cooperative tool-call timeout budget in milliseconds. When given it
    * must be a positive finite number; it is attached to the produced
    * {@link ToolDefinition} for `@deepseek-ai/dsh-timeout-policy` to enforce and
    * is never sent to the model.
    */
-  timeoutMs?: number
+  readonly timeoutMs?: number
+  /** Make this protocol tool's canonical wire presence or absence owner-final. */
+  readonly ownerFinal?: boolean
   /**
    * Tool execution function. `args` is typed as {@link InferArgs<S>} — zero
    * casts needed. Returns either a bare {@link ContentBlock}`[]` (model-facing
@@ -353,6 +355,7 @@ export interface DefineToolOptions<S extends SchemaSpec> {
  * Raw JSON-Schema tool definitions (from MCP servers) are still accepted
  * by `ToolRegistry.register()` directly — `defineTool` is sugar for
  * first-party plugin authors.
+ *
  * @param options - the tool's name, description, typed parameter schema,
  *   execute body, and optional presenters.
  * @returns a registry-ready {@link ToolDefinition}: its `execute` validates the
@@ -377,6 +380,7 @@ export function defineTool<S extends SchemaSpec>(options: DefineToolOptions<S>):
     description: options.description,
     parameters: schemaSpecToJsonSchema(options.parameters) as unknown as Record<string, unknown>,
     ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+    ...(options.ownerFinal === true ? { ownerFinal: true } : {}),
     async execute(args: unknown, exec: ToolExecution): Promise<ToolExecuteReturn> {
       // Validate the model-generated args before the typed body runs. On
       // mismatch we throw ToolArgsError; the registry turns it into an
diff --git a/packages/core/tools/tests/code-mode.spec.ts b/packages/core/tools/tests/code-mode.spec.ts
index da5725f10e..83dedbdb00 100644
--- a/packages/core/tools/tests/code-mode.spec.ts
+++ b/packages/core/tools/tests/code-mode.spec.ts
@@ -215,41 +215,24 @@ describe('mode-aware wire contribution', () => {
     expect(() => scope.ctx.tools.register(impostor)).toThrow(/reserved for the Code Mode presentation transport/)
     expect(() => ctx.tools.register(impostor)).toThrow(/reserved for the Code Mode presentation transport/)
     expect(() => scope.ctx.systemPrompt.section({ name: 'tools:sdk', order: -999, text: 'malicious SDK' }))
-      .toThrow(/globally protected and cannot be shadowed/)
+      .toThrow(/globally owner-final and cannot be shadowed/)
     expect(() => scope.ctx.tools.restrict({ allow: [RUN_CODE_NAME] })).toThrow(/cannot name reserved Code Mode presentation transport/)
     expect(() => scope.ctx.tools.restrict({ deny: [RUN_CODE_NAME] })).toThrow(/cannot name reserved Code Mode presentation transport/)
-    const transport = ctx.tools.get(RUN_CODE_NAME)!
-    expect(Object.isFrozen(transport)).toBe(true)
-    expect(Object.isFrozen(transport.parameters)).toBe(true)
-    expect(() => { transport.name = 'mutated_transport' }).toThrow(TypeError)
-
-    const mutableSection = { name: 'scoped-note', order: 149, text: 'safe note' }
-    scope.ctx.systemPrompt.section(mutableSection)
-    mutableSection.name = 'tools:sdk'
-    mutableSection.text = 'mutated SDK'
-    const mutableTool = defineTool({
+    scope.ctx.systemPrompt.section({ name: 'scoped-note', order: 149, text: 'safe note' })
+    scope.ctx.tools.register(defineTool({
       name: 'scoped_safe',
       description: 'Safe scoped tool.',
       parameters: {},
       execute: () => Promise.resolve([{ type: 'text' as const, text: 'safe' }]),
-    })
-    scope.ctx.tools.register(mutableTool)
-    mutableTool.name = RUN_CODE_NAME
-    mutableTool.description = 'Mutated transport impostor.'
-    const stored = ctx.tools.get('scoped_safe', agent)!
-    expect(Object.isFrozen(stored)).toBe(true)
-    expect(Object.isFrozen(stored.parameters)).toBe(true)
-    expect(() => { stored.name = RUN_CODE_NAME }).toThrow(TypeError)
+    }))
 
     const assembly = await systemPrompt.assemble({ scope: agent })
     const transports = assembly.tools.filter(tool => tool.name === RUN_CODE_NAME)
     expect(transports).toHaveLength(1)
     expect(transports[0]?.description).toContain('Execute a TypeScript program')
-    expect(assembly.sections.find(section => section.name === 'tools:sdk')?.text).not.toContain('mutated SDK')
     expect(assembly.sections.find(section => section.name === 'scoped-note')?.text).toBe('safe note')
     expect(assembly.sections.find(section => section.name === 'tools:sdk')?.text).toContain('scoped_safe(args:')
     expect(ctx.tools.get(RUN_CODE_NAME, agent)).toBe(ctx.tools.get(RUN_CODE_NAME))
-    expect(ctx.tools.knownNames(agent)).not.toContain(RUN_CODE_NAME)
     const result = await runCode(ctx, 'return 1', { agent })
     expect(result.content).toEqual([{ type: 'text', text: '(run_code completed with no output)' }])
   })
@@ -262,7 +245,6 @@ describe('mode-aware wire contribution', () => {
     registerEcho(ctx)
     const { agent } = await mintAgentScope(ctx)
 
-    expect(ctx.tools.knownNames(agent)).toEqual(['echo'])
     const assembly = await systemPrompt.assemble({ scope: agent })
     expect(assembly.tools.map(tool => tool.name)).toEqual(mode === 'code'
       ? [RUN_CODE_NAME]
diff --git a/packages/core/tools/tests/scoped.spec.ts b/packages/core/tools/tests/scoped.spec.ts
index cac4a7e29b..991d420054 100644
--- a/packages/core/tools/tests/scoped.spec.ts
+++ b/packages/core/tools/tests/scoped.spec.ts
@@ -4,7 +4,7 @@ import { createScope } from '@deepseek-ai/dsh-scope'
 import type { Scope } from '@deepseek-ai/dsh-scope'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
-import type { PreToolDecision, ToolDefinition, ToolExecution, ToolExecutionToken } from '@deepseek-ai/dsh-tools'
+import type { PreToolDecision, ToolDefinition, ToolExecution, ToolExecutionInput, ToolExecutionToken } from '@deepseek-ai/dsh-tools'
 import type { Agent, AgentId } from '@deepseek-ai/dsh-agent'
 import { CallId } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
@@ -89,6 +89,35 @@ describe('scoped tool registration', () => {
     expect(() => scope.ctx.tools.register(tool('y'))).toThrow(/already registered in this scope/)
   })
 
+  it('rejects either registration order between a global owner-final tool and a scoped shadow', async () => {
+    const first = await mount()
+    const { scope: firstScope } = await mintAgentScope(first, 'first')
+    first.tools.register({ ...tool('reserved'), ownerFinal: true })
+    expect(() => firstScope.ctx.tools.register(tool('reserved')))
+      .toThrow(/globally owner-final and cannot be shadowed/)
+
+    const second = await mount()
+    const { scope: secondScope } = await mintAgentScope(second, 'second')
+    secondScope.ctx.tools.register(tool('reserved'))
+    expect(() => second.tools.register({ ...tool('reserved'), ownerFinal: true }))
+      .toThrow(/owner-final tool "reserved" cannot be registered while a scoped shadow exists/)
+  })
+
+  it('restores global and scoped owner-final tools removed by assembly middleware', async () => {
+    const ctx = await mount()
+    const { scope, key } = await mintAgentScope(ctx, 'owner-final')
+    ctx.tools.register({ ...tool('required'), ownerFinal: true })
+    scope.ctx.tools.register({ ...tool('scoped-required'), ownerFinal: true })
+    ctx.on('system-prompt/assemble', async assembly => ({
+      ...assembly,
+      tools: assembly.tools.filter(schema => !schema.name.includes('required')),
+    }))
+
+    expect((await ctx.systemPrompt.assemble()).tools.map(schema => schema.name)).toContain('required')
+    expect((await ctx.systemPrompt.assemble({ scope: key })).tools.map(schema => schema.name))
+      .toEqual(expect.arrayContaining(['required', 'scoped-required']))
+  })
+
   it('disposing the scope unwinds its registrations and leaves no residue', async () => {
     const ctx = await mount()
     const { scope, key } = await mintAgentScope(ctx, 'a')
@@ -96,12 +125,12 @@ describe('scoped tool registration', () => {
     expect(ctx.tools.get('mine', key)).toBeDefined()
     await scope.dispose()
     expect(ctx.tools.get('mine', key)).toBeUndefined()
-    expect(ctx.tools.knownNames(key)).toEqual([])
+    expect(ctx.tools.schemas(key)).toEqual([])
   })
 })
 
 describe('restrict()', () => {
-  it('masks global tools for the scope; grants bypass; assembly and execute agree', async () => {
+  it('masks global tools, merges scope-local tools afterward, and keeps assembly with execution', async () => {
     const ctx = await mount()
     const { scope, key } = await mintAgentScope(ctx, 'a')
     ctx.tools.register(tool('read'))
@@ -109,7 +138,7 @@ describe('restrict()', () => {
     scope.ctx.tools.register(tool('capture'))
     scope.ctx.tools.restrict({ allow: ['read'] })
 
-    // The scoped grant survives the allow-list; the unlisted global is gone.
+    // The scope-local registration survives the allow-list; the unlisted global is gone.
     expect(ctx.tools.schemas(key).map(t => t.name).sort()).toEqual(['capture', 'read'])
     expect(await run(ctx, 'bash', key)).toBe('Error: unknown tool "bash"')
     expect(await run(ctx, 'read', key)).toBe('ran:read')
@@ -118,6 +147,29 @@ describe('restrict()', () => {
     expect(ctx.tools.schemas().map(t => t.name).sort()).toEqual(['bash', 'read'])
   })
 
+  it('applies snapshotted filters to the live global registry before merging later scope-local tools', async () => {
+    const ctx = await mount()
+    const denied = await mintAgentScope(ctx, 'denied')
+    const allowed = await mintAgentScope(ctx, 'allowed')
+    ctx.tools.register(tool('read'))
+    ctx.tools.register(tool('bash'))
+    denied.scope.ctx.tools.restrict({ deny: ['bash'] })
+    allowed.scope.ctx.tools.restrict({ allow: ['read'] })
+
+    ctx.tools.register(tool('web'))
+    denied.scope.ctx.tools.register(tool('denied-local'))
+    allowed.scope.ctx.tools.register(tool('allowed-local'))
+
+    expect(ctx.tools.schemas(denied.key).map(t => t.name).sort())
+      .toEqual(['denied-local', 'read', 'web'])
+    expect(ctx.tools.schemas(allowed.key).map(t => t.name).sort())
+      .toEqual(['allowed-local', 'read'])
+    expect(await run(ctx, 'web', denied.key)).toBe('ran:web')
+    expect(await run(ctx, 'web', allowed.key)).toBe('Error: unknown tool "web"')
+    expect(await run(ctx, 'denied-local', denied.key)).toBe('ran:denied-local')
+    expect(await run(ctx, 'allowed-local', allowed.key)).toBe('ran:allowed-local')
+  })
+
   it('composes multiple restrictions by intersection and lifts each independently', async () => {
     const ctx = await mount()
     const { scope, key } = await mintAgentScope(ctx, 'a')
@@ -130,7 +182,7 @@ describe('restrict()', () => {
     expect(ctx.tools.schemas(key).map(t => t.name).sort()).toEqual(['a', 'c'])
   })
 
-  it('snapshots the filter at registration (caller mutation changes nothing)', async () => {
+  it('compiles the readonly filter values at registration', async () => {
     const ctx = await mount()
     const { scope, key } = await mintAgentScope(ctx, 'a')
     ctx.tools.register(tool('a'))
@@ -141,19 +193,21 @@ describe('restrict()', () => {
     expect(ctx.tools.schemas(key).map(t => t.name)).toEqual(['b'])
   })
 
-  it('fails loud on an unscoped call, an empty filter, and unknown names', async () => {
+  it('fails loud on an unscoped call, an empty filter, and non-global names', async () => {
     const ctx = await mount()
     const { scope } = await mintAgentScope(ctx, 'a')
     ctx.tools.register(tool('real'))
+    scope.ctx.tools.register(tool('local'))
     expect(() => ctx.tools.restrict({ deny: ['real'] })).toThrow(/requires a scoped context/)
     expect(() => scope.ctx.tools.restrict({})).toThrow(/no-op/)
-    expect(() => scope.ctx.tools.restrict({ allow: ['reall'] })).toThrow(/unknown tool "reall"; known tools for this scope: real/)
-    expect(() => scope.ctx.tools.restrict({ deny: ['ghost', 'wraith'] })).toThrow(/unknown tools "ghost", "wraith"/)
+    expect(() => scope.ctx.tools.restrict({ allow: ['local'] })).toThrow(/unknown global tool "local"/)
+    expect(() => scope.ctx.tools.restrict({ allow: ['reall'] })).toThrow(/unknown global tool "reall"; known global tools: real/)
+    expect(() => scope.ctx.tools.restrict({ deny: ['ghost', 'wraith'] })).toThrow(/unknown global tools "ghost", "wraith"/)
 
     const emptyCtx = await mount()
     const { scope: emptyScope } = await mintAgentScope(emptyCtx, 'empty')
     expect(() => emptyScope.ctx.tools.restrict({ deny: ['ghost'] }))
-      .toThrow(/known tools for this scope: \(none\)/)
+      .toThrow(/known global tools: \(none\)/)
   })
 })
 
@@ -188,9 +242,8 @@ describe('scoped execution dispatch', () => {
         return Promise.resolve([{ type: 'text', text: 'ran:t' }])
       },
     })
-    let guardViewFrozen = false
     const guard = (execution: Readonly<ToolExecution>): string => {
-      guardViewFrozen = Object.isFrozen(execution) && Object.isFrozen(execution.arguments)
+      expect(Object.isFrozen(execution.arguments)).toBe(true)
       return 'terminal policy'
     }
     const liftFirst = scope.ctx.tools.guard(guard)
@@ -201,7 +254,6 @@ describe('scoped execution dispatch', () => {
     scope.ctx.on('tools/pre-execute', () => Promise.resolve({ kind: 'allow' }), { prepend: true })
 
     expect(await run(ctx, 't', key)).toBe('Error: terminal policy')
-    expect(guardViewFrozen).toBe(true)
     expect(await run(ctx, 't', other)).toBe('ran:t')
     expect(bodyCalls).toBe(1)
 
@@ -229,13 +281,14 @@ describe('scoped execution dispatch', () => {
     expect(bodyCalls).toBe(0)
   })
 
-  it('protects call identity before policy and dispatch while leaving only signal mutable', async () => {
+  it('shares one token and materialized argument value across the pipeline', async () => {
     const ctx = await mount()
     const { scope, key } = await mintAgentScope(ctx, 'a')
     let safeCalls = 0
     let dangerCalls = 0
     let scopedResults = 0
     let safeArguments: unknown
+    const tokens = new Set<ToolExecutionToken>()
     ctx.tools.register({
       ...tool('safe'),
       execute: (args) => {
@@ -253,17 +306,16 @@ describe('scoped execution dispatch', () => {
     })
     scope.ctx.tools.guard(exec => exec.name === 'danger' ? 'danger denied' : undefined)
     ctx.on('tools/pre-execute', (exec, next) => {
-      expect(Reflect.set(exec, 'agent', undefined)).toBe(false)
-      expect(Reflect.set(exec, 'name', 'safe')).toBe(false)
-      expect(Reflect.set(exec.arguments as object, 'injected', true)).toBe(false)
+      tokens.add(exec.token)
+      expect(Object.isFrozen(exec.arguments)).toBe(true)
       return next()
     })
     ctx.on('tools/execute', (exec, next) => {
-      expect(Reflect.set(exec, 'name', 'danger')).toBe(false)
+      tokens.add(exec.token)
       return next()
     })
     ctx.on('tools/post-execute', (exec, _result, next) => {
-      expect(Reflect.set(exec, 'agent', undefined)).toBe(false)
+      tokens.add(exec.token)
       return next()
     })
     scope.ctx.on('tools/result', () => { scopedResults += 1 })
@@ -281,6 +333,8 @@ describe('scoped execution dispatch', () => {
     expect(safeArguments).not.toBe(callerArguments)
     expect(Object.isFrozen(safeArguments)).toBe(true)
     expect(callerArguments).toEqual({ source: true })
+    // One token for danger and one shared by every phase of safe.
+    expect(tokens.size).toBe(2)
     expect({ safeCalls, dangerCalls, scopedResults }).toEqual({
       safeCalls: 1,
       dangerCalls: 0,
@@ -353,23 +407,114 @@ describe('scoped execution dispatch', () => {
     expect(callerArguments.invalid).toBeTypeOf('function')
   })
 
-  it('rejects a forged mutable parent token without exposing it to final observers', async () => {
+  it('reads a stateful parent accessor once before policy, dispatch, and result observation', async () => {
     const ctx = await mount()
-    ctx.tools.register(tool('t'))
-    const forged = { mutable: true } as unknown as ToolExecutionToken
-    let observedParent: ToolExecutionToken | undefined = forged
-    ctx.on('tools/result', (exec) => { observedParent = exec.parent })
-
-    const result = await ctx.tools.execute({
-      callId: CallId('forged-parent'), name: 't', arguments: {}, parent: forged,
+    const observed: (ToolExecutionToken | undefined)[] = []
+    ctx.tools.register({
+      ...tool('t'),
+      execute: (_args, exec) => {
+        observed.push(exec.parent)
+        return Promise.resolve([{ type: 'text', text: 'ran:t' }])
+      },
     })
+    ctx.on('tools/pre-execute', (exec, next) => {
+      observed.push(exec.parent)
+      return next()
+    })
+    ctx.on('tools/execute', (exec, next) => {
+      observed.push(exec.parent)
+      return next()
+    })
+    ctx.on('tools/result', (exec) => { observed.push(exec.parent) })
+    const forged = { fake: true } as unknown as ToolExecutionToken
+    let parentReads = 0
+    const input = {
+      callId: CallId('stateful-parent'),
+      name: 't',
+      arguments: {},
+      get parent(): ToolExecutionToken | undefined {
+        parentReads += 1
+        return parentReads === 1 ? undefined : forged
+      },
+    } as ToolExecutionInput
+
+    const result = await ctx.tools.execute(input)
+
+    expect(result.isError).toBe(false)
+    expect(parentReads).toBe(1)
+    expect(observed).toEqual([undefined, undefined, undefined, undefined])
+  })
+
+  it('uses one input snapshot for the normalized error shell', async () => {
+    const ctx = await mount()
+    const { scope, key } = await mintAgentScope(ctx, 'accepted')
+    const driftAgent = { id: 'drift' as AgentId } as Agent
+    ctx.tools.register(tool('parent'))
+    ctx.tools.register(tool('t'))
+    let parent!: ToolExecutionToken
+    const stopCapture = ctx.on('tools/pre-execute', (exec, next) => {
+      if (exec.name === 'parent') parent = exec.token
+      return next()
+    })
+    await ctx.tools.execute({ callId: CallId('parent'), name: 'parent', arguments: {} })
+    stopCapture()
+    const acceptedSignal = new AbortController().signal
+    const driftSignal = new AbortController().signal
+    const forged = { fake: true } as unknown as ToolExecutionToken
+    const reads = { callId: 0, name: 0, arguments: 0, agent: 0, parent: 0, signal: 0 }
+    const input = {
+      get callId() { reads.callId += 1; return CallId('unstable-error') },
+      get name() { reads.name += 1; return 't' },
+      get arguments(): unknown { reads.arguments += 1; return { invalid: () => undefined } },
+      get agent() { reads.agent += 1; return reads.agent === 1 ? key : driftAgent },
+      get parent() { reads.parent += 1; return reads.parent <= 2 ? parent : forged },
+      get signal() { reads.signal += 1; return reads.signal === 1 ? acceptedSignal : driftSignal },
+    } as ToolExecutionInput
+    let observed: Readonly<ToolExecution> | undefined
+    let scopedObserved = 0
+    ctx.on('tools/result', (exec) => { observed = exec })
+    scope.ctx.on('tools/result', () => { scopedObserved += 1 })
+
+    const result = await ctx.tools.execute(input)
 
     expect(result.isError).toBe(true)
-    expect(result.content).toEqual([{
-      type: 'text', text: 'Error: tool execution parent must be a registry-minted opaque token',
-    }])
-    expect(observedParent).toBeUndefined()
-    expect(Object.isFrozen(forged)).toBe(false)
+    expect(reads).toEqual({ callId: 1, name: 1, arguments: 1, agent: 1, parent: 1, signal: 1 })
+    expect(scopedObserved).toBe(1)
+    expect(observed).toMatchObject({
+      callId: CallId('unstable-error'),
+      name: 't',
+      agent: key,
+      parent,
+      signal: acceptedSignal,
+    })
+    expect(Object.isFrozen(observed)).toBe(true)
+  })
+
+  it('normalizes a throwing arguments accessor without rereading it or losing the final notification', async () => {
+    const ctx = await mount()
+    ctx.tools.register(tool('t'))
+    let argumentReads = 0
+    let observed = 0
+    ctx.on('tools/result', (exec, result) => {
+      observed += 1
+      expect(exec.arguments).toBeUndefined()
+      expect(result.isError).toBe(true)
+    })
+    const input = {
+      callId: CallId('throwing-arguments'),
+      name: 't',
+      get arguments(): unknown {
+        argumentReads += 1
+        throw new Error('getter exploded')
+      },
+    } as ToolExecutionInput
+
+    const result = await ctx.tools.execute(input)
+
+    expect(result.isError).toBe(true)
+    expect(result.content).toEqual([{ type: 'text', text: 'Error: getter exploded' }])
+    expect(argumentReads).toBe(1)
+    expect(observed).toBe(1)
   })
 
   it.each([
@@ -408,7 +553,7 @@ describe('scoped execution dispatch', () => {
     expect({ policyCalls, bodyCalls, observed }).toEqual({ policyCalls: 0, bodyCalls: 0, observed: 1 })
   })
 
-  it('rejects arguments that change to non-JSON data while being snapshotted', async () => {
+  it('reads nested arguments once into the executed snapshot', async () => {
     const ctx = await mount()
     ctx.tools.register(tool('t'))
     let reads = 0
@@ -421,12 +566,11 @@ describe('scoped execution dispatch', () => {
       callId: CallId('unstable-arguments'), name: 't', arguments: argumentsValue,
     })
 
+    expect(reads).toBe(1)
     expect(result).toEqual({
       callId: CallId('unstable-arguments'),
-      content: [{
-        type: 'text', text: 'Error: tool execution arguments must be stable losslessly JSON-serializable data',
-      }],
-      isError: true,
+      content: [{ type: 'text', text: 'ran:t' }],
+      isError: false,
     })
   })
 
diff --git a/packages/core/tools/tests/tools.spec.ts b/packages/core/tools/tests/tools.spec.ts
index deb53b7dc7..4c52ba7910 100644
--- a/packages/core/tools/tests/tools.spec.ts
+++ b/packages/core/tools/tests/tools.spec.ts
@@ -7,7 +7,7 @@ import ApprovalService, { type ApprovalOutcome, type ApprovalRequest } from '@de
 import ToolRegistry, {
   defineTool, schemaSpecToJsonSchema, validateArgs, ToolArgsError, ToolNotFoundError,
   type InferArgs, type SchemaSpec, type PreToolDecision, type PostToolDecision,
-  type ToolExecution, type ToolExecutionResult, type ToolGuard,
+  type ToolExecution, type ToolExecutionResult,
 } from '@deepseek-ai/dsh-tools'
 
 async function setup() {
@@ -135,33 +135,6 @@ describe('ToolRegistry', () => {
     expect(observedError).toBe(true)
   })
 
-  it('normalizes a result that changes to non-JSON data while being snapshotted', async () => {
-    const ctx = await setup()
-    ctx.tools.register(echoTool)
-    let reads = 0
-    const hostileBlock = Object.defineProperty({ type: 'text' }, 'text', {
-      enumerable: true,
-      get: () => ++reads === 1 ? 'safe' : new Map([['mutable', true]]),
-    })
-    ctx.on('tools/execute', async exec => ({
-      callId: exec.callId,
-      content: [hostileBlock],
-      isError: false,
-    }) as unknown as ToolExecutionResult)
-
-    const result = await ctx.tools.execute({
-      callId: CallId('unstable-result'), name: 'echo', arguments: {},
-    })
-
-    expect(result).toEqual({
-      callId: CallId('unstable-result'),
-      content: [{
-        type: 'text', text: 'Error: tools/execute must return a stable losslessly JSON-serializable ToolExecutionResult',
-      }],
-      isError: true,
-    })
-  })
-
   it('returns isError results for unknown tools and throwing tools', async () => {
     const ctx = await setup()
     ctx.tools.register({
@@ -229,85 +202,6 @@ describe('ToolRegistry', () => {
     expect(result.content[0]).toMatchObject({ text: 'Error: denied by policy' })
   })
 
-  it.each([
-    {
-      name: 'non-object decision',
-      replacement: null,
-      message: 'tools/pre-execute must return a PreToolDecision object',
-    },
-    {
-      name: 'unknown decision kind',
-      replacement: { kind: 'permit' },
-      message: 'tools/pre-execute must return an allow, deny, or ask decision',
-    },
-    {
-      name: 'allow decision carrying extra fields',
-      replacement: { kind: 'allow', reason: 'smuggled' },
-      message: 'tools/pre-execute allow decision must contain only kind',
-    },
-    {
-      name: 'deny decision without a reason',
-      replacement: { kind: 'deny' },
-      message: 'tools/pre-execute deny decision must contain only kind and a string reason',
-    },
-    {
-      name: 'deny decision with a non-string reason',
-      replacement: { kind: 'deny', reason: 42 },
-      message: 'tools/pre-execute deny decision must contain only kind and a string reason',
-    },
-    {
-      name: 'ask decision with a non-string reason',
-      replacement: { kind: 'ask', reason: true },
-      message: 'tools/pre-execute ask decision must contain only kind and an optional string reason',
-    },
-    {
-      name: 'ask decision carrying extra fields',
-      replacement: { kind: 'ask', cache: true },
-      message: 'tools/pre-execute ask decision must contain only kind and an optional string reason',
-    },
-  ])('fails closed on a malformed tools/pre-execute $name', async ({ replacement, message }) => {
-    const ctx = await setup()
-    let bodyCalls = 0
-    const observed: ToolExecutionResult[] = []
-    ctx.tools.register({
-      ...echoTool,
-      async execute() {
-        bodyCalls += 1
-        return []
-      },
-    })
-    ctx.on('tools/pre-execute', async () => replacement as unknown as PreToolDecision)
-    ctx.on('tools/result', (_exec, result) => { observed.push(result) })
-
-    const result = await ctx.tools.execute({
-      callId: CallId('malformed-pre'), name: 'echo', arguments: {},
-    })
-
-    expect(result.isError).toBe(true)
-    expect(result.content[0]).toMatchObject({ text: `Error: ${message}` })
-    expect(bodyCalls).toBe(0)
-    expect(observed).toEqual([result])
-  })
-
-  it('rejects a JavaScript guard that returns an async/non-string decision', async () => {
-    const ctx = await setup()
-    let bodyCalls = 0
-    ctx.tools.register({
-      ...echoTool,
-      async execute() {
-        bodyCalls += 1
-        return []
-      },
-    })
-    ctx.tools.guard((() => Promise.resolve('late denial')) as unknown as ToolGuard)
-
-    const result = await ctx.tools.execute({ callId: CallId('bad-guard'), name: 'echo', arguments: {} })
-    expect(result.isError).toBe(true)
-    expect(result.content[0]?.type === 'text' && result.content[0].text)
-      .toContain('tools.guard() must return')
-    expect(bodyCalls).toBe(0)
-  })
-
   it('an ask decision degrades to deny when no approval seam is mounted', async () => {
     const ctx = await setup()
     ctx.tools.register(echoTool)
@@ -484,55 +378,6 @@ describe('ToolRegistry', () => {
     expect(result.additionalContext).toMatchObject({ content: [{ text: 'fyi' }], source: { kind: 'plugin', plugin: 'test' } })
   })
 
-  it('a post-execute listener cannot mutate any nested part of the dispatched result', async () => {
-    // The decision is the ONLY sanctioned channel to change the outcome. A
-    // listener that reaches in and mutates the passed result reference (flipping
-    // isError, rewriting callId, attaching a bogus error) must NOT affect what
-    // execute() returns — the registry snapshots the authoritative fields before
-    // the waterfall and rebuilds from the snapshot + decision.
-    const ctx = await setup()
-    ctx.tools.register(echoTool)
-    ctx.on('tools/execute', async (_exec, next) => {
-      await next()
-      return {
-        callId: CallId('c1'),
-        content: [{ type: 'text', text: 'original' }],
-        isError: true,
-        error: { name: 'OriginalError', code: 'ORIGINAL' },
-        meta: { nested: { label: 'original' } },
-      }
-    })
-
-    ctx.on('tools/post-execute', async (_exec, result, next) => {
-      const mutable = result as {
-        callId: string
-        isError: boolean
-        error?: { name: string; code: string }
-        content: { type: 'text'; text: string }[]
-        meta?: { nested: { label: string } }
-      }
-      mutable.callId = 'hijacked'
-      mutable.isError = false
-      if (mutable.error) {
-        mutable.error.name = 'Evil'
-        mutable.error.code = 'EVIL'
-      }
-      mutable.content[0]!.text = 'MUTATED'
-      mutable.content.push({ type: 'text', text: 'INJECTED' }) // in-place array mutation
-      if (mutable.meta) mutable.meta.nested.label = 'MUTATED'
-      return next() // delegate to the default accept — no decision-level override
-    })
-
-    const result = await ctx.tools.execute({ callId: CallId('c1'), name: 'echo', arguments: { text: 'hi' } })
-    expect(result.callId).toBe(CallId('c1'))   // authoritative exec.callId, not 'hijacked'
-    expect(result.isError).toBe(true)
-    expect(result.error).toEqual({ name: 'OriginalError', code: 'ORIGINAL' })
-    expect(result.content).toHaveLength(1)       // the in-place push did not leak in
-    expect(result.content[0]).toMatchObject({ text: 'original' })
-    expect(result.content.some(b => (b as { text?: string }).text === 'INJECTED')).toBe(false)
-    expect(result.meta).toEqual({ nested: { label: 'original' } })
-  })
-
   it('composes pre + post waterfalls around dispatch (sandbox-wrap pattern)', async () => {
     const ctx = await setup()
     ctx.tools.register(echoTool)
@@ -711,87 +556,20 @@ describe('ToolRegistry', () => {
     })
   })
 
-  it('normalizes malformed tools/execute results instead of treating them as success', async () => {
+  it('normalizes a tools/execute result with the wrong call id', async () => {
     const ctx = await setup()
     ctx.tools.register(echoTool)
-    let observedError: boolean | undefined
-    ctx.on('tools/execute', async (_exec, next) => {
-      await next()
-      return {} as ToolExecutionResult
-    })
-    ctx.on('tools/result', (_exec, result) => { observedError = result.isError })
-
-    const result = await ctx.tools.execute({ callId: CallId('malformed'), name: 'echo', arguments: {} })
-    expect(result.isError).toBe(true)
-    expect(result.content[0]).toMatchObject({
-      text: 'Error: tools/execute must return a ToolExecutionResult with content[] and boolean isError',
-    })
-    expect(observedError).toBe(true)
-  })
-
-  it.each([
-    {
-      name: 'non-object result',
-      replacement: null,
-      message: 'tools/execute must return a ToolExecutionResult object',
-    },
-    {
-      name: 'wrong call id',
-      replacement: { callId: CallId('other'), content: [], isError: false },
-      message: 'tools/execute returned callId "other" for authoritative call "malformed-shape"',
-    },
-  ])('normalizes a tools/execute $name', async ({ replacement, message }) => {
-    const ctx = await setup()
-    ctx.tools.register(echoTool)
-    ctx.on('tools/execute', async () => replacement as ToolExecutionResult)
+    ctx.on('tools/execute', async () => ({ callId: CallId('other'), content: [], isError: false }))
 
     const result = await ctx.tools.execute({
       callId: CallId('malformed-shape'), name: 'echo', arguments: {},
     })
     expect(result.isError).toBe(true)
-    expect(result.content[0]).toMatchObject({ text: `Error: ${message}` })
-  })
-
-  it('normalizes malformed tools/post-execute decisions', async () => {
-    const ctx = await setup()
-    ctx.tools.register(echoTool)
-    ctx.on('tools/post-execute', async () => ({ kind: 'accept', content: 'not blocks' }) as unknown as PostToolDecision)
-
-    const result = await ctx.tools.execute({ callId: CallId('malformed-post'), name: 'echo', arguments: {} })
-    expect(result.isError).toBe(true)
     expect(result.content[0]).toMatchObject({
-      text: 'Error: tools/post-execute accept content must be an array',
+      text: 'Error: tools/execute returned callId "other" for authoritative call "malformed-shape"',
     })
   })
 
-  it.each([
-    {
-      name: 'non-object decision',
-      replacement: null,
-      message: 'tools/post-execute must return a PostToolDecision object',
-    },
-    {
-      name: 'block without feedback blocks',
-      replacement: { kind: 'block', feedback: 'not blocks' },
-      message: 'tools/post-execute block feedback must be an array',
-    },
-    {
-      name: 'unknown decision kind',
-      replacement: { kind: 'defer' },
-      message: 'tools/post-execute must return an accept or block decision',
-    },
-  ])('normalizes a tools/post-execute $name', async ({ replacement, message }) => {
-    const ctx = await setup()
-    ctx.tools.register(echoTool)
-    ctx.on('tools/post-execute', async () => replacement as unknown as PostToolDecision)
-
-    const result = await ctx.tools.execute({
-      callId: CallId('malformed-post-shape'), name: 'echo', arguments: {},
-    })
-    expect(result.isError).toBe(true)
-    expect(result.content[0]).toMatchObject({ text: `Error: ${message}` })
-  })
-
   it('returns an isError result when a tools/execute listener throws', async () => {
     const ctx = await setup()
     ctx.tools.register(echoTool)
@@ -869,59 +647,12 @@ describe('ToolRegistry', () => {
     }])
   })
 
-  it.each([
-    ['Map', new Map([['mutable', true]])],
-    ['class instance', new (class Parameters { value = 1 })()],
-  ])('rejects cloneable non-JSON tool parameters (%s) without registry residue', async (_kind, parameters) => {
+  it('rejects a non-positive or non-finite registration timeout', async () => {
     const ctx = await setup()
-    const definition = {
-      ...echoTool,
-      name: 'invalid-parameters',
-      parameters,
-    } as unknown as typeof echoTool
-
-    expect(() => ctx.tools.register(definition)).toThrow(
-      'tool parameters must be losslessly JSON-serializable',
-    )
-    expect(ctx.tools.get('invalid-parameters')).toBeUndefined()
-  })
-
-  it('rejects tool parameters that change to non-JSON data while being snapshotted', async () => {
-    const ctx = await setup()
-    let reads = 0
-    const parameters = Object.defineProperty({}, 'properties', {
-      enumerable: true,
-      get: () => ++reads === 1 ? {} : new Map([['mutable', true]]),
-    })
-
-    expect(() => ctx.tools.register({
-      ...echoTool,
-      name: 'unstable-parameters',
-      parameters,
-    })).toThrow('tool parameters must be stable losslessly JSON-serializable data')
-    expect(ctx.tools.get('unstable-parameters')).toBeUndefined()
-  })
-
-  it('snapshots callbacks while preserving their registration-time method receiver', async () => {
-    const ctx = await setup()
-    const receivers: object[] = []
-    const definition = {
-      ...echoTool,
-      name: 'callback-snapshot',
-      async execute() {
-        receivers.push(this)
-        return [{ type: 'text' as const, text: 'original' }]
-      },
-    }
-    ctx.tools.register(definition)
-    definition.execute = async () => [{ type: 'text' as const, text: 'replacement' }]
-
-    const result = await ctx.tools.execute({
-      callId: CallId('callback-snapshot'), name: definition.name, arguments: {},
-    })
-
-    expect(receivers).toEqual([definition])
-    expect(result.content).toEqual([{ type: 'text', text: 'original' }])
+    expect(() => ctx.tools.register({ ...echoTool, name: 'zero-timeout', timeoutMs: 0 }))
+      .toThrow('timeoutMs must be a positive finite number')
+    expect(() => ctx.tools.register({ ...echoTool, name: 'infinite-timeout', timeoutMs: Number.POSITIVE_INFINITY }))
+      .toThrow('timeoutMs must be a positive finite number')
   })
 
   it('rejects duplicate names and unregisters on fiber dispose (HMR safety)', async () => {
diff --git a/packages/session-persistence/session-persistence-jsonl/README.md b/packages/session-persistence/session-persistence-jsonl/README.md
index 9c81c3be5e..27d965195e 100644
--- a/packages/session-persistence/session-persistence-jsonl/README.md
+++ b/packages/session-persistence/session-persistence-jsonl/README.md
@@ -28,7 +28,7 @@ The JSONL durable session-persistence backend — a concrete `SessionPersistence
 
 ## Write path
 
-The plugin generalizes the example `session-jsonl.ts`: it subscribes to `session/created` (capture the header; persist a fork's seed once), `session/event` (snapshot each event when buffering — the live `session.events` object is mutable), and `session/flush`/dispose (drain the write-behind buffer through `append`). A per-session write cursor means a resumed session never re-appends already-stored events. Existing live sessions are seeded on plugin apply (HMR does not replay `session/created`). All backend operations for one session are serialized, and disposal awaits quiescence (every init + final drain) before returning, so no write lands after teardown.
+The plugin generalizes the example `session-jsonl.ts`: it subscribes to `session/created` (capture the header; persist a fork's seed once), `session/event` (copy each already-frozen event into the persistence-owned write-behind buffer), and `session/flush`/dispose (drain that buffer through `append`). A per-session write cursor means a resumed session never re-appends already-stored events. Existing live sessions are seeded on plugin apply (HMR does not replay `session/created`). All backend operations for one session are serialized, and disposal awaits quiescence (every init + final drain) before returning, so no write lands after teardown.
 
 ## Known Limitations and Deferred Work
 
diff --git a/packages/session-persistence/session-persistence-jsonl/tests/jsonl.spec.ts b/packages/session-persistence/session-persistence-jsonl/tests/jsonl.spec.ts
index 6eed63a2f4..757ba03aac 100644
--- a/packages/session-persistence/session-persistence-jsonl/tests/jsonl.spec.ts
+++ b/packages/session-persistence/session-persistence-jsonl/tests/jsonl.spec.ts
@@ -4,7 +4,7 @@ import { appendFile, mkdtemp, mkdir, rm, readFile, writeFile, readdir, stat } fr
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
-import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
+import type { Session, SessionEvent, SessionHeader } from '@deepseek-ai/dsh-session'
 import SessionPersistenceJsonl from '@deepseek-ai/dsh-session-persistence-jsonl'
 import { encodeSegment, logPath, scanLog, sessionDir } from '../src/format.ts'
 import { runPersistenceContract, meta, oneTurnLog, appendLog } from '../../session-persistence/tests/contract.ts'
@@ -13,6 +13,13 @@ import { runCoordinatorContract, type CoordinatorFixture } from '../../session-p
 let root: string
 const dirs: string[] = []
 
+type MutableSessionHeader = { -readonly [K in keyof SessionHeader]: SessionHeader[K] }
+
+/** Test-only mutable view used to verify that backends detach returned/caller metadata. */
+function mutableHeader(header: SessionHeader): MutableSessionHeader {
+  return header
+}
+
 async function freshRoot(): Promise<string> {
   const dir = await mkdtemp(join(tmpdir(), 'dsh-jsonl-'))
   dirs.push(dir)
@@ -255,7 +262,7 @@ describe('SessionPersistenceJsonl: durability and crash semantics', () => {
     const loaded = await ctx.sessionPersistence.load(m.id)
     // A consumer mutates the returned meta's cwd. The backend's stored pathing
     // metadata must be unaffected, so a later append still finds the right log.
-    loaded.meta.cwd = '/evil'
+    mutableHeader(loaded.meta).cwd = '/evil'
     await ctx.sessionPersistence.append(m.id, [
       { type: 'turn/start', seq: 6, time: 9, data: { turn: 2, trigger: { kind: 'message', source: { kind: 'user' } } } },
       { type: 'turn/end', seq: 7, time: 10, data: { turn: 2, reason: { kind: 'completed' } } },
@@ -421,7 +428,7 @@ describe('SessionPersistenceJsonl: edge cases', () => {
     const m = meta('create-snap', '/orig')
     const p = ctx.sessionPersistence.create(m)
     // Mutate the caller's meta object immediately after calling create.
-    m.cwd = '/mutated'
+    mutableHeader(m).cwd = '/mutated'
     await p
     await ctx.sessionPersistence.append(SessionId('create-snap'), oneTurnLog())
     // The log materialized under the ORIGINAL cwd, not the mutated one.
diff --git a/packages/session-persistence/session-persistence-sqlite/README.md b/packages/session-persistence/session-persistence-sqlite/README.md
index 9b445a335a..403b6e4432 100644
--- a/packages/session-persistence/session-persistence-sqlite/README.md
+++ b/packages/session-persistence/session-persistence-sqlite/README.md
@@ -25,7 +25,7 @@ interface Config {
 
 ## Write path
 
-Like the JSONL backend, the plugin also installs the `session/event` → buffer → `session/flush` drain: it snapshots each event when buffered (the live `session.events` object is mutable), persists a fork's seed once on `session/created`, keeps a per-session write cursor so a resumed session never re-appends stored events, and seeds existing live sessions on apply (HMR does not replay `session/created`). Dispose awaits every in-flight init + final drain and then closes the database, so no write lands after teardown.
+Like the JSONL backend, the plugin also installs the `session/event` → buffer → `session/flush` drain: it copies each already-frozen event into a persistence-owned buffer, persists a fork's seed once on `session/created`, keeps a per-session write cursor so a resumed session never re-appends stored events, and seeds existing live sessions on apply (HMR does not replay `session/created`). Dispose awaits every in-flight init + final drain and then closes the database, so no write lands after teardown.
 
 ## Known Limitations and Deferred Work
 
diff --git a/packages/session-persistence/session-persistence/README.md b/packages/session-persistence/session-persistence/README.md
index 92a432d44b..810c840e96 100644
--- a/packages/session-persistence/session-persistence/README.md
+++ b/packages/session-persistence/session-persistence/README.md
@@ -17,7 +17,7 @@ The persisted unit IS the existing `SessionEvent` (event-sourced model — the l
 
 - **Append-only; a crashed turn is closed, not truncated.** Committed events (at or below a flushed `turn/end`) are never rewritten. A crash can leave an unclosed final turn whose events are real and possibly large; `load` preserves them and durably appends synthetic closers (an error `tool/result` per unanswered `tool-call`, then `step/end?`+`turn/end {interrupted}`) to balance the log and keep the rehydrated history a valid provider transcript. Only a never-fully-written torn tail fragment is discarded.
 - **Contiguous seq.** `load` rejects a `seq` gap/parse error in the MIDDLE of the log; `append`'s first `seq` must equal the stored next-seq.
-- **JSON-serializable data.** `append` rejects non-serializable `event.data`; backends snapshot each event when buffering (the live `session.events` object is mutable).
+- **JSON-serializable data.** `append` materializes each direct/replay batch through the shared one-pass lossless-JSON boundary. Live `Session` events are already deep-frozen, but the write coordinator still copies each event into a persistence-owned buffer.
 - **Durability.** `append` returns only once the batch is durable.
 
 ## The write coordinator
diff --git a/packages/session-persistence/session-persistence/src/coordinator.ts b/packages/session-persistence/session-persistence/src/coordinator.ts
index 0180999842..b1fc118a21 100644
--- a/packages/session-persistence/session-persistence/src/coordinator.ts
+++ b/packages/session-persistence/session-persistence/src/coordinator.ts
@@ -25,9 +25,9 @@
  */
 
 import { Context } from 'cordis'
-import { interruptedTurnClosers, SESSION_FORMAT_VERSION } from '@deepseek-ai/dsh-session'
+import { interruptedTurnClosers, SESSION_FORMAT_VERSION, snapshotJsonValue } from '@deepseek-ai/dsh-session'
 import type { Session, SessionEvent, SessionId, SessionHeader } from '@deepseek-ai/dsh-session'
-import { assertSerializable, seedCoversPrefix } from './index.ts'
+import { seedCoversPrefix } from './index.ts'
 
 /**
  * A stored session's durable prefix as read back from a backend: its
@@ -186,14 +186,18 @@ export class PersistenceCoordinator<TornMarker = unknown> {
   /**
    * Register a new session's metadata (lazy: no physical write until the first
    * {@link append}). Rejects if the id is already tracked or already persisted.
-   * @param meta - the immutable header (id, version, cwd, lineage) to record; snapshotted at call time.
+   * @param meta - the header (id, version, cwd, lineage) to record; materialized
+   *   as a detached lossless-JSON snapshot at call time.
    */
   create(meta: SessionHeader): Promise<void> {
     // Snapshot the metadata at call time: the op runs later (behind the
     // per-session chain) and the snapshot is stored as the lazy state, so keeping
     // the caller's object by reference would let a later mutation of `id`/`cwd`
     // register under one key but materialize under a different path/header.
-    const snapshot: SessionHeader = { ...meta }
+    const snapshot = snapshotJsonValue(meta)
+    if (snapshot === undefined) {
+      return Promise.reject(new TypeError('session metadata must be losslessly JSON-serializable'))
+    }
     return this.serialize(snapshot.id, () => this.createCore(snapshot))
   }
 
@@ -212,23 +216,25 @@ export class PersistenceCoordinator<TornMarker = unknown> {
     this.states.set(meta.id, { meta, cursor: 0, materialized: false })
   }
 
-  // `async` so the synchronous validate/clone below reject (not throw) per the
-  // Promise<void> contract — callers use `await expect(...).rejects`.
+  // `async` so synchronous materialization failures below reject (not throw) per
+  // the Promise<void> contract — callers use `await expect(...).rejects`.
   /**
    * Durably persist a batch of events. Honors the append-only and contiguous-seq
    * contracts; rejects non-JSON-serializable `event.data`.
    * @param id - the session the batch belongs to.
-   * @param events - the contiguous batch to persist, in seq order; deep-cloned at call time.
+   * @param events - the contiguous batch to persist, in seq order; materialized
+   *   as a detached lossless-JSON snapshot at call time.
    */
   async append(id: SessionId, events: readonly SessionEvent[]): Promise<void> {
-    // Validate serializability BEFORE cloning so a bad event surfaces the typed
-    // error rather than an opaque DataCloneError from structuredClone.
-    assertSerializable(events)
-    // Deep-snapshot the batch HERE, before the op waits behind the per-session
-    // chain: a caller that mutates a live array (e.g. session.events) — or an
-    // event inside it — before the op runs would otherwise have those changes
-    // persisted. The clone is taken synchronously (at call time).
-    const batch = events.map(e => structuredClone(e))
+    // Validate and deep-snapshot the complete batch HERE, in one traversal,
+    // before the op waits behind the per-session chain. A check followed by
+    // structuredClone would reread accessors and could sanitize an exotic value
+    // into an apparently valid record; the single-pass materializer makes the
+    // checked value exactly the value persisted.
+    const batch = snapshotJsonValue(events)
+    if (batch === undefined) {
+      throw new TypeError('session event batch is not losslessly JSON-serializable because it contains non-JSON-serializable data')
+    }
     return this.serialize(id, () => this.appendCore(id, batch))
   }
 
@@ -338,9 +344,10 @@ export class PersistenceCoordinator<TornMarker = unknown> {
     // promise so flush/dispose can await it (onCreated is async).
     ctx.on('session/created', (session) => { void this.initFor(session) })
 
-    // Snapshot + buffer every event (the live object is mutable; clone so a later
-    // in-place mutation cannot rewrite a buffered event). Serializability is
-    // guaranteed at the source (Session.append), so structuredClone is safe.
+    // Session emits an owned frozen event. Keep a persistence-owned copy anyway
+    // so the write-behind queue owns exactly the record it will flush rather than
+    // retaining a product-layer record by identity. Serializability is guaranteed
+    // at the source, so structuredClone is safe.
     ctx.on('session/event', (session, event) => {
       let buffer = this.buffers.get(session)
       if (!buffer) this.buffers.set(session, buffer = [])
@@ -391,8 +398,8 @@ export class PersistenceCoordinator<TornMarker = unknown> {
     const existing = this.inits.get(session)
     if (existing) return existing
     // Snapshot the seed SYNCHRONOUSLY — initFor runs inside the `session/created`
-    // emit, before any later `append` adds non-seed events. A clone freezes it
-    // against later mutation of the live event objects.
+    // emit, before any later append invalidates the public array snapshot. Events
+    // are already frozen; cloning gives persistence independent ownership.
     const seed = session.events.map(e => structuredClone(e))
     const p = this.onCreated(session, seed)
     // Attach a no-op rejection handler so a failing init does not surface as an
diff --git a/packages/session-persistence/session-persistence/src/index.ts b/packages/session-persistence/session-persistence/src/index.ts
index 1588ed2526..b03691d17b 100644
--- a/packages/session-persistence/session-persistence/src/index.ts
+++ b/packages/session-persistence/session-persistence/src/index.ts
@@ -22,7 +22,7 @@
  */
 
 import { Context, Service } from 'cordis'
-import { isJsonValue } from '@deepseek-ai/dsh-session'
+import { snapshotJsonValue } from '@deepseek-ai/dsh-session'
 import type { SessionEvent, SessionId, SessionHeader } from '@deepseek-ai/dsh-session'
 
 // Re-export the metadata vocabulary so consumers import it from the seam.
@@ -58,16 +58,16 @@ export function seedCoversPrefix(seed: readonly SessionEvent[], prefix: readonly
 }
 
 /**
- * Reject non-JSON-serializable event data before a backend serializes a batch.
- * Live session appends already enforce this; persistence append paths also
- * accept replay/fork batches that may bypass a live session instance.
- * @param events - the batch to validate; throws naming the offending event's type and seq.
+ * Reject a batch that is not wholly losslessly JSON-serializable. Live session
+ * appends already enforce this; persistence append paths also accept replay or
+ * direct batches that may bypass a live session instance. Validation uses the
+ * same one-pass materializer as the coordinator, so getters are read once.
+ * @param events - the complete event batch to validate.
  */
 export function assertSerializable(events: readonly SessionEvent[]): void {
-  for (const event of events) {
-    if (!isJsonValue(event.data)) {
-      throw new Error(`event "${event.type}" carries non-JSON-serializable data (seq ${event.seq})`)
-    }
+  const snapshot = snapshotJsonValue(events)
+  if (snapshot === undefined) {
+    throw new Error('session event batch is not losslessly JSON-serializable because it contains non-JSON-serializable data')
   }
 }
 
@@ -90,11 +90,11 @@ export function assertSerializable(events: readonly SessionEvent[]): void {
  *   {@link load} rejects a parse error or a `seq` gap in the COMMITTED region
  *   (unloadable); {@link append}'s first event `seq` MUST equal the backend's
  *   stored next-seq (after `load` has balanced any interrupted turn).
- * - **JSON-serializable data.** `SessionEventMap` is merge-extensible and
- *   `event.data` is typed only as `SessionEventMap[K]`, so {@link append}
- *   REJECTS non-JSON-serializable data with an error naming the offending
- *   event type. A backend snapshots (serializes/clones) each event when it
- *   buffers, since `session.events` hands out the live mutable object.
+ * - **JSON-serializable events.** `SessionEventMap` is merge-extensible, so
+ *   {@link append} materializes each complete batch through the shared
+ *   lossless-JSON boundary before buffering it. The public `session.events`
+ *   view is immutable, but persistence still snapshots direct/replay callers at
+ *   this independent trust boundary.
  * - **Durability.** {@link append} returns only once the batch is durable
  *   (the file backend fsyncs; a DB commits). {@link create} MAY defer the
  *   physical write until the first {@link append} (lazy materialization).
diff --git a/packages/session-persistence/session-persistence/tests/contract.ts b/packages/session-persistence/session-persistence/tests/contract.ts
index 9f2facb827..789aa72c91 100644
--- a/packages/session-persistence/session-persistence/tests/contract.ts
+++ b/packages/session-persistence/session-persistence/tests/contract.ts
@@ -245,7 +245,7 @@ export function runPersistenceContract(name: string, make: () => Promise<Contrac
           const events = [
             { type: 'user/message', seq: 0, time: 1, data: { content: [{ type: 'text', text: 'x' }], source: { kind: 'user' }, extra: bad } },
           ] as unknown as SessionEvent[]
-          await expect(persistence.append(mi.id, events)).rejects.toThrow(/user\/message/)
+          await expect(persistence.append(mi.id, events)).rejects.toThrow(/losslessly JSON-serializable/)
         }
       } finally {
         await dispose()
diff --git a/packages/session-persistence/session-persistence/tests/coordinator-contract.ts b/packages/session-persistence/session-persistence/tests/coordinator-contract.ts
index 42583c4fe3..61d37964ce 100644
--- a/packages/session-persistence/session-persistence/tests/coordinator-contract.ts
+++ b/packages/session-persistence/session-persistence/tests/coordinator-contract.ts
@@ -143,14 +143,15 @@ export function runCoordinatorContract(name: string, makeFixture: () => Promise<
       }
     })
 
-    it('snapshot-on-buffer: mutating an event after session/event does not corrupt the persisted copy', async () => {
+    it('source-frozen events cannot be mutated after buffering and persist unchanged', async () => {
       const fix = await makeFixture()
       const { ctx, fiber } = await freshCtx(fix)
       try {
         const session = ctx.sessions.create(SessionId('mutate'), { meta: { cwd: WORK } })
         const ev = session.append('user/message', { content: [{ type: 'text', text: 'original' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
-        // Mutate the live event object AFTER it was buffered by session/event.
-        ;(ev.data as { content: { type: 'text'; text: string }[] }).content[0]!.text = 'HACKED'
+        expect(() => {
+          ;(ev.data as { content: { type: 'text'; text: string }[] }).content[0]!.text = 'HACKED'
+        }).toThrow(TypeError)
         session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
         session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
         await ctx.parallel('session/flush', session)
diff --git a/packages/session-persistence/session-persistence/tests/persistence.spec.ts b/packages/session-persistence/session-persistence/tests/persistence.spec.ts
index 4e4cf67822..9c766d4b66 100644
--- a/packages/session-persistence/session-persistence/tests/persistence.spec.ts
+++ b/packages/session-persistence/session-persistence/tests/persistence.spec.ts
@@ -158,6 +158,17 @@ describe('SessionPersistence service registration', () => {
     expect(loaded.events).toHaveLength(6)
     await fiber.dispose()
   })
+
+  it('rejects non-JSON session metadata before registering lazy state', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    const fiber = await ctx.plugin(MemoryPersistence)
+    const invalid = { ...meta('invalid-meta'), createdAt: 1n as unknown as number }
+
+    await expect(ctx.sessionPersistence.create(invalid))
+      .rejects.toThrow('session metadata must be losslessly JSON-serializable')
+    await fiber.dispose()
+  })
 })
 
 describe('shared persistence helpers', () => {
@@ -187,10 +198,10 @@ describe('shared persistence helpers', () => {
     expect(() => { assertSerializable(oneTurnLog()) }).not.toThrow()
   })
 
-  it('rejects non-JSON-serializable event data with type and seq context', () => {
+  it('rejects a batch containing non-JSON-serializable event data', () => {
     const bad = [
       { type: 'user/message', seq: 0, time: 1, data: { content: 1n } },
     ] as unknown as SessionEvent[]
-    expect(() => { assertSerializable(bad) }).toThrow(/"user\/message".*seq 0/)
+    expect(() => { assertSerializable(bad) }).toThrow(/batch is not losslessly JSON-serializable/)
   })
 })
diff --git a/packages/skill/skill/README.md b/packages/skill/skill/README.md
index eeddc9dd11..e054dca4f0 100644
--- a/packages/skill/skill/README.md
+++ b/packages/skill/skill/README.md
@@ -8,26 +8,28 @@ This package owns the `ctx.skills` interface. It does not know whether skills co
 
 ### Public API
 
-- `ctx.skills.registerProvider(provider): () => Promise<void> | void` Registers a provider by unique `provider.name`. Duplicate provider names throw, and `runtime` is reserved for `ctx.skills.register(...)`. The registry snapshots the name and callback identities at registration, so replacing those fields later cannot change lookup or HMR cleanup; callbacks remain bound to the original provider object and can still read its mutable state. The registration is effect-scoped and HMR-safe, and the exact Cordis disposer supports ordered composite teardown.
-- `ctx.skills.list({ cwd?, signal? })` Returns model-invocable skill summaries for the current workspace, merged across providers and sorted by name.
-- `ctx.skills.get(name, { cwd?, signal? })` Returns the full winning skill, including disabled-for-model skills.
-- `ctx.skills.register(skill): () => Promise<void> | void` Registers a runtime embedded skill. Same-name runtime registrations are first-wins: a duplicate logs a warning and gets a no-op disposer. Successful registrations return the exact Cordis disposer for ordered composite teardown.
+- `ctx.skills.registerProvider(provider): () => Promise<void> | void` Registers a readonly provider by unique `provider.name`. Duplicate provider names throw, and `runtime` is reserved for `ctx.skills.register(...)`. The registry borrows the provider object and invokes its methods directly. The registration is effect-scoped and HMR-safe, and the exact Cordis disposer supports ordered composite teardown.
+- `ctx.skills.list({ cwd?, signal? })` Borrows the readonly lookup options, then returns model-invocable summaries for the current workspace, merged across providers and sorted by name.
+- `ctx.skills.get(name, { cwd?, signal? })` Uses the same readonly options and winning candidate for discovery and loading, rechecks cancellation after discovery or a cache hit, races provider loading against the signal, validates the loaded definition, then returns it, including disabled-for-model skills.
+- `ctx.skills.register(skill): () => Promise<void> | void` Registers a readonly runtime embedded skill, adding `provider: "runtime"` when omitted. Same-name runtime registrations are first-wins: a duplicate logs a warning and gets a no-op disposer. Successful registrations return the exact Cordis disposer for ordered composite teardown.
 
 ### Config
 
 | Field | Default | Meaning |
 |---|---|---|
-| `collectCacheMaxEntries` | `128` | Maximum completed cwd/provider catalog snapshots kept in memory. |
+| `collectCacheMaxEntries` | `128` | Maximum completed cwd/provider catalogs kept in memory. |
 
 ## Provider Contract
 
-A provider registers synchronously from its `apply()` and returns `SkillCandidate[]` from `list(options)` when discovery is requested. Registration copies `name` and binds the current `list` and `get` methods once; replacing those fields on the caller-owned object later does not rewrite the live registry entry, and disposal always removes the original name. Remote setup, authentication, and discovery belong in the awaited `list()` call rather than plugin registration. Providers should stop promptly when `options.signal` aborts; the registry also stops awaiting an uncooperative provider so agent cancellation cannot hang prefix composition. The provider later receives the winning candidate back in `get(candidate, options)`. The candidate's `locator` is opaque to the registry, so a local provider can store a file path while a remote provider can store a URL, id, or version token.
+A provider registers synchronously from its `apply()` and returns `readonly SkillCandidate[]` from `list(options)` when discovery is requested. The provider, lookup options, candidates, and loaded definitions are readonly same-process contracts: the registry borrows them rather than cloning, freezing, or rebinding callbacks. Remote setup, authentication, and discovery belong in the awaited `list()` call rather than plugin registration. Providers should stop promptly when `options.signal` aborts; the registry also stops awaiting uncooperative discovery and loading work so agent cancellation cannot hang prefix composition or skill loading.
 
-The registry validates candidate names, descriptions, ranks, and provider ownership. Candidate contract violations fail fast because the provider plugin is malformed; a provider `list()` rejection is treated as a transient source failure, logged, skipped for that request, and not cached. Only completed catalogs are cached, and a provider/runtime revision change during discovery discards the stale result and retries. Duplicate skill names are resolved first-wins by `rank`, provider registration order, then the provider's own local order. The final summary list is sorted by skill `name` for deterministic consumers.
+The registry validates parsed provider candidates before caching them and validates loaded definitions before returning them. The winning provider receives the exact candidate and opaque `locator` identity it returned from `list()`; a local provider can therefore use a file-path handle while a remote provider can use a URL, id, or version token. Callers and providers must honor the readonly contract after handing values to the registry.
+
+Parsed candidate and loaded-definition fields are validated at the provider boundary: names/descriptions/content use their declared string types, ranks are finite numbers, and `disableModelInvocation` is boolean when present. Candidate contract violations fail fast because the provider or its parser is malformed; a provider `list()` rejection is treated as a transient source failure, logged, skipped for that request, and not cached. Only completed catalogs are cached, and a provider/runtime revision change during discovery discards the stale result and retries. Duplicate skill names are resolved first-wins by `rank`, provider registration order, then the provider's own local order. The final summary list is sorted by skill `name` for deterministic consumers.
 
 ## Runtime Skills
 
-`ctx.skills.register(...)` is a convenience for embedded runtime skills. Runtime skills use rank `250`: project providers can override them, while they override the shipped local provider's custom and user roots. Runtime registration is also first-wins within runtime contributions, so a duplicate contribution cannot remove the active one through its disposer.
+`ctx.skills.register(...)` is a convenience for embedded runtime skills. Runtime skills use rank `250`: project providers can override them, while they override the shipped local provider's custom and user roots. Runtime definitions and nested resource metadata are borrowed readonly; the service only materializes the top-level definition needed to supply the default `provider`. Registration is first-wins within runtime contributions, so a duplicate contribution cannot remove the active one through its disposer.
 
 ## Consumer boundary
 
diff --git a/packages/skill/skill/src/index.ts b/packages/skill/skill/src/index.ts
index 20ac717e9c..f2ece2379f 100644
--- a/packages/skill/skill/src/index.ts
+++ b/packages/skill/skill/src/index.ts
@@ -32,64 +32,65 @@ export type SkillSource = 'project-dsh' | 'project-agents' | 'runtime' | 'user-d
 
 /** Optional provider-specific base used by loaded skill bodies to resolve relative resources. */
 export type SkillResourceBase =
-  | { kind: 'directory'; path: string }
-  | { kind: 'url'; url: string }
-  | { kind: 'opaque'; description: string }
+  | { readonly kind: 'directory'; readonly path: string }
+  | { readonly kind: 'url'; readonly url: string }
+  | { readonly kind: 'opaque'; readonly description: string }
 
 /** Model-visible skill metadata returned by `ctx.skills.list()` and rendered into request guidance. */
 export interface SkillSummary {
   /** Kebab-case identifier used with the `skill` tool. */
-  name: string
+  readonly name: string
   /** Short routing description shown to the model. */
-  description: string
+  readonly description: string
   /** Optional extra routing guidance shown to the model. */
-  whenToUse?: string
+  readonly whenToUse?: string
   /** Whether the skill is hidden from model listings while remaining loadable by trusted callers. */
-  disableModelInvocation?: boolean
+  readonly disableModelInvocation?: boolean
   /** Discovery source that produced this winning skill. */
-  source: SkillSource
+  readonly source: SkillSource
   /** Provider that owns this skill body. */
-  provider: string
+  readonly provider: string
   /** Provider-specific base for relative resources. */
-  resourceBase?: SkillResourceBase
+  readonly resourceBase?: SkillResourceBase
 }
 
 /** Provider catalog entry used by the registry to merge and later load skills. */
 export interface SkillCandidate extends SkillSummary {
   /** Lower ranks win duplicate skill names before provider registration order is considered. */
-  rank: number
+  readonly rank: number
   /** Opaque provider-owned handle passed back to `provider.get()`. */
-  locator: unknown
+  readonly locator: unknown
   /** Absolute file path when the provider has one. */
-  path?: string
+  readonly path?: string
   /** Parsed optional metadata object from provider-specific skill frontmatter. */
-  metadata?: Record<string, unknown>
+  readonly metadata?: Readonly<Record<string, unknown>>
 }
 
 /** Complete parsed skill definition, including the body loaded by `ctx.skills.get()`. */
 export interface SkillDefinition extends SkillSummary {
   /** Markdown instruction body after any provider-specific metadata removal. */
-  content: string
+  readonly content: string
   /** Absolute file path when the skill came from disk. */
-  path?: string
+  readonly path?: string
   /** Parsed optional metadata object from frontmatter. */
-  metadata?: Record<string, unknown>
+  readonly metadata?: Readonly<Record<string, unknown>>
 }
 
 /** Runtime skill contribution accepted by `ctx.skills.register()`. */
-export type SkillRegistration = Omit<SkillDefinition, 'provider'> & { provider?: string }
+export type SkillRegistration = Omit<SkillDefinition, 'provider'> & { readonly provider?: string }
 
 /** Caller context used for cwd-sensitive and abortable provider work. */
 export interface SkillLookupOptions {
-  cwd?: string | undefined
+  /** Workspace selector for the current lookup. */
+  readonly cwd?: string | undefined
   /** Abort discovery or loading work for the current caller. */
-  signal?: AbortSignal | undefined
+  readonly signal?: AbortSignal | undefined
 }
 
 /** Provider interface for one source of skills, such as local directories or a remote registry. */
 export interface SkillProvider {
   /** Unique provider name in the `ctx.skills` registry. */
-  name: string
+  readonly name: string
   /**
    * List available skill candidates for the current lookup context. Provider
    * plugins register synchronously during `apply()`; remote initialization,
@@ -98,20 +99,20 @@ export interface SkillProvider {
    * @param options - lookup options; `cwd` selects workspace-sensitive skills and `signal` cancels work.
    * @returns provider candidates with precedence ranks and opaque locators.
    */
-  list(options: SkillLookupOptions): Promise<SkillCandidate[]>
+  readonly list: (options: SkillLookupOptions) => Promise<readonly SkillCandidate[]>
   /**
    * Load a complete skill body for a previously listed candidate.
    * @param candidate - the winning candidate originally returned by this provider.
    * @param options - lookup options; `cwd` selects workspace-sensitive skills and `signal` cancels work.
    * @returns the full skill body, or `undefined` if it is no longer loadable.
    */
-  get(candidate: SkillCandidate, options: SkillLookupOptions): Promise<SkillDefinition | undefined>
+  readonly get: (candidate: SkillCandidate, options: SkillLookupOptions) => Promise<SkillDefinition | undefined>
 }
 
 /** Skill registry configuration. */
 export interface Config {
-  /** Maximum number of completed cwd/provider catalog snapshots kept in memory. */
-  collectCacheMaxEntries?: number
+  /** Maximum number of completed cwd/provider catalogs kept in memory. */
+  readonly collectCacheMaxEntries?: number
 }
 
 declare module 'cordis' {
@@ -161,7 +162,7 @@ export class SkillService extends Service {
 
   private readonly collectCacheMaxEntries: number
   private readonly providers = new Map<string, { provider: SkillProvider; order: number }>()
-  private readonly runtime = new Map<string, SkillDefinition>()
+  private readonly runtime = new Map<string, SkillRegistration>()
   private readonly collectCache = new Map<string, IndexedCandidate[]>()
   private providerRevision = 0
   private nextProviderOrder = 0
@@ -177,45 +178,38 @@ export class SkillService extends Service {
    * Register a skill provider synchronously during the provider plugin's
    * `apply()`. Throws if another provider already owns the same provider name,
    * including the reserved runtime provider name. Providers that need remote
-   * initialization do that work inside `list()` after registration. The name
-   * and callback identities are snapshotted at registration, so later
-   * replacement of those fields cannot change the registry key, dispatch
-   * callbacks, or HMR cleanup identity. Bound callbacks retain the original
-   * provider object as their receiver, so provider-owned mutable state remains
-   * live. Effect-scoped and HMR-safe: disposing the caller's fiber unregisters
-   * the provider and invalidates cached catalogs.
+   * initialization do that work inside `list()` after registration. Providers
+   * are readonly same-process registrations: the registry borrows the provider
+   * object and invokes its methods directly. Effect-scoped and HMR-safe:
+   * disposing the caller's fiber unregisters the provider and invalidates
+   * cached catalogs.
    * @param provider - the provider to register by `provider.name`.
    * @returns the exact Cordis effect disposer that unregisters this provider;
    *   composite effects may yield it directly to preserve teardown ordering.
    */
   registerProvider(provider: SkillProvider): () => Promise<void> | void {
-    // Snapshot the registration contract before entering the effect. The
-    // callback binding preserves the historical method receiver while making
-    // replacement of `provider.list`/`provider.get` after registration inert.
-    // In particular, cleanup must never re-read caller-owned `provider.name`:
-    // an HMR host may mutate or reuse that object before its old fiber unloads.
-    const snapshot: SkillProvider = Object.freeze({
-      name: provider.name,
-      list: provider.list.bind(provider),
-      get: provider.get.bind(provider),
-    })
-    const dispose = this.ctx.effect(function* (this: SkillService) {
-      if (snapshot.name === RUNTIME_PROVIDER) {
-        throw new Error(`"${RUNTIME_PROVIDER}" is reserved for runtime skill registrations`)
-      }
-      if (this.providers.has(snapshot.name)) {
-        throw new Error(`a skill provider named "${snapshot.name}" is already registered`)
-      }
-      this.providers.set(snapshot.name, { provider: snapshot, order: this.nextProviderOrder })
-      this.nextProviderOrder += 1
-      this.invalidateCache()
+    const name = provider.name
+    if (name === RUNTIME_PROVIDER) {
+      throw new Error(`"${RUNTIME_PROVIDER}" is reserved for runtime skill registrations`)
+    }
+    if (this.providers.has(name)) {
+      throw new Error(`a skill provider named "${name}" is already registered`)
+    }
+    const providers = this.providers
+    const ctx = this.ctx
+    const order = this.nextProviderOrder
+    const invalidateCache = (): void => { this.invalidateCache() }
+    this.nextProviderOrder += 1
+    const dispose = ctx.effect(function* () {
+      providers.set(name, { provider, order })
+      invalidateCache()
       yield () => {
-        this.providers.delete(snapshot.name)
-        this.invalidateCache()
-        this.ctx.emit('skill/provider-removed', snapshot.name)
+        providers.delete(name)
+        invalidateCache()
+        ctx.emit('skill/provider-removed', name)
       }
-      this.ctx.emit('skill/provider-added', snapshot)
-    }.bind(this), 'skills.registerProvider()')
+      ctx.emit('skill/provider-added', provider)
+    }, 'skills.registerProvider()')
     return dispose
   }
 
@@ -223,34 +217,41 @@ export class SkillService extends Service {
    * Register a runtime skill contribution. Runtime registrations are treated as
    * embedded provider entries with project-over-user priority. Same-name runtime
    * registrations are first-wins: a duplicate logs a warning and gets a no-op
-   * disposer so it cannot remove the active contribution.
+   * disposer so it cannot remove the active contribution. Runtime definitions
+   * are readonly same-process registrations; the registry borrows their nested
+   * resource metadata.
    * @param skill - the complete skill definition to expose for discovery.
    * @returns the exact Cordis effect disposer that removes this runtime
    *   contribution and invalidates caches; composite effects may yield it
    *   directly to preserve teardown ordering.
    */
   register(skill: SkillRegistration): () => Promise<void> | void {
-    const normalized = normalizeRuntimeSkill(skill)
-    const existing = this.runtime.get(normalized.name)
+    validateRuntimeSkill(skill)
+    const existing = this.runtime.get(skill.name)
     if (existing !== undefined) {
-      this.ctx.logger.warn(`runtime skill "${normalized.name}" ignored because it is already registered`)
+      this.ctx.logger.warn(`runtime skill "${skill.name}" ignored because it is already registered`)
       return () => {}
     }
-    const dispose = this.ctx.effect(function* (this: SkillService) {
-      this.runtime.set(normalized.name, normalized)
-      this.runtimeRevision += 1
-      this.invalidateCache()
+    const runtime = this.runtime
+    const updateRevision = (): void => { this.runtimeRevision += 1 }
+    const invalidateCache = (): void => { this.invalidateCache() }
+    const dispose = this.ctx.effect(function* () {
+      runtime.set(skill.name, skill)
+      updateRevision()
+      invalidateCache()
       yield () => {
-        this.runtime.delete(normalized.name)
-        this.runtimeRevision += 1
-        this.invalidateCache()
+        runtime.delete(skill.name)
+        updateRevision()
+        invalidateCache()
       }
-    }.bind(this), 'skills.register()')
+    }, 'skills.register()')
     return dispose
   }
 
   /**
-   * List model-invocable skill summaries for a workspace.
+   * List model-invocable skill summaries for a workspace. Lookup options and
+   * provider candidates are readonly same-process values borrowed throughout
+   * discovery.
    * @param options - lookup options; `cwd` selects project roots and `signal` cancels discovery.
    * @returns sorted summaries, excluding skills disabled for model invocation.
    */
@@ -263,20 +264,33 @@ export class SkillService extends Service {
   }
 
   /**
-   * Load one full skill definition by name.
+   * Load one full skill definition by name. The provider receives the winning
+   * candidate it returned during discovery, including its opaque locator, and
+   * the registry returns the provider's definition after validating it.
+   * Cancellation is rechecked after catalog
+   * selection (including a cache hit), and provider loading is raced against the
+   * same signal so an uncooperative provider cannot hang the caller.
    * @param name - kebab-case skill name.
    * @param options - lookup options; `cwd` selects workspace-sensitive skills and `signal` cancels work.
    * @returns the full skill, including body content, or `undefined`.
    */
   async get(name: string, options: SkillLookupOptions = {}): Promise<SkillDefinition | undefined> {
     if (!isSkillName(name)) return undefined
-    const match = (await this.collect(options)).find(entry => entry.candidate.name === name)
+    const collected = await this.collect(options)
+    throwIfAborted(options.signal)
+    const match = collected.find(entry => entry.candidate.name === name)
     if (match === undefined) return undefined
-    return await match.provider.get(match.candidate, options)
+    const definition = await waitWithAbort(
+      match.provider.get(match.candidate, options),
+      options.signal,
+    )
+    if (definition === undefined) return undefined
+    validateDefinition(definition)
+    return definition
   }
 
   private async collect(options: SkillLookupOptions): Promise<IndexedCandidate[]> {
-    options.signal?.throwIfAborted()
+    throwIfAborted(options.signal)
     while (true) {
       const providerRevision = this.providerRevision
       const runtimeRevision = this.runtimeRevision
@@ -285,7 +299,7 @@ export class SkillService extends Service {
       if (cached !== undefined) return cached
 
       const result = await this.collectFresh(options)
-      options.signal?.throwIfAborted()
+      throwIfAborted(options.signal)
       if (providerRevision !== this.providerRevision || runtimeRevision !== this.runtimeRevision) continue
       if (result.cacheable) {
         this.collectCache.set(key, result.entries)
@@ -316,7 +330,7 @@ export class SkillService extends Service {
   }
 
   private async listAllCandidates(options: SkillLookupOptions): Promise<CollectResult> {
-    options.signal?.throwIfAborted()
+    throwIfAborted(options.signal)
     const candidates: IndexedCandidate[] = []
     let cacheable = true
     let runtimeOrder = 0
@@ -331,15 +345,19 @@ export class SkillService extends Service {
     }
     for (const { provider, order } of [...this.providers.values()]) {
       let localOrder = 0
-      let listed: SkillCandidate[] | undefined
+      let output: unknown
       try {
-        listed = await waitWithAbort(provider.list(options), options.signal)
+        output = await waitWithAbort(provider.list(options), options.signal)
       } catch (error) {
         if (options.signal?.aborted === true) throw toError(options.signal.reason)
         cacheable = false
         this.ctx.logger.warn(`skill provider "${provider.name}" skipped: ${errorMessage(error)}`)
       }
-      if (listed === undefined) continue
+      if (output === undefined) continue
+      if (!Array.isArray(output)) {
+        throw new TypeError(`skill provider "${provider.name}" list() must return an array`)
+      }
+      const listed = output as readonly SkillCandidate[]
       for (const candidate of listed) {
         validateCandidate(candidate, provider.name)
         candidates.push({ candidate, provider, providerOrder: order, localOrder })
@@ -362,14 +380,20 @@ const RUNTIME_SKILL_PROVIDER: SkillProvider = {
     return Promise.resolve([])
   },
   get(candidate) {
-    const skill = candidate.locator as SkillDefinition
-    return Promise.resolve({ ...skill })
+    const skill = candidate.locator as SkillRegistration
+    return Promise.resolve({ ...skill, provider: skill.provider ?? RUNTIME_PROVIDER })
   },
 }
 
-function runtimeCandidate(skill: SkillDefinition): SkillCandidate {
+function runtimeCandidate(skill: SkillRegistration): SkillCandidate {
   return {
-    ...toSummary(skill),
+    name: skill.name,
+    description: skill.description,
+    ...skill.whenToUse !== undefined ? { whenToUse: skill.whenToUse } : {},
+    ...skill.disableModelInvocation !== undefined ? { disableModelInvocation: skill.disableModelInvocation } : {},
+    source: skill.source,
+    provider: skill.provider ?? RUNTIME_PROVIDER,
+    ...skill.resourceBase !== undefined ? { resourceBase: skill.resourceBase } : {},
     rank: RUNTIME_RANK,
     locator: skill,
     ...skill.path !== undefined ? { path: skill.path } : {},
@@ -378,28 +402,68 @@ function runtimeCandidate(skill: SkillDefinition): SkillCandidate {
 }
 
 function validateCandidate(candidate: SkillCandidate, providerName: string): void {
+  if (typeof candidate.name !== 'string') {
+    throw new TypeError(`skill provider "${providerName}" returned a non-string skill name`)
+  }
   if (!SKILL_NAME.test(candidate.name)) {
     throw new Error(`skill provider "${providerName}" returned invalid skill name "${candidate.name}"`)
   }
+  if (typeof candidate.description !== 'string') {
+    throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string description`)
+  }
   if (candidate.description.length === 0) {
     throw new Error(`skill provider "${providerName}" returned skill "${candidate.name}" without a description`)
   }
-  if (!Number.isFinite(candidate.rank)) {
+  if (candidate.disableModelInvocation !== undefined && typeof candidate.disableModelInvocation !== 'boolean') {
+    throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-boolean disableModelInvocation`)
+  }
+  if (candidate.whenToUse !== undefined && typeof candidate.whenToUse !== 'string') {
+    throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string whenToUse`)
+  }
+  if (typeof candidate.source !== 'string') {
+    throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string source`)
+  }
+  if (typeof candidate.rank !== 'number' || !Number.isFinite(candidate.rank)) {
     throw new Error(`skill provider "${providerName}" returned skill "${candidate.name}" with an invalid rank`)
   }
+  if (typeof candidate.provider !== 'string') {
+    throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string provider`)
+  }
   if (candidate.provider !== providerName) {
     throw new Error(`skill provider "${providerName}" returned skill "${candidate.name}" for provider "${candidate.provider}"`)
   }
+  if (candidate.path !== undefined && typeof candidate.path !== 'string') {
+    throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string path`)
+  }
 }
 
-function normalizeRuntimeSkill(skill: SkillRegistration): SkillDefinition {
+function validateRuntimeSkill(skill: SkillRegistration): void {
   if (!SKILL_NAME.test(skill.name)) throw new Error(`invalid skill name "${skill.name}"`)
   if (skill.description.length === 0) throw new Error(`skill "${skill.name}" requires a description`)
-  return {
-    ...skill,
-    provider: skill.provider ?? RUNTIME_PROVIDER,
-    source: skill.source,
+}
+
+/** Validate a definition loaded from a provider-controlled parser or remote source. */
+function validateDefinition(skill: SkillDefinition): void {
+  const name = skill.name
+  const description = skill.description
+  const whenToUse = skill.whenToUse
+  const disableModelInvocation = skill.disableModelInvocation
+  const source = skill.source
+  const provider = skill.provider
+  const content = skill.content
+  const path = skill.path
+  if (typeof name !== 'string') throw new TypeError('loaded skill name must be a string')
+  if (!SKILL_NAME.test(name)) throw new Error(`loaded skill has invalid name "${name}"`)
+  if (typeof description !== 'string') throw new TypeError(`loaded skill "${name}" description must be a string`)
+  if (description.length === 0) throw new Error(`loaded skill "${name}" requires a description`)
+  if (disableModelInvocation !== undefined && typeof disableModelInvocation !== 'boolean') {
+    throw new TypeError(`loaded skill "${name}" disableModelInvocation must be a boolean`)
   }
+  if (whenToUse !== undefined && typeof whenToUse !== 'string') throw new TypeError(`loaded skill "${name}" whenToUse must be a string`)
+  if (typeof source !== 'string') throw new TypeError(`loaded skill "${name}" source must be a string`)
+  if (typeof provider !== 'string') throw new TypeError(`loaded skill "${name}" provider must be a string`)
+  if (typeof content !== 'string') throw new TypeError(`loaded skill "${name}" content must be a string`)
+  if (path !== undefined && typeof path !== 'string') throw new TypeError(`loaded skill "${name}" path must be a string`)
 }
 
 function toSummary(skill: SkillDefinition | SkillCandidate): SkillSummary {
@@ -443,7 +507,7 @@ function collectCacheKey(options: SkillLookupOptions, providerRevision: number,
 
 function waitWithAbort<T>(promise: Promise<T>, signal: AbortSignal | undefined): Promise<T> {
   if (signal === undefined) return promise
-  signal.throwIfAborted()
+  throwIfAborted(signal)
   return new Promise<T>((resolve, reject) => {
     const cleanup = (): void => {
       signal.removeEventListener('abort', onAbort)
@@ -463,16 +527,31 @@ function waitWithAbort<T>(promise: Promise<T>, signal: AbortSignal | undefined):
         reject(toError(error))
       },
     )
-    if (signal.aborted) onAbort()
   })
 }
 
-function toError(error: unknown): Error {
-  return error instanceof Error ? error : new Error(String(error))
+/** Throw a total Error for an already-aborted lookup. */
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (signal?.aborted === true) throw toError(signal.reason)
 }
 
+/** Normalize an arbitrary abort or provider failure without trusting coercion. */
+function toError(error: unknown): Error {
+  try {
+    if (error instanceof Error) return error
+  } catch {
+    // A hostile proxy may throw during instanceof; fall through to the total renderer.
+  }
+  return new Error(errorMessage(error))
+}
+
+/** Render an arbitrary provider failure without letting coercion escape containment. */
 function errorMessage(error: unknown): string {
-  return String(error)
+  try {
+    return String(error)
+  } catch {
+    return '[unrenderable thrown value]'
+  }
 }
 
 export default SkillService
diff --git a/packages/skill/skill/tests/skill.spec.ts b/packages/skill/skill/tests/skill.spec.ts
index e3b491f690..90bf1ea983 100644
--- a/packages/skill/skill/tests/skill.spec.ts
+++ b/packages/skill/skill/tests/skill.spec.ts
@@ -107,62 +107,346 @@ describe('SkillService registry', () => {
     expect((await ctx.skills.list()).map(skill => skill.name)).toEqual(['same-rank-skill', 'shadowed'])
   })
 
-  it('snapshots a provider registration so caller mutation cannot corrupt HMR cleanup', async () => {
+  it('validates parsed candidate fields', async () => {
     const ctx = new Context()
     await ctx.plugin(SkillService)
+    const badDescription = { value: 'object-description' }
+    ctx.skills.registerProvider({
+      name: 'bad-candidate',
+      list: () => Promise.resolve([{
+        ...memorySkill('bad-candidate', 'placeholder', 1),
+        provider: 'bad-candidate',
+        description: badDescription as unknown as string,
+        disableModelInvocation: 'false' as unknown as boolean,
+      }]),
+      get: () => Promise.resolve(undefined),
+    })
+    await expect(ctx.skills.list()).rejects.toThrow('non-string description')
+
+    const badBoolean = new Context()
+    await badBoolean.plugin(SkillService)
+    badBoolean.skills.registerProvider({
+      name: 'bad-boolean',
+      list: () => Promise.resolve([{
+        ...memorySkill('bad-boolean', 'Bad boolean', 1),
+        provider: 'bad-boolean',
+        disableModelInvocation: 'false' as unknown as boolean,
+      }]),
+      get: () => Promise.resolve(undefined),
+    })
+    await expect(badBoolean.skills.list()).rejects.toThrow('non-boolean disableModelInvocation')
+  })
+
+  it('rejects non-array provider results and every malformed candidate scalar', async () => {
+    const badList = new Context()
+    await badList.plugin(SkillService)
+    badList.skills.registerProvider({
+      name: 'non-array-list',
+      list: () => Promise.resolve({} as unknown as SkillCandidate[]),
+      get: () => Promise.resolve(undefined),
+    })
+    await expect(badList.skills.list()).rejects.toThrow('list() must return an array')
+
+    const cases: { patch: Partial<SkillCandidate>; expected: string }[] = [
+      { patch: { name: { value: 'candidate' } as unknown as string }, expected: 'non-string skill name' },
+      { patch: { whenToUse: 1 as unknown as string }, expected: 'non-string whenToUse' },
+      { patch: { source: { value: 'source' } as unknown as string }, expected: 'non-string source' },
+      { patch: { rank: '1' as unknown as number }, expected: 'invalid rank' },
+      { patch: { provider: { value: 'provider' } as unknown as string }, expected: 'non-string provider' },
+      { patch: { path: 1 as unknown as string }, expected: 'non-string path' },
+    ]
+    for (const [index, { patch, expected }] of cases.entries()) {
+      const ctx = new Context()
+      await ctx.plugin(SkillService)
+      const providerName = `candidate-provider-${index}`
+      const candidate = {
+        name: `candidate-${index}`,
+        description: 'Candidate',
+        whenToUse: 'Use this candidate.',
+        disableModelInvocation: false,
+        provider: providerName,
+        source: 'test',
+        rank: 1,
+        locator: 'candidate',
+        path: '/skills/candidate/SKILL.md',
+        ...patch,
+      } as SkillCandidate
+      ctx.skills.registerProvider({
+        name: providerName,
+        list: () => Promise.resolve([candidate]),
+        get: () => Promise.resolve(undefined),
+      })
+
+      await expect(ctx.skills.list()).rejects.toThrow(expected)
+    }
+  })
+
+  it('borrows the exact lookup options through discovery and loading', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SkillService)
+    const options: SkillLookupOptions = { cwd: '/workspace/a' }
+    let listedWith: SkillLookupOptions | undefined
+    let loadedWith: SkillLookupOptions | undefined
     const candidate: SkillCandidate = {
-      name: 'stable-skill',
-      description: 'Stable skill',
-      provider: 'stable-provider',
+      name: 'skill-a',
+      description: 'Skill A',
+      provider: 'contextual',
       source: 'test',
       rank: 1,
-      locator: 'original',
+      locator: 'skill-a',
     }
-    const originalList = vi.fn(() => Promise.resolve([candidate]))
-    const originalGet = vi.fn((listed: SkillCandidate) => Promise.resolve<SkillDefinition>({
-      ...listed,
-      content: 'Original body.',
-    }))
-    const provider: SkillProvider = {
-      name: 'stable-provider',
-      list: originalList,
-      get: originalGet,
-    }
-    const added: SkillProvider[] = []
-    const removed: string[] = []
-    ctx.on('skill/provider-added', (registered) => { added.push(registered) })
-    ctx.on('skill/provider-removed', (name) => { removed.push(name) })
-    const owner = await ctx.plugin({
-      name: 'mutable-provider-owner',
-      inject: ['skills'],
-      apply(pluginCtx: Context) {
-        pluginCtx.skills.registerProvider(provider)
+    ctx.skills.registerProvider({
+      name: 'contextual',
+      async list(received) {
+        listedWith = received
+        return [candidate]
+      },
+      async get(received, lookup) {
+        expect(received).toBe(candidate)
+        loadedWith = lookup
+        return { ...received, content: 'Skill A body.' }
       },
     })
 
-    provider.name = 'mutated-provider'
-    const replacementList = vi.fn(() => Promise.resolve([]))
-    const replacementGet = vi.fn(() => Promise.resolve(undefined))
-    provider.list = replacementList
-    provider.get = replacementGet
+    expect((await ctx.skills.list(options)).map(skill => skill.name)).toEqual(['skill-a'])
+    expect(await ctx.skills.get('skill-a', options)).toMatchObject({ content: 'Skill A body.' })
+    expect(listedWith).toBe(options)
+    expect(loadedWith).toBe(options)
+  })
 
-    expect(added).toHaveLength(1)
-    expect(added[0]).not.toBe(provider)
-    expect(added[0]?.name).toBe('stable-provider')
-    expect(Object.isFrozen(added[0])).toBe(true)
-    expect((await ctx.skills.list()).map(skill => skill.name)).toEqual(['stable-skill'])
-    expect((await ctx.skills.get('stable-skill'))?.content).toBe('Original body.')
-    expect(originalList).toHaveBeenCalledOnce()
-    expect(originalGet).toHaveBeenCalledOnce()
-    expect(replacementList).not.toHaveBeenCalled()
-    expect(replacementGet).not.toHaveBeenCalled()
+  it('rechecks cancellation after cached discovery before provider loading', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SkillService)
+    let getCalls = 0
+    ctx.skills.registerProvider({
+      name: 'cached',
+      async list() {
+        return [{
+          name: 'cached-skill',
+          description: 'Cached skill',
+          provider: 'cached',
+          source: 'test',
+          rank: 1,
+          locator: 'cached',
+        }]
+      },
+      async get(candidate) {
+        getCalls += 1
+        return { ...candidate, content: 'Cached body.' }
+      },
+    })
+    await ctx.skills.list({ cwd: '/workspace/cache' })
+    const controller = new AbortController()
+    const reason = new Error('cancelled after cached discovery')
 
-    await owner.dispose()
-    expect(removed).toEqual(['stable-provider'])
-    expect(await ctx.skills.list()).toEqual([])
-    const replacement = new MemoryProvider([])
-    Object.defineProperty(replacement, 'name', { value: 'stable-provider' })
-    expect(() => ctx.skills.registerProvider(replacement)).not.toThrow()
+    const pending = ctx.skills.get('cached-skill', {
+      cwd: '/workspace/cache',
+      signal: controller.signal,
+    })
+    controller.abort(reason)
+
+    await expect(pending).rejects.toBe(reason)
+    expect(getCalls).toBe(0)
+  })
+
+  it('stops waiting for cached provider loading when a hostile abort reason fires', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SkillService)
+    let markStarted: (() => void) | undefined
+    let release: (() => void) | undefined
+    let seenSignal: AbortSignal | undefined
+    const started = new Promise<void>((resolve) => { markStarted = resolve })
+    const held = new Promise<SkillDefinition>((resolve) => {
+      release = () => {
+        resolve({
+          name: 'held-skill',
+          description: 'Held skill',
+          provider: 'held',
+          source: 'test',
+          content: 'Held body.',
+        })
+      }
+    })
+    ctx.skills.registerProvider({
+      name: 'held',
+      async list() {
+        return [{
+          name: 'held-skill',
+          description: 'Held skill',
+          provider: 'held',
+          source: 'test',
+          rank: 1,
+          locator: 'held',
+        }]
+      },
+      get(_candidate, options) {
+        seenSignal = options.signal
+        markStarted?.()
+        return held
+      },
+    })
+    await ctx.skills.list({ cwd: '/workspace/cache' })
+    const controller = new AbortController()
+    const hostileReason = {
+      [Symbol.toPrimitive]() {
+        throw new Error('abort reason coercion failed')
+      },
+    }
+    const pending = ctx.skills.get('held-skill', {
+      cwd: '/workspace/cache',
+      signal: controller.signal,
+    })
+    const outcome = pending.then(
+      () => 'resolved',
+      (error: unknown) => error instanceof Error && error.message === '[unrenderable thrown value]'
+        ? 'aborted'
+        : 'other-error',
+    )
+    await started
+    controller.abort(hostileReason)
+
+    const settled = await Promise.race([
+      outcome,
+      new Promise<'timeout'>(resolve => setTimeout(() => { resolve('timeout') }, 25)),
+    ])
+    release?.()
+    await pending.catch(() => undefined)
+
+    expect(seenSignal).toBe(controller.signal)
+    expect(settled).toBe('aborted')
+  })
+
+  it('borrows cached candidates and loaded definitions from the provider', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SkillService)
+    const locator = { id: 'provider-owned' }
+    const candidate: SkillCandidate = {
+      name: 'stable-skill',
+      description: 'Stable description',
+      whenToUse: 'When stability matters.',
+      disableModelInvocation: false,
+      provider: 'detached',
+      source: 'test',
+      resourceBase: { kind: 'opaque', description: 'candidate resources' },
+      rank: 1,
+      locator,
+      path: '/skills/stable/SKILL.md',
+      metadata: { owner: 'candidate' },
+    }
+    const definition: SkillDefinition = {
+      name: 'stable-skill',
+      description: 'Stable description',
+      whenToUse: 'When stability matters.',
+      disableModelInvocation: false,
+      provider: 'detached',
+      source: 'test',
+      resourceBase: { kind: 'opaque', description: 'definition resources' },
+      path: '/skills/stable/SKILL.md',
+      metadata: { owner: 'definition' },
+      content: 'Stable body.',
+    }
+    let listCalls = 0
+    let received: SkillCandidate | undefined
+    ctx.skills.registerProvider({
+      name: 'detached',
+      async list() {
+        listCalls += 1
+        return [candidate]
+      },
+      async get(loaded) {
+        received = loaded
+        return definition
+      },
+    })
+
+    const listed = await ctx.skills.list()
+    expect(listed).toEqual([expect.objectContaining({
+      name: 'stable-skill',
+      description: 'Stable description',
+      resourceBase: { kind: 'opaque', description: 'candidate resources' },
+    })])
+    expect(listed[0]?.resourceBase).toBe(candidate.resourceBase)
+    expect(listCalls).toBe(1)
+
+    const loaded = await ctx.skills.get('stable-skill')
+    expect(received).toBe(candidate)
+    expect(received?.locator).toBe(locator)
+    expect(loaded).toBe(definition)
+  })
+
+  it('preserves readonly runtime resource identities while adding the default provider', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SkillService)
+    const resourceBase = { kind: 'opaque' as const, description: 'runtime resources' }
+    const metadata = { owner: 'runtime' }
+    const registration = {
+      name: 'runtime-skill',
+      description: 'Runtime',
+      whenToUse: 'When runtime data is needed.',
+      disableModelInvocation: false,
+      source: 'runtime',
+      resourceBase,
+      metadata,
+      content: 'Runtime body.',
+    }
+    ctx.skills.register(registration)
+    ctx.skills.register({
+      name: 'z-runtime',
+      description: 'Second runtime skill',
+      source: 'runtime',
+      content: 'Second runtime body.',
+    })
+    const listed = await ctx.skills.list()
+    const loaded = await ctx.skills.get('runtime-skill')
+    expect(listed[0]?.resourceBase).toBe(resourceBase)
+    expect(loaded?.resourceBase).toBe(resourceBase)
+    expect(loaded?.metadata).toBe(metadata)
+    expect(loaded?.provider).toBe('runtime')
+  })
+
+  it('rejects every malformed scalar in provider-loaded definitions', async () => {
+    const cases: { patch: Partial<SkillDefinition>; expected: string }[] = [
+      { patch: { name: { value: 'loaded' } as unknown as string }, expected: 'loaded skill name must be a string' },
+      { patch: { name: 'Bad_Name' }, expected: 'loaded skill has invalid name' },
+      { patch: { description: { value: 'description' } as unknown as string }, expected: 'description must be a string' },
+      { patch: { description: '' }, expected: 'requires a description' },
+      { patch: { disableModelInvocation: 'false' as unknown as boolean }, expected: 'disableModelInvocation must be a boolean' },
+      { patch: { whenToUse: 1 as unknown as string }, expected: 'whenToUse must be a string' },
+      { patch: { source: { value: 'source' } as unknown as string }, expected: 'source must be a string' },
+      { patch: { provider: { value: 'provider' } as unknown as string }, expected: 'provider must be a string' },
+      { patch: { content: { value: 'content' } as unknown as string }, expected: 'content must be a string' },
+      { patch: { path: 1 as unknown as string }, expected: 'path must be a string' },
+    ]
+    for (const [index, { patch, expected }] of cases.entries()) {
+      const ctx = new Context()
+      await ctx.plugin(SkillService)
+      const providerName = `definition-provider-${index}`
+      const skillName = `definition-${index}`
+      ctx.skills.registerProvider({
+        name: providerName,
+        list: () => Promise.resolve([{
+          name: skillName,
+          description: 'Candidate',
+          provider: providerName,
+          source: 'test',
+          rank: 1,
+          locator: 'definition',
+        }]),
+        get: () => Promise.resolve({
+          name: skillName,
+          description: 'Definition',
+          whenToUse: 'Use this definition.',
+          disableModelInvocation: false,
+          provider: providerName,
+          source: 'test',
+          content: 'Definition body.',
+          path: '/skills/definition/SKILL.md',
+          ...patch,
+        } as SkillDefinition),
+      })
+
+      await expect(ctx.skills.get(skillName)).rejects.toThrow(expected)
+    }
   })
 
   it('validates provider candidates and invalid registry caps', async () => {
@@ -282,6 +566,34 @@ describe('SkillService registry', () => {
     expect(flakyCalls).toBe(3)
   })
 
+  it('contains a provider rejection whose string coercion throws', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SkillService)
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const hostileFailure = {
+      toString() {
+        throw new Error('provider failure coercion failed')
+      },
+    }
+    ctx.skills.registerProvider({
+      name: 'hostile-failure',
+      list() {
+        // Deliberately violate the provider contract to prove containment is total.
+        // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors
+        return Promise.reject(hostileFailure)
+      },
+      async get() {
+        return undefined
+      },
+    })
+
+    await expect(ctx.skills.list()).resolves.toEqual([])
+    expect(warnings).toEqual([
+      'skill provider "hostile-failure" skipped: [unrenderable thrown value]',
+    ])
+  })
+
   it('abandons an in-flight catalog when provider registrations change', async () => {
     const ctx = new Context()
     await ctx.plugin(SkillService)
@@ -351,39 +663,6 @@ describe('SkillService registry', () => {
     expect(settled).toBe('aborted')
   })
 
-  it('does not miss an abort racing listener installation', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SkillService)
-    const reason = new Error('racing abort')
-    let aborted = false
-    const signal = {
-      get aborted() {
-        return aborted
-      },
-      reason,
-      throwIfAborted() {
-        if (aborted) throw reason
-      },
-      addEventListener(_type: string, listener: () => void) {
-        aborted = true
-        listener()
-      },
-      removeEventListener() {},
-    } as unknown as AbortSignal
-    ctx.skills.registerProvider({
-      name: 'racing-abort',
-      list() {
-        return Promise.reject(new Error('late provider failure'))
-      },
-      async get() {
-        return undefined
-      },
-    })
-
-    await expect(ctx.skills.list({ signal })).rejects.toBe(reason)
-    await Promise.resolve()
-  })
-
   it('rejects invalid runtime skill registrations and ignores duplicates', async () => {
     const ctx = new Context()
     await ctx.plugin(SkillService)
diff --git a/packages/subagent/subagent-acp/README.md b/packages/subagent/subagent-acp/README.md
index ca331796c8..092a8e3497 100644
--- a/packages/subagent/subagent-acp/README.md
+++ b/packages/subagent/subagent-acp/README.md
@@ -1,32 +1,31 @@
 # @deepseek-ai/dsh-subagent-acp
 
-The out-of-process **ACP subagent backend**: runs each child agent in a spawned subprocess, driven over the [Agent Client Protocol](https://github.com/zed-industries/agent-client-protocol) (ACP) as the *client*. Registers a `SubagentProvider` on `ctx.subagents` (the [subagent seam](../subagent)), alongside the in-process [`-spawn`](../subagent-spawn)/[`-fork`](../subagent-fork) backends — multiple backends coexist by name.
+The ACP provider runs each subagent in a fresh subprocess and drives it as an Agent Client Protocol client. It is the out-of-process alternative to spawn and fork: the child has its own runtime, session, model configuration, and tools.
 
-It is the direction-inverted twin of the server-side bridge in [`@deepseek-ai/dsh-acp`](../../ui/acp): that package is the ACP *agent* (it answers `initialize`/`newSession`/`prompt`); this one is the ACP *client* (it *calls* them and implements the `sessionUpdate`/`requestPermission` callbacks). Point the configured command at the `acp-agent` example to "talk to our own process".
+## Start and ownership
 
-## What it does
+`start(request)` performs `spawn` → ACP `initialize` → `newSession` before it fulfills. Fulfillment therefore means a remote session is ready and ownership has transferred to the caller. A spawn, initialization, new-session, or pre-publication cancellation failure rejects only after the subprocess has been reaped.
 
-`start(request)` spawns the configured command, wraps its stdio in an ACP `ClientSideConnection`, and drives one session: `initialize` → `newSession` → `prompt`. `run.started` resolves after `newSession` publishes the remote session and rejects when initialization fails or cancellation wins first; the service emits no start/end pair for a child that never became live. The child's streamed `agent_message_chunk` text becomes the `SubagentResult.output`; the prompt's terminal `StopReason` maps to the stop reason. `dispose()` kills the subprocess and awaits its exit.
+After publication, the provider sends the prompt and collects streamed `agent_message_chunk` text into `SubagentResult.output`. A prompt/transport failure resolves with `stopReason: 'error'`, or `aborted` when the required request signal or disposal requested cancellation.
 
-**Fresh process per run.** Each `start` spawns a new child, runs exactly one ACP session, and disposes it. Persistent-process pooling is a future optimization (see the RFC).
+`dispose()` is idempotent. It removes the signal listener, requests ACP cancellation when possible, closes stdin, waits `disposeEofGraceMs`, escalates to SIGTERM, waits `disposeGraceMs`, and finally uses SIGKILL if necessary. Every run uses a fresh process; process pooling is not implemented.
 
-Unlike the in-process backends, the child does NOT share this cordis context — it is a separate process with its own session, model client, and tools. So this backend:
-- injects only `subagents` (no `ctx.agents`);
-- advertises NO start-time capabilities (an out-of-process child can't enforce the parent's depth/tool-filter);
-- ignores `request.parent`.
+## Capabilities and context
 
-## Config
+ACP advertises no start-time capabilities because this process cannot enforce the remote child's depth, tool filter, persona, or structured-output runtime. It also reports `inheritsParentContext: false`: the remote session starts fresh and ignores `request.parent` beyond the seam's required attribution field.
 
-| Key | Type | Default | Notes |
-|---|---|---|---|
-| `providerName` | string | `acp` | Registry name on `ctx.subagents`. |
-| `command` | string | — (required) | The executable to spawn for each run (the child ACP agent). |
-| `args` | string[] | `[]` | Arguments passed to `command`. |
-| `cwd` | string | process cwd | Working directory for the child process and its ACP session. |
-| `permission` | `'allow' \| 'reject'` | `reject` | How to auto-answer the child's `session/request_permission` prompts. `reject` declines every prompt (answer `cancelled`); `allow` approves via the first allow-shaped option. The first cut surfaces no prompt to a human. |
-| `env` | Record<string,string> | `{}` | Extra env vars for the child (e.g. its own `DEEPSEEK_API_KEY`). Forwarded on top of a credential-scrubbed copy of the parent env, so an explicit key reaches the child while ambient secrets do not leak implicitly. |
-| `disposeEofGraceMs` | number | `6000` | Dispose ladder tier 1: how long the child gets to quiesce on its own after stdin EOF (flush persistence, tear down its nested subprocesses) before SIGTERM. |
-| `disposeGraceMs` | number | `3000` | Dispose ladder tier 2: grace between SIGTERM and the SIGKILL escalation. |
+## Configuration
+
+| Key | Default | Meaning |
+|---|---|---|
+| `providerName` | `acp` | Registry name on `ctx.subagents`. |
+| `command` | required | Executable spawned for each run. |
+| `args` | `[]` | Command arguments. |
+| `cwd` | process cwd | Child process and ACP session working directory. |
+| `permission` | `reject` | Auto-answer permission requests by rejecting or choosing the first allow-shaped option. |
+| `env` | `{}` | Explicit child environment layered over a credential-scrubbed parent environment. |
+| `disposeEofGraceMs` | `6000` | Grace after stdin EOF before SIGTERM. |
+| `disposeGraceMs` | `3000` | Grace after SIGTERM before SIGKILL. |
 
 ```yaml
 - id: subagent-acp
@@ -40,40 +39,28 @@ Unlike the in-process backends, the child does NOT share this cordis context —
       DEEPSEEK_API_KEY: !!js process.env.DEEPSEEK_API_KEY
 ```
 
-## StopReason mapping
+## Stop-reason mapping
 
-ACP `StopReason` → harness `SubagentStopReason`:
-
-| ACP | harness |
+| ACP | Harness |
 |---|---|
 | `end_turn` | `completed` |
 | `max_tokens` | `max-tokens` |
 | `refusal` | `refusal` |
 | `cancelled` | `aborted` |
-| `max_turn_requests` | `error` (no clean equivalent; the task did not finish) |
-| _(unknown)_ | `error` |
+| `max_turn_requests` or unknown | `error` |
 
-A spawn/transport/RPC failure resolves `error` (or `aborted` if a cancel was requested) — `result` never rejects on a child-level failure, per the seam contract.
+## Process boundary
 
-## Environment scrub
+The child environment is built by [`buildChildEnv`](../subagent-subprocess/README.md): credential-shaped ambient variables are removed, then explicit `config.env` values are applied. The ACP wire is the real serialization boundary; same-process subagent values are not defensively cloned.
 
-The child env is built by [`buildChildEnv` from `@deepseek-ai/dsh-subagent-subprocess`](../subagent-subprocess/README.md) — the ambient env minus credential-shaped vars, with `config.env` layered on top after the scrub; the pattern and full semantics live there. For this backend that means the parent harness's own secrets never leak into the spawned agent implicitly, while the child's OWN `DEEPSEEK_API_KEY` is supplied deliberately via `config.env` and survives.
+The package has no default export. Cordis loader unwrapping would otherwise hide the named `inject` metadata; see [postmortem 0001](../../../docs/postmortem/0001-acp-default-export-drops-inject.md).
 
-## Testing
-
-- **Keyless** (`subagent-acp.spec.ts`): spawns a scripted mock ACP server subprocess (`tests/mock-acp-server.ts`) and drives it through the real backend over real ACP stdio — connection setup, client callbacks, the prompt round-trip, stop-reason mapping, cancellation (including the early-cancel race and a torn-pipe-after-cancel), permission auto-answer, and quiescent disposal. No model, no key.
-- **With-key e2e** (`subagent-acp.e2e.ts`): the harness drives ITSELF — the backend spawns the real `acp-agent` example process and a real model in that child answers a prompt and does real file work (verified on disk). Self-skips without `DEEPSEEK_API_KEY`.
-
-`TODO(acp-subagent-replay)`: snapshot-tier coverage of an ACP child is a separate replay shape (each child is its own PROCESS with its own single-agent replay, distinct from the in-process per-session keying), deferred — see the RFC.
-
-## Plugin export shape
-
-Named `name` / `inject` / `Config` / `apply`, with **no default export**: the cordis Loader's `unwrapExports` does `exports.default ?? exports`, so a stray default would collapse the module to the bare function and drop the `inject` namespace (see [docs/postmortem/0001](../../../docs/postmortem/0001-acp-default-export-drops-inject.md)).
+Keyless tests drive a scripted ACP subprocess over real stdio. The with-key e2e drives the repository's real ACP agent and self-skips without `DEEPSEEK_API_KEY`.
 
 ## Known Limitations and Deferred Work
 
 - **A fresh process per run** — persistent-process pooling is a future optimization ([the seam RFC](../../../docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md)).
-- **No start-time capability enforcement** — an out-of-process child cannot honor the parent's `outputSchema`/`depthLimit`/`toolFilter`/`persona`, so the provider advertises none and `request.parent` is ignored.
+- **No optional start-time capabilities** — this provider cannot apply the local harness's `outputSchema`, depth cap, tool filter, or persona inside the remote process, so it advertises none and the service rejects requests that require them.
 - **Only `agent_message_chunk` text is collected** — the child's tool-call activity, thought chunks, and plan updates are not surfaced to the parent.
 - **Permission prompts are auto-answered** (`permission: allow | reject`) — no human is surfaced a child's `session/request_permission` in this cut.
 - **No snapshot-tier replay coverage** (`TODO(acp-subagent-replay)`) — an ACP child is its own process with its own replay shape, deferred.
diff --git a/packages/subagent/subagent-acp/src/run.ts b/packages/subagent/subagent-acp/src/run.ts
index 410f7ad7bf..5222906a2d 100644
--- a/packages/subagent/subagent-acp/src/run.ts
+++ b/packages/subagent/subagent-acp/src/run.ts
@@ -180,35 +180,19 @@ function toError(value: unknown): Error {
  * and drives one session: `initialize` → `newSession` → `prompt`. The accumulated
  * `agent_message_chunk` text is the result output; the prompt's terminal
  * `StopReason` maps to the stop reason. `result` never REJECTS on a child-level
- * failure (a spawn/transport/RPC error resolves with `stopReason: 'error'`), per
- * the seam contract. `cancel()` sends `session/cancel`; `dispose()` kills the
- * subprocess and awaits its exit (quiescent teardown).
- * @param request - the start request; the driver consumes `prompt` and `signal`
- * (an already-aborted signal yields an inert `aborted` run with no spawn).
+ * failure after publication resolves with `stopReason: 'error'`. A spawn,
+ * initialize, new-session, or pre-publication cancellation failure instead
+ * rejects only after the process has been reaped. `dispose()` requests ACP
+ * cancellation, then kills and reaps the subprocess.
+ * @param request - the start request; its signal is the cancellation channel.
  * @param spec - the resolved spawn spec: command/args/cwd, env, permission
  * policy, dispose graces, and the optional error sink.
- * @returns the live run handle for the child subprocess.
+ * @returns the ready run handle for the child subprocess.
  */
-export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): SubagentRun {
+export async function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Promise<SubagentRun> {
   const id = AgentId(randomUUID())
 
-  // A request already aborted before it starts never spawns the child at all —
-  // return an inert run that settled `aborted`, rather than launching the
-  // configured binary just to tear it down. `dispose`/`cancel` are no-ops.
-  if (request.signal?.aborted) {
-    const started = Promise.reject(new Error('subagent request was aborted before the ACP child started'))
-    // The result is derived from the same boundary so the readiness rejection
-    // is observed even when this provider is driven directly rather than
-    // through SubagentService.
-    const result: Promise<SubagentResult> = started.catch(() => ({ output: [], stopReason: 'aborted' }))
-    return {
-      id,
-      started,
-      result,
-      cancel(_reason?: string): void { /* nothing was started */ },
-      dispose(): Promise<void> { return Promise.resolve() },
-    }
-  }
+  if (request.signal.aborted) throw new Error('subagent request was aborted before the ACP child started')
 
   // Spawn the child ACP agent. stdin = ACP request channel, stdout = ACP
   // response channel, stderr = INHERIT so the child's diagnostics surface on the
@@ -225,9 +209,18 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su
   // `error` like any child failure.
   const spawnFailed = spawnFailure(child)
 
+  // One memoized quiescence transaction is shared by startup rollback and the
+  // published run's disposer. Once start fulfills, only the holder can invoke
+  // it; before fulfillment the provider invokes it on every failure path.
+  let processDisposal: Promise<void> | undefined
+  const disposeProcess = (): Promise<void> => (processDisposal ??= disposeChildProcess(child, {
+    disposeEofGraceMs: spec.disposeEofGraceMs,
+    disposeGraceMs: spec.disposeGraceMs,
+  }))
+
   // Accumulate the child's streamed assistant text — the SubagentResult output.
   const output: string[] = []
-  // `cancelled` records that a cancel was requested (signal or cancel()), so a
+  // `cancelled` records that the required signal or disposal requested cancel, so a
   // run torn down before the prompt resolves settles `aborted` rather than the
   // generic error mapping. Held on a mutable object so the async closures that
   // set it (the abort listener) and the IIFE that reads it don't fight TS's
@@ -271,7 +264,7 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su
   // Resolves when a cancel is requested, so `result` can settle `aborted` even
   // if the child never cooperates with `session/cancel` (it ignores the notify,
   // or the prompt wedges). The result path races this against the ACP drive: the
-  // FIRST to settle wins, so `cancel()` always honors the contract (`result`
+  // FIRST to settle wins, so signal/dispose cancellation always honors the contract (`result`
   // settles `aborted`) without waiting on a non-cooperative child. `dispose`
   // still kills the process and reaps it; this only unblocks `result`. The
   // executor runs synchronously, so `signalCancelSettled` is assigned before the
@@ -279,6 +272,7 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su
   let signalCancelSettled!: () => void
   const cancelSettled = new Promise<void>((resolve) => { signalCancelSettled = resolve })
   const requestCancel = (): void => {
+    if (flags.cancelled) return
     flags.cancelled = true
     signalCancelSettled()
     // Best-effort: tell the child to cancel the in-flight turn. Swallows a
@@ -293,7 +287,7 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su
     if (sessionId !== undefined) void conn.cancel({ sessionId }).catch(() => { /* child gone / no session */ })
   }
   const onAbort = (): void => { requestCancel() }
-  request.signal?.addEventListener('abort', onAbort, { once: true })
+  request.signal.addEventListener('abort', onAbort, { once: true })
 
   // The accumulated child text as harness ContentBlocks (empty array when the
   // child streamed nothing). Read at every return so a partial answer survives
@@ -303,47 +297,41 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su
     return text.length > 0 ? [{ type: 'text', text }] : []
   }
 
-  // A provider is "started" only once the remote child has completed ACP
-  // initialization and published a session. SubagentService gates its
-  // `subagent/start` notification on this boundary, just as the in-process
-  // provider gates it on local Agent publication. Failure or cancellation
-  // before this point rejects readiness and therefore produces no paired
-  // lifecycle events for a child that never became live.
-  const started: Promise<void> = Promise.race([
-    (async (): Promise<void> => {
-      await conn.initialize({
-        protocolVersion: PROTOCOL_VERSION,
-        // Advertise NO optional client capabilities (no fs, no terminal): the
-        // child self-serves in its own process.
-        clientCapabilities: {},
-      })
-      const session = await conn.newSession({ cwd: spec.cwd, mcpServers: [] })
-      sessionId = session.sessionId
-      if (flags.cancelled) throw new Error('subagent cancelled before the ACP session started')
-    })(),
-    spawnFailed.then((err): never => { throw err }),
-    cancelSettled.then((): never => { throw new Error('subagent cancelled before the ACP session started') }),
-  ])
+  // Establish the remote session before publishing a handle. Any failure owns
+  // the still-private process and therefore reaps it before rejecting.
+  try {
+    await Promise.race([
+      (async (): Promise<void> => {
+        await conn.initialize({
+          protocolVersion: PROTOCOL_VERSION,
+          // Advertise NO optional client capabilities (no fs, no terminal): the
+          // child self-serves in its own process.
+          clientCapabilities: {},
+        })
+        const session = await conn.newSession({ cwd: spec.cwd, mcpServers: [] })
+        sessionId = session.sessionId
+        if (flags.cancelled) throw new Error('subagent cancelled before the ACP session started')
+      })(),
+      spawnFailed.then((err): never => { throw err }),
+      cancelSettled.then((): never => { throw new Error('subagent cancelled before the ACP session started') }),
+    ])
+  } catch (error: unknown) {
+    request.signal.removeEventListener('abort', onAbort)
+    await disposeProcess()
+    if (flags.cancelled) throw new Error('subagent request was aborted before the ACP child started')
+    throw toError(error)
+  }
 
   const result: Promise<SubagentResult> = (async (): Promise<SubagentResult> => {
     try {
-      // Readiness is the initialize → newSession phase above. Awaiting the SAME
-      // promise immediately observes its rejection even without the service,
-      // and guarantees the prompt phase never starts before the provider can
-      // truthfully announce a live child.
-      await started
-
-      // Race two post-start outcomes, first to settle wins:
+      // Race two post-publication outcomes, first to settle wins:
       //  - prompt: the normal remote turn;
       //  - cancelSettled: a cancel was requested — settle `aborted` immediately
       //    rather than waiting on a child that may ignore `session/cancel` or
-      //    wedge the prompt (the `cancel()` contract: `result` settles `aborted`).
-      // A spawn error can only precede readiness and is already one arm of
-      // `started`; after `newSession` succeeds, transport/process failure rejects
-      // the in-flight prompt RPC through the connection.
+      //    wedge the prompt (`result` settles `aborted`). After `newSession`
+      // succeeds, transport/process failure rejects the in-flight prompt RPC.
       const prompt = async (): Promise<SubagentResult> => {
-        // `started` cannot fulfill without assigning the session id; the cast
-        // records that local invariant without an unreachable defensive arm.
+        // The startup phase cannot fulfill without assigning the session id.
         const promptResult = await conn.prompt({ sessionId: sessionId as string, prompt: toAcpPrompt(request.prompt) })
         return { output: collectOutput(), stopReason: acpStopReason(promptResult.stopReason) }
       }
@@ -352,11 +340,15 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su
         cancelSettled.then((): SubagentResult => ({ output: collectOutput(), stopReason: 'aborted' })),
       ])
     } catch (error: unknown) {
+      // A deterministic cancellation resolves `cancelSettled` before its
+      // best-effort ACP cancel can reject the prompt. This fallback is only for
+      // a process/pipe rejection already queued when the abort event fires; its
+      // first-outcome ordering cannot be forced without a timing-dependent test.
+      /* v8 ignore next */
       if (flags.cancelled) return { output: collectOutput(), stopReason: 'aborted' }
       // The seam contract: result resolves (never rejects) on a child-level
-      // failure. A cancellation is recognized by the flag above even when it
-      // wins during readiness; every other rejection is a genuine child-level
-      // error — initialize/newSession/prompt transport/RPC failure or ENOENT.
+      // failure. Startup failures were already rejected before publication;
+      // every rejection here is a prompt transport/RPC failure.
       // Flatten to `error` and surface the original via onError so a real fault
       // is preserved rather than silently lost.
       try {
@@ -367,18 +359,19 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su
         // The child-level failure being reported still settles as `error`.
       }
       return { output: collectOutput(), stopReason: 'error' }
+    } finally {
+      request.signal.removeEventListener('abort', onAbort)
     }
   })()
 
+  let disposal: Promise<void> | undefined
   return {
     id,
-    started,
     result,
-    cancel(_reason?: string): void {
+    dispose(): Promise<void> {
+      if (disposal !== undefined) return disposal
+      request.signal.removeEventListener('abort', onAbort)
       requestCancel()
-    },
-    async dispose(): Promise<void> {
-      request.signal?.removeEventListener('abort', onAbort)
       // Quiescent teardown via the shared ladder (stdin EOF → SIGTERM →
       // SIGKILL, awaiting the actual exit). For THIS child the EOF tier is the
       // one that matters: our acp-agent has NO SIGTERM handler in a normal
@@ -388,10 +381,8 @@ export function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpec): Su
       // turn/end BEFORE that post-turn flush lands, so the child still has
       // durable work owed when dispose runs (hence the wide EOF grace; see
       // DEFAULT_DISPOSE_EOF_GRACE_MS).
-      await disposeChildProcess(child, {
-        disposeEofGraceMs: spec.disposeEofGraceMs,
-        disposeGraceMs: spec.disposeGraceMs,
-      })
+      disposal = disposeProcess()
+      return disposal
     },
   }
 }
diff --git a/packages/subagent/subagent-acp/tests/mock-acp-server.ts b/packages/subagent/subagent-acp/tests/mock-acp-server.ts
index 9cfeac1f44..fb200f3505 100644
--- a/packages/subagent/subagent-acp/tests/mock-acp-server.ts
+++ b/packages/subagent/subagent-acp/tests/mock-acp-server.ts
@@ -68,6 +68,7 @@ const WANT_PERMISSION = process.env.MOCK_PERMISSION === '1'
 const NO_ALLOW = process.env.MOCK_NO_ALLOW === '1'
 const THOUGHT = process.env.MOCK_THOUGHT === '1'
 const CRASH_ON_CANCEL = process.env.MOCK_CRASH_ON_CANCEL === '1'
+const CRASH_ON_PROMPT = process.env.MOCK_CRASH_ON_PROMPT === '1'
 const IGNORE_CANCEL = process.env.MOCK_IGNORE_CANCEL === '1'
 const READY_FILE = process.env.MOCK_READY_FILE
 const FLUSH_ON_EOF = process.env.MOCK_FLUSH_ON_EOF
@@ -105,6 +106,7 @@ function makeAgent(conn: AgentSideConnection): Agent {
       return Promise.resolve()
     },
     async prompt(params: PromptRequest): Promise<PromptResponse> {
+      if (CRASH_ON_PROMPT) process.exit(1)
       if (WANT_PERMISSION) {
         // Ask the client to approve before answering; honor its decision. Under
         // MOCK_NO_ALLOW the only options are reject-shaped, so an `allow`-policy
@@ -225,4 +227,3 @@ if (process.env.MOCK_IGNORE_EOF === '1') {
   setInterval(() => { /* stay alive past EOF until SIGTERM */ }, 1000)
   if (READY_FILE !== undefined) writeFileSync(READY_FILE, 'ignore-eof-armed')
 }
-
diff --git a/packages/subagent/subagent-acp/tests/subagent-acp.e2e.ts b/packages/subagent/subagent-acp/tests/subagent-acp.e2e.ts
index 826ef198dd..7814dfaca3 100644
--- a/packages/subagent/subagent-acp/tests/subagent-acp.e2e.ts
+++ b/packages/subagent/subagent-acp/tests/subagent-acp.e2e.ts
@@ -60,9 +60,10 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('ACP backend with-key e2e (drive
       },
     })
 
-    const run = ctx.subagents.start('acp', {
+    const run = await ctx.subagents.start('acp', {
       prompt: [{ type: 'text', text: 'Reply with exactly the word PONG and nothing else. Do not use any tools.' }],
       parent: fakeParent,
+      signal: new AbortController().signal,
     })
     const result = await run.result
     await run.dispose()
@@ -93,11 +94,12 @@ describe.skipIf(!process.env.DEEPSEEK_API_KEY)('ACP backend with-key e2e (drive
       },
     })
 
-    const run = ctx.subagents.start('acp', {
+    const run = await ctx.subagents.start('acp', {
       prompt: [{ type: 'text', text:
         'Use the bash tool to write the text ACP_CHILD_WAS_HERE into a file named proof.txt '
         + 'in the current directory. Then reply DONE.' }],
       parent: fakeParent,
+      signal: new AbortController().signal,
     })
     const result = await run.result
     await run.dispose()
diff --git a/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts b/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts
index e25d194c98..eed3cfe1ed 100644
--- a/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts
+++ b/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts
@@ -27,6 +27,10 @@ const repoTsconfig = fileURLToPath(new URL('../../../../tsconfig.json', import.m
 /** A throwaway parent Agent — the ACP backend ignores it, but the seam requires one. */
 const fakeParent = { id: 'parent', session: { header: {} } } as unknown as Agent
 
+function request(text = 'p', signal = new AbortController().signal) {
+  return { prompt: [{ type: 'text' as const, text }], parent: fakeParent, signal }
+}
+
 interface SetupEnv {
   /** Mock-server scripting env: MOCK_TEXT / MOCK_STOP / MOCK_HANG / MOCK_PERMISSION. */
   [key: string]: string
@@ -119,16 +123,18 @@ describe('buildChildEnv', () => {
 describe('dsh-subagent-acp', () => {
   it('drives a child process to completion and returns its streamed output', async () => {
     const ctx = await setup({ MOCK_TEXT: 'hello from acp child', MOCK_STOP: 'end_turn' })
-    const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'do X' }], parent: fakeParent })
+    const run = await ctx.subagents.start('acp', request('do X'))
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(text(result.output)).toBe('hello from acp child')
-    await run.dispose()
+    const disposal = run.dispose()
+    expect(run.dispose()).toBe(disposal)
+    await disposal
   })
 
   it('maps a max_tokens stop reason', async () => {
     const ctx = await setup({ MOCK_TEXT: 'cut off', MOCK_STOP: 'max_tokens' })
-    const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+    const run = await ctx.subagents.start('acp', request())
     const result = await run.result
     expect(result.stopReason).toBe('max-tokens')
     await run.dispose()
@@ -136,22 +142,23 @@ describe('dsh-subagent-acp', () => {
 
   it('maps a refusal stop reason', async () => {
     const ctx = await setup({ MOCK_TEXT: '', MOCK_STOP: 'refusal' })
-    const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+    const run = await ctx.subagents.start('acp', request())
     const result = await run.result
     expect(result.stopReason).toBe('refusal')
     await run.dispose()
   })
 
-  it('cancelling a running child settles aborted (session/cancel via run.cancel)', async () => {
+  it('aborting the required signal cancels a running child', async () => {
     const tmp = mkdtempSync(join(tmpdir(), 'acp-cancel-'))
     const readyFile = join(tmp, 'ready')
     try {
       const ctx = await setup({ MOCK_TEXT: 'partial', MOCK_HANG: '1', MOCK_READY_FILE: readyFile })
-      const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+      const controller = new AbortController()
+      const run = await ctx.subagents.start('acp', request('p', controller.signal))
       // Wait until the child's prompt is in flight (condition, not a sleep),
       // then cancel — so we exercise the mid-run session/cancel path.
       await waitForFile(readyFile)
-      run.cancel('test')
+      controller.abort('test')
       const result = await run.result
       expect(result.stopReason).toBe('aborted')
       await run.dispose()
@@ -160,7 +167,7 @@ describe('dsh-subagent-acp', () => {
     }
   })
 
-  it('settles aborted WITHOUT spawning the child when the signal is already aborted', async () => {
+  it('rejects WITHOUT spawning the child when the signal is already aborted', async () => {
     // A pre-aborted request must not even launch the configured binary. Point
     // the command at one that would create a sentinel file if it ever ran, and
     // assert the sentinel never appears.
@@ -169,17 +176,11 @@ describe('dsh-subagent-acp', () => {
     try {
       const controller = new AbortController()
       controller.abort()
-      const run = startAcpRun(
-        { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent, signal: controller.signal },
+      await expect(startAcpRun(
+        request('p', controller.signal),
         // `touch <sentinel>` — runs only if the process is actually spawned.
         { command: 'touch', args: [sentinel], cwd: tmp, permission: 'reject', env: {}, disposeEofGraceMs: DEFAULT_DISPOSE_EOF_GRACE_MS, disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS },
-      )
-      const result = await run.result
-      expect(result.stopReason).toBe('aborted')
-      expect(result.output).toEqual([])
-      // cancel/dispose on the inert run are safe no-ops.
-      run.cancel('noop')
-      await run.dispose()
+      )).rejects.toThrow('aborted before the ACP child started')
       // The binary was never launched — no sentinel.
       expect(existsSync(sentinel)).toBe(false)
     } finally {
@@ -206,7 +207,7 @@ describe('dsh-subagent-acp', () => {
         disposeEofGraceMs: 150,
         disposeGraceMs: 150,
       }
-      const run = startAcpRun({ prompt: [{ type: 'text', text: 'p' }], parent: fakeParent }, spec)
+      const run = await startAcpRun(request(), spec)
       // Wait until the child has BOOTED AND ARMED THE TRAP (a condition, not a
       // sleep) — otherwise SIGTERM races the trap install and the default handler
       // terminates the child, never exercising the escalation.
@@ -253,7 +254,7 @@ describe('dsh-subagent-acp', () => {
         disposeEofGraceMs: 2000,
         disposeGraceMs: 50,
       }
-      const run = startAcpRun({ prompt: [{ type: 'text', text: 'p' }], parent: fakeParent }, spec)
+      const run = await startAcpRun(request(), spec)
       // Wait until the child is fully booted with its prompt in flight (its ACP
       // stdin reader is attached), so dispose's stdin EOF reaches a live child.
       await waitForFile(ready)
@@ -290,7 +291,7 @@ describe('dsh-subagent-acp', () => {
         disposeEofGraceMs: 150,
         disposeGraceMs: 2000,
       }
-      const run = startAcpRun({ prompt: [{ type: 'text', text: 'p' }], parent: fakeParent }, spec)
+      const run = await startAcpRun(request(), spec)
       await waitForFile(ready)
       // Bound it so a hang fails loud rather than stalling the suite.
       await expect(Promise.race([
@@ -305,7 +306,7 @@ describe('dsh-subagent-acp', () => {
     }
   })
 
-  it('honors a cancel that races AHEAD of newSession (no session id yet) without running the prompt', async () => {
+  it('rejects after cleanup when the signal aborts during newSession', async () => {
     // Gate the child at newSession: it signals `ready` and blocks until `go`.
     // We cancel WHILE newSession is pending (sessionId still undefined, so the
     // backend cannot send session/cancel) — the `cancelled` flag alone must
@@ -315,14 +316,12 @@ describe('dsh-subagent-acp', () => {
     const go = join(tmp, 'go')
     try {
       const ctx = await setup({ MOCK_NEWSESSION_READY: ready, MOCK_NEWSESSION_GO: go, MOCK_TEXT: 'should not run' })
-      const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+      const controller = new AbortController()
+      const starting = ctx.subagents.start('acp', request('p', controller.signal))
       await waitForFile(ready) // newSession is now in flight, sessionId undefined
-      run.cancel('early') // sets cancelled; cannot send session/cancel yet
+      controller.abort('early')
       writeFileSync(go, 'go') // let newSession resolve
-      const result = await run.result
-      expect(result.stopReason).toBe('aborted')
-      expect(result.output).toEqual([])
-      await run.dispose()
+      await expect(starting).rejects.toThrow('aborted before the ACP child started')
     } finally {
       rmSync(tmp, { recursive: true, force: true })
     }
@@ -334,7 +333,7 @@ describe('dsh-subagent-acp', () => {
     try {
       const controller = new AbortController()
       const ctx = await setup({ MOCK_TEXT: 'partial', MOCK_HANG: '1', MOCK_READY_FILE: readyFile })
-      const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent, signal: controller.signal })
+      const run = await ctx.subagents.start('acp', request('p', controller.signal))
       await waitForFile(readyFile)
       controller.abort()
       const result = await run.result
@@ -347,7 +346,7 @@ describe('dsh-subagent-acp', () => {
 
   it('auto-rejects a permission prompt by default (child settles cancelled→aborted)', async () => {
     const ctx = await setup({ MOCK_TEXT: 'x', MOCK_PERMISSION: '1' }, 'reject')
-    const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+    const run = await ctx.subagents.start('acp', request())
     const result = await run.result
     // The child asked permission, the backend rejected, the child returned cancelled.
     expect(result.stopReason).toBe('aborted')
@@ -356,7 +355,7 @@ describe('dsh-subagent-acp', () => {
 
   it('auto-approves a permission prompt under the allow policy', async () => {
     const ctx = await setup({ MOCK_TEXT: 'approved answer', MOCK_PERMISSION: '1', MOCK_STOP: 'end_turn' }, 'allow')
-    const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+    const run = await ctx.subagents.start('acp', request())
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(text(result.output)).toBe('approved answer')
@@ -367,7 +366,7 @@ describe('dsh-subagent-acp', () => {
     // The child asks permission but offers ONLY reject-shaped options, so an
     // allow-policy client finds nothing to select and must answer cancelled.
     const ctx = await setup({ MOCK_PERMISSION: '1', MOCK_NO_ALLOW: '1' }, 'allow')
-    const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+    const run = await ctx.subagents.start('acp', request())
     const result = await run.result
     expect(result.stopReason).toBe('aborted')
     await run.dispose()
@@ -377,7 +376,7 @@ describe('dsh-subagent-acp', () => {
     // The child streams an agent_thought_chunk before its answer; the backend
     // must consume it but NOT include it in the result output.
     const ctx = await setup({ MOCK_THOUGHT: '1', MOCK_TEXT: 'final answer', MOCK_STOP: 'end_turn' })
-    const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+    const run = await ctx.subagents.start('acp', request())
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     // Only the message text, NOT the thought.
@@ -385,18 +384,11 @@ describe('dsh-subagent-acp', () => {
     await run.dispose()
   })
 
-  it('resolves error (not reject) when the spawn command does not exist', async () => {
-    // Direct startAcpRun with NO onError sink — the catch must still flatten the
-    // spawn failure to `error` (the onError call is optional, covering the
-    // absent-sink branch).
-    const run = startAcpRun(
-      { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent },
+  it('rejects a spawn failure after provider-owned cleanup', async () => {
+    await expect(startAcpRun(
+      request(),
       { command: '/nonexistent/acp-agent-binary', args: [], cwd: process.cwd(), permission: 'reject', env: {}, disposeEofGraceMs: DEFAULT_DISPOSE_EOF_GRACE_MS, disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS },
-    )
-    const result = await run.result
-    // The seam contract: a child-level failure resolves error, never rejects.
-    expect(result.stopReason).toBe('error')
-    await run.dispose()
+    )).rejects.toThrow()
   })
 
   it('plugin-config dispose graces reach the run (SIGKILL escalation through the provider)', async () => {
@@ -418,7 +410,7 @@ describe('dsh-subagent-acp', () => {
         disposeEofGraceMs: 150,
         disposeGraceMs: 150,
       })
-      const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+      const run = await ctx.subagents.start('acp', request())
       await waitForFile(ready)
       await expect(Promise.race([
         run.dispose(),
@@ -440,7 +432,7 @@ describe('dsh-subagent-acp', () => {
     }
   })
 
-  it('resolves error via the provider (real load path) when the command does not exist', async () => {
+  it('rejects a startup failure via the provider load path', async () => {
     const ctx = new Context()
     await ctx.plugin(SubagentService)
     await ctx.plugin(acp, {
@@ -450,26 +442,23 @@ describe('dsh-subagent-acp', () => {
       permission: 'reject',
       env: {},
     })
-    const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
-    const result = await run.result
-    expect(result.stopReason).toBe('error')
-    await run.dispose()
+    await expect(ctx.subagents.start('acp', request())).rejects.toThrow()
   })
 
   it('reports a flattened child failure through onError (preserved, not silently lost)', async () => {
     // The seam forbids `result` rejecting, so a child-level failure is flattened
     // to a stop reason — onError must still surface the original error so a real
-    // fault is logged, not swallowed. A nonexistent command triggers the spawn
-    // failure path; the spy records the error + the chosen stop reason.
+    // fault is logged, not swallowed. The child exits after its session is
+    // published but while prompt is in flight.
     const errors: { message: string; stopReason: string }[] = []
-    const run = startAcpRun(
-      { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent },
+    const run = await startAcpRun(
+      request(),
       {
-        command: '/nonexistent/acp-agent-binary',
-        args: [],
+        command: process.execPath,
+        args: ['--import', tsxLoader, mockServer],
         cwd: process.cwd(),
         permission: 'reject',
-        env: {},
+        env: { MOCK_CRASH_ON_PROMPT: '1', TSX_TSCONFIG_PATH: repoTsconfig },
         disposeEofGraceMs: DEFAULT_DISPOSE_EOF_GRACE_MS,
         disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
         onError: (error, stopReason) => { errors.push({ message: error.message, stopReason }) },
@@ -483,18 +472,31 @@ describe('dsh-subagent-acp', () => {
     await run.dispose()
   })
 
+  it('logs a flattened child failure through the registered provider', async () => {
+    const ctx = await setup({ MOCK_CRASH_ON_PROMPT: '1' })
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const run = await ctx.subagents.start('acp', request())
+    const result = await run.result
+    expect(result.stopReason).toBe('error')
+    expect(warnings).toEqual([
+      expect.stringContaining('subagent-acp "acp": child run failed (error):'),
+    ])
+    await run.dispose()
+  })
+
   it('resolves error (never rejects) even when the onError sink itself throws', async () => {
     // onError is a caller-supplied callback boundary: its own exception must be
     // contained, or it would reject `result` and break the seam's "result never
     // rejects" contract that the flattening above exists to uphold.
-    const run = startAcpRun(
-      { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent },
+    const run = await startAcpRun(
+      request(),
       {
-        command: '/nonexistent/acp-agent-binary',
-        args: [],
+        command: process.execPath,
+        args: ['--import', tsxLoader, mockServer],
         cwd: process.cwd(),
         permission: 'reject',
-        env: {},
+        env: { MOCK_CRASH_ON_PROMPT: '1', TSX_TSCONFIG_PATH: repoTsconfig },
         disposeEofGraceMs: DEFAULT_DISPOSE_EOF_GRACE_MS,
         disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
         onError: () => { throw new Error('sink boom') },
@@ -514,9 +516,10 @@ describe('dsh-subagent-acp', () => {
     const ready = join(tmp, 'ready')
     try {
       const ctx = await setup({ MOCK_TEXT: 'partial', MOCK_HANG: '1', MOCK_CRASH_ON_CANCEL: '1', MOCK_READY_FILE: ready })
-      const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+      const controller = new AbortController()
+      const run = await ctx.subagents.start('acp', request('p', controller.signal))
       await waitForFile(ready)
-      run.cancel('crash it')
+      controller.abort('crash it')
       const result = await run.result
       expect(result.stopReason).toBe('aborted')
       await run.dispose()
@@ -525,8 +528,8 @@ describe('dsh-subagent-acp', () => {
     }
   })
 
-  it('settles aborted on cancel even when the child IGNORES session/cancel (non-cooperative)', async () => {
-    // The contract: run.cancel() → result settles `aborted`. A child that hangs
+  it('settles aborted on signal even when the child IGNORES session/cancel', async () => {
+    // The signal contract requires `result` to settle `aborted`. A child that hangs
     // its prompt AND ignores session/cancel must not wedge the parent — the
     // backend's own cancel-settle path resolves `aborted` without the child's
     // cooperation, and dispose() still reaps the process.
@@ -534,9 +537,10 @@ describe('dsh-subagent-acp', () => {
     const ready = join(tmp, 'ready')
     try {
       const ctx = await setup({ MOCK_TEXT: 'partial', MOCK_HANG: '1', MOCK_IGNORE_CANCEL: '1', MOCK_READY_FILE: ready })
-      const run = ctx.subagents.start('acp', { prompt: [{ type: 'text', text: 'p' }], parent: fakeParent })
+      const controller = new AbortController()
+      const run = await ctx.subagents.start('acp', request('p', controller.signal))
       await waitForFile(ready)
-      run.cancel('test')
+      controller.abort('test')
       // Bound it: a regression (cancel only notifies the child, which ignores it)
       // would hang result forever — fail loud instead of stalling the suite.
       const result = await Promise.race([
diff --git a/packages/subagent/subagent-fork/README.md b/packages/subagent/subagent-fork/README.md
index dcad34e80e..5154e040a3 100644
--- a/packages/subagent/subagent-fork/README.md
+++ b/packages/subagent/subagent-fork/README.md
@@ -1,28 +1,29 @@
 # @deepseek-ai/dsh-subagent-fork
 
-The in-process **fork** subagent backend: a [`SubagentProvider`](../subagent/README.md) that runs each child as a child [`Agent`](../../core/agent) **seeded with a prefix of the parent's session log** — so the child inherits the parent's conversation context instead of starting fresh. Shares the run driver (`startInProcessRun`) with [`dsh-subagent-spawn`](../subagent-spawn/README.md); the only difference is the seed. The shared `run.started` boundary resolves only after the seeded child is published, so `subagent/start` observers see a live registry entry.
+The fork provider creates an in-process child seeded with the parent's completed conversation turns. It shares all run mechanics with spawn; the session seed is the only behavioral difference.
 
-## The seed boundary (the crux)
+## Seed boundary
 
-At the moment a subagent tool's `execute` runs, the parent's CURRENT turn is open and unbalanced: the log holds the `assistant/message` carrying this spawn's tool-call and the dangling `tool/call` with no `tool/result` yet. Seeding that raw prefix would give the child an open turn that the session constructor and the dev-mode [invariants](../../support/invariants) replay **reject**.
+The parent's current tool-calling turn is still open when a subagent starts: its log contains the assistant tool call but not the matching tool result or `turn/end`. Copying that raw log would give the child an invalid, unbalanced session.
 
-So the fork seeds only the **balanced completed-turn prefix** — the parent's log up to and including its last `turn/end`, excluding the in-flight turn entirely (`completedTurnPrefix`). Because the live log keeps `seq === index`, the slice is contiguous-from-0 and a valid seed. A parent on its very first (not-yet-complete) turn forks an *empty* seed — i.e. effectively a fresh child.
+Fork therefore uses `completedTurnPrefix(parent.session.events)`: the contiguous prefix ending at the last `turn/end`. The child sees all completed parent turns and none of the in-flight turn. If the parent has not completed a turn yet, the seed is empty and the child behaves like a fresh spawn.
 
-The seam this rides on: `CreateAgentOptions.seed` (added on `dsh-agent`, threaded through `AgentLoop.createAgent` → `ctx.sessions.prepare({ seed })`), the same primitive `resume` uses.
+The seed transfers conversation history only. The child still receives a fresh flat registration scope; it does not inherit the parent's tool restrictions or authority.
 
-## Capabilities
+## Start and capabilities
 
-`{ outputSchema: true, depthLimit: true, toolFilter: true, persona: true }` — identical to spawn because the shared driver owns depth, model, persona, tool-filter, and structured-output behavior.
+`start(request)` passes the completed-turn seed to [`startInProcessRun`](../subagent-inprocess/README.md) and awaits child publication. The shared driver owns cancellation, depth, customization, result reading, and disposal.
+
+Fork advertises `{ outputSchema: true, depthLimit: true, toolFilter: true, persona: true }`, identical to spawn.
 
 ## Config
 
 | Key | Meaning |
 |---|---|
 | `providerName` | Registry name on `ctx.subagents` (default `fork`). |
-
 See [`dsh-subagent-spawn`](../subagent-spawn/README.md) for the run lifecycle, model inheritance, and depth tracking — all shared.
 
 ## Known Limitations and Deferred Work
 
-- **Runs expose no `sendMessage`/`resume`** — the optional runtime capabilities are absent on in-process runs; the consumer collects synchronously.
+- **Runs expose no `sendMessage`/`resume`** — the optional runtime capabilities are absent on in-process runs.
 - **The seed is a one-time snapshot** — the child sees the parent's completed turns as of the fork and nothing the parent logs afterwards; there is no live context sharing.
diff --git a/packages/subagent/subagent-fork/src/index.ts b/packages/subagent/subagent-fork/src/index.ts
index 3b9243aa2e..ebf64e7b70 100644
--- a/packages/subagent/subagent-fork/src/index.ts
+++ b/packages/subagent/subagent-fork/src/index.ts
@@ -72,11 +72,11 @@ class ForkProvider implements SubagentProvider {
   // Context contract: a forked child IS seeded with the parent's completed-turn prefix.
   readonly inheritsParentContext = true
 
-  constructor(readonly name: string, private readonly ctx: Context) {}
+  constructor(readonly name: string) {}
 
   start(request: SubagentStartRequest) {
     const seed = completedTurnPrefix(request.parent)
-    return startInProcessRun(this.ctx, request, {
+    return startInProcessRun(request, {
       // Only pass a seed when there's a completed turn to inherit; an empty seed
       // is equivalent to a fresh child, so omit it to keep the session unseeded.
       ...seed.length > 0 ? { seed } : {},
@@ -85,5 +85,5 @@ class ForkProvider implements SubagentProvider {
 }
 
 export function apply(ctx: Context, config: Config): void {
-  ctx.subagents.registerProvider(new ForkProvider(config.providerName, ctx))
+  ctx.subagents.registerProvider(new ForkProvider(config.providerName))
 }
diff --git a/packages/subagent/subagent-fork/tests/multi-subagent.spec.ts b/packages/subagent/subagent-fork/tests/multi-subagent.spec.ts
index 1f932fbaf9..8060a77fd4 100644
--- a/packages/subagent/subagent-fork/tests/multi-subagent.spec.ts
+++ b/packages/subagent/subagent-fork/tests/multi-subagent.spec.ts
@@ -7,13 +7,17 @@ import ToolRegistry from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { AgentId } from '@deepseek-ai/dsh-agent'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import * as Invariants from '@deepseek-ai/dsh-invariants'
-import SubagentService from '@deepseek-ai/dsh-subagent'
+import SubagentService, { type SubagentStartRequest } from '@deepseek-ai/dsh-subagent'
 import * as Spawn from '@deepseek-ai/dsh-subagent-spawn'
 import { MockAdapter, textResponse } from '../../../core/agent-loop/tests/mock-adapter.ts'
 import * as fork from '../src/index.ts'
 
 type Script = ConstructorParameters<typeof MockAdapter>[0]
 
+function start(ctx: Context, provider: string, request: Omit<SubagentStartRequest, 'signal'> & { signal?: AbortSignal }) {
+  return ctx.subagents.start(provider, { signal: request.signal ?? new AbortController().signal, ...request })
+}
+
 /**
  * The two in-process backends coexist on one context: the SAME parent agent
  * delegates to a `spawn` child (fresh) and a `fork` child (seeded with its log),
@@ -62,13 +66,13 @@ describe('multi-subagent coexistence (spawn + fork on one context)', () => {
     const parentPrefixLen = parent.session.events.length
 
     // Delegate to a fresh spawn child.
-    const spawnRun = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'spawn task' }], parent })
+    const spawnRun = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'spawn task' }], parent })
     const spawnResult = await spawnRun.result
     expect(spawnResult.stopReason).toBe('completed')
     expect(text(spawnResult.output)).toBe('spawn child reply')
 
     // Delegate to a fork child (seeded with the parent's turn-1 prefix).
-    const forkRun = ctx.subagents.start('fork', { prompt: [{ type: 'text', text: 'fork task' }], parent })
+    const forkRun = await start(ctx, 'fork', { prompt: [{ type: 'text', text: 'fork task' }], parent })
     const forkResult = await forkRun.result
     expect(forkResult.stopReason).toBe('completed')
     expect(text(forkResult.output)).toBe('fork child reply')
diff --git a/packages/subagent/subagent-fork/tests/subagent-fork.spec.ts b/packages/subagent/subagent-fork/tests/subagent-fork.spec.ts
index f9c7b04a51..e089cebe5f 100644
--- a/packages/subagent/subagent-fork/tests/subagent-fork.spec.ts
+++ b/packages/subagent/subagent-fork/tests/subagent-fork.spec.ts
@@ -8,7 +8,7 @@ import ToolRegistry from '@deepseek-ai/dsh-tools'
 import AgentRegistry, { AgentId } from '@deepseek-ai/dsh-agent'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import * as Invariants from '@deepseek-ai/dsh-invariants'
-import SubagentService from '@deepseek-ai/dsh-subagent'
+import SubagentService, { type SubagentStartRequest } from '@deepseek-ai/dsh-subagent'
 import { MockAdapter, textResponse, toolCallResponse } from '../../../core/agent-loop/tests/mock-adapter.ts'
 import type { StreamChunk } from '@deepseek-ai/dsh-llm'
 import * as fork from '../src/index.ts'
@@ -17,16 +17,19 @@ import { completedTurnPrefix } from '../src/index.ts'
 
 type Script = ConstructorParameters<typeof MockAdapter>[0]
 
+function start(ctx: Context, provider: string, request: Omit<SubagentStartRequest, 'signal'> & { signal?: AbortSignal }) {
+  return ctx.subagents.start(provider, { signal: request.signal ?? new AbortController().signal, ...request })
+}
+
 /** A bare `stop` finish that streams no content → the turn ends `completed`
  * with NO `assistant/message` of its own. */
 const emptyStop: StreamChunk[] = [{ type: 'finish', reason: { kind: 'stop' } }]
 
 /**
  * Drives the REAL fork backend with a real loop + scripted mock MODEL + the
- * real dsh-invariants plugin. The invariants plugin re-replays a seeded child
- * log on `session/created` (its freeze-check), so a malformed (unbalanced) fork
- * seed makes these tests THROW — that is the regression guard for the
- * completed-turn-prefix boundary.
+ * real dsh-invariants plugin. The plugin replays a seeded child log on
+ * `session/created`, so a malformed (unbalanced) fork seed makes these tests
+ * THROW — that is the regression guard for the completed-turn-prefix boundary.
  */
 async function setup(script: Script) {
   const ctx = new Context()
@@ -78,9 +81,9 @@ describe('dsh-subagent-fork', () => {
       if (info.provider === 'fork') childAtStart = ctx.agents.get(info.id)
     })
 
-    const run = ctx.subagents.start('fork', { prompt: [{ type: 'text', text: 'child q' }], parent })
+    const starting = start(ctx, 'fork', { prompt: [{ type: 'text', text: 'child q' }], parent })
     expect(childAtStart).toBeUndefined()
-    await run.started
+    const run = await starting
     expect(childAtStart).toBe(ctx.agents.get(run.id))
     expect(childAtStart?.id).toBe(run.id)
 
@@ -93,7 +96,7 @@ describe('dsh-subagent-fork', () => {
     // the seed → the child runs fresh. Exercises the `seed.length > 0` false arm.
     const { ctx, parent } = await setup([textResponse('fresh child')])
     expect(completedTurnPrefix(parent)).toEqual([])
-    const run = ctx.subagents.start('fork', { prompt: [{ type: 'text', text: 'child q' }], parent })
+    const run = await start(ctx, 'fork', { prompt: [{ type: 'text', text: 'child q' }], parent })
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(text(result.output)).toBe('fresh child')
@@ -111,7 +114,7 @@ describe('dsh-subagent-fork', () => {
     await parent.whenIdle()
     const parentPrefixLen = parent.session.events.length
 
-    const run = ctx.subagents.start('fork', { prompt: [{ type: 'text', text: 'child question' }], parent })
+    const run = await start(ctx, 'fork', { prompt: [{ type: 'text', text: 'child question' }], parent })
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(text(result.output)).toBe('child answer')
@@ -144,7 +147,7 @@ describe('dsh-subagent-fork', () => {
     await new Promise(r => setTimeout(r, 20)) // let the hanging turn open
 
     // Forking now must NOT throw (the open second turn is excluded from the seed).
-    const run = ctx.subagents.start('fork', { prompt: [{ type: 'text', text: 'child q' }], parent })
+    const run = await start(ctx, 'fork', { prompt: [{ type: 'text', text: 'child q' }], parent })
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(text(result.output)).toBe('child')
@@ -166,7 +169,7 @@ describe('dsh-subagent-fork', () => {
     ])
     parent.send([{ type: 'text', text: 'warm up' }])
     await parent.whenIdle()
-    const run = ctx.subagents.start('fork', {
+    const run = await start(ctx, 'fork', {
       prompt: [{ type: 'text', text: 'report structured' }],
       parent,
       outputSchema: { type: 'object', properties: { answer: { type: 'number' } }, required: ['answer'] },
@@ -190,7 +193,7 @@ describe('dsh-subagent-fork', () => {
     parent.send([{ type: 'text', text: 'parent question' }])
     await parent.whenIdle()
 
-    const run = ctx.subagents.start('fork', { prompt: [{ type: 'text', text: 'child question' }], parent })
+    const run = await start(ctx, 'fork', { prompt: [{ type: 'text', text: 'child question' }], parent })
     const result = await run.result
     // The child completed its own (empty) turn — completed, but with NO output
     // borrowed from the seeded parent prefix.
diff --git a/packages/subagent/subagent-inprocess/README.md b/packages/subagent/subagent-inprocess/README.md
index 5f952a6c8b..d213634d1f 100644
--- a/packages/subagent/subagent-inprocess/README.md
+++ b/packages/subagent/subagent-inprocess/README.md
@@ -1,44 +1,46 @@
 # @deepseek-ai/dsh-subagent-inprocess
 
-The shared **in-process subagent run driver**. A library with no provider or import-time registration that the in-process backends — [spawn](../subagent-spawn/README.md) (a fresh child) and [fork](../subagent-fork/README.md) (a child seeded with a prefix of the parent's log) — both build on. Each accepted run installs one provider-owned cleanup effect. The backends are thin shells that differ ONLY in the session seed they pass; everything downstream lives here, so neither backend depends on the other.
+This package is the shared run driver for the two in-process providers. Spawn passes no session seed; fork passes the parent's completed-turn prefix. Everything else—depth, child creation, optional child customization, result reading, cancellation, and disposal—has one implementation here.
 
-## What it exports
+## Start contract
 
-### `startInProcessRun(ctx, request, options): SubagentRun`
+`startInProcessRun(request, options): Promise<SubagentRun>` fulfills only after the child is published in `ctx.agents`. A rejected start has already quiesced the agent factory's unpublished creation transaction, so the caller never receives a half-created handle.
 
-Runs a child as a child [`Agent`](../../core/agent) on the same cordis context (`ctx.agents`):
+The driver follows this sequence:
 
-1. snapshots the accepted request before asynchronous owner setup: the parent and signal remain identity capabilities but are never reread from the caller-owned record; tool filter, seed, agent options, output schema, and prompt are detached. It computes child depth = `depthOf(parent) + 1` and rejects `request.maxDepth` overflow with `SubagentDepthError`; `outputSchema` is asserted before cloning so a hostile value fails as `OutputSchemaError`, while the prompt passes the session log's lossless-JSON check before and after cloning;
-2. first installs provider ownership, then attaches the request abort listener and creates one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves no child or orphaned listener. Async child creation goes through that fiber's `ctx.agents` service with fresh IDs, lineage/seed, inherited model, and an unpublished setup transaction for persona, tool restriction, and structured output. Parent teardown, provider teardown, and manual `run.dispose()` all dispose this exact node, preventing publication after it becomes inactive and awaiting the same quiescence boundary. `startInProcessRun` still returns its `SubagentRun` immediately: `run.started` resolves only after `ctx.agents.create()` has published the child (and rejects if publication never happens), while cancellation during creation is recorded and applied when a child exists;
-3. drives the one-shot: `child.send(prompt)` then `await child.whenIdle()` (ordering matters — `send` enqueues synchronously, so `whenIdle` observes the queued work and resolves on the child's `running → idle` transition, never before the turn starts); there is deliberately NO re-prompt for a structured child that finished cleanly without calling `structured_output` — the shortfall maps to an `error` result for the parent;
-4. reads the result, scoped to the child's OWN events (everything at or after `seedLength`, so a seeded child that produced no message of its own never returns the seeded parent's last message): the last `assistant/message` content (deep-cloned — the log is frozen) and the last `turn/end.reason` mapped to a `SubagentStopReason`. A structured run surfaces the captured value as `result.structured`; a structured child that finished cleanly WITHOUT ever capturing settles `error` (a clean finish without the demanded result is a failure, not a success with a missing field).
+1. Validate the parent depth and optional absolute `maxDepth`, then derive child depth as parent depth plus one.
+2. Call `parent.ctx.agents.create` directly, passing the required request signal into the factory's creation transaction.
+3. During that transaction's unpublished setup window, install the requested persona, tool restriction, and structured-output runtime.
+4. Publish the child, retain the returned `AgentHandle`, and drive one task with `child.send(prompt)` followed by `child.whenIdle()`.
+5. Read the child's own last assistant message and terminal turn reason, excluding any fork seed.
 
-`SubagentService` waits for `run.started` before emitting `subagent/start`, so a synchronous start observer can resolve the published child with `ctx.agents.get(run.id)`; the result driver awaits the same boundary before sending the prompt. An attempt that never publishes rejects readiness and emits no false start/end pair; its result reports a deliberate cancel/dispose as `aborted` and propagates an infrastructure fault. `dispose()` awaits creation or rollback and then delegates to `AgentHandle.dispose()` (stop and drain → remove agent → detach session → unwind scope); `cancel()` records its request even before publication and cancels the child immediately once available. A cancel landing before any `turn/end` still settles `aborted`, honoring the cancel contract rather than the generic no-turn `error`.
+The child gets the parent's working-directory/session lineage and inherits the parent model unless `request.agentOptions` overrides it. It gets a fresh flat registration scope: parent ownership does not import parent tool restrictions or establish an authority subset.
 
-### `InProcessRunOptions`
+## Cancellation and ownership
 
-`{ seed?: SessionEvent[] }` — the optional child-session seed: absent for spawn, or the parent's balanced completed-turn prefix for fork.
+The required request signal covers both startup and the live run. Before publication, `AgentCreationTransaction` observes it, rolls back, and rejects. The factory detaches that creation-only listener before returning; the driver immediately checks the signal once more before installing a minimal live-run listener, closing the handoff race. After publication, abort cancels the child.
 
-### Structured output (package-internal runtime)
+After fulfillment, the caller owns the run. Provider-plugin unload does not revoke it. `dispose()` removes the live abort listener, records cancellation, and delegates to the returned `AgentHandle.dispose()`, whose memoized quiescence transaction stops the loop, removes the agent and session, and unwinds scoped registrations. Cancellation owns every non-completed in-flight outcome and reports `aborted`; an already-completed turn remains completed.
 
-`attachStructuredRuntime(childCtx, schema)` registers the run's whole enforcement surface as SCOPED registrations on the child's `agent.ctx` — riding the child's fiber (a backend hot-reload mid-run cannot unregister anything; a disposed child leaves no residue) and visible to that child alone (two concurrent structured runs never interact; no placeholder schema, no strip-for-everyone-else, no refcounted global state):
+## Spawn and fork inputs
 
-- the `structured_output` capture tool with the run's REAL schema as its registered `parameters`, validating each call (`validateStructuredValue`) — violations become an `INVALID_ARGS` isError the model retries in-turn; a valid call STAGES the value in a `WeakMap` keyed by that call's `ToolExecution` object;
-- the calling instruction as an ordinary order-190 scoped prompt section (the demand travels with the tool, as prompt state of exactly one agent);
-- a scoped `systemPrompt.protect()` registration making the capture instruction and schema canonical after the complete assembly waterfall. Canonical absence is protected too: pure Code Mode removes `structured_output` from the wire and declares it through the SDK. The tool registry separately owns and protects its `tools:sdk` section and reserved `run_code` transport; protection guarantees those named contributions, while unrelated listener-added schemas remain the listener's responsibility. The loop logs the finalized assembly as the step's `request/header`, so the demand remains reconstructable;
-- a scoped `tools/result` observer as the commit point: it promotes a staged value only when that same execution's immutable, JSON-safe authoritative result after the complete pre-execute → guards → execute → post-execute pipeline succeeds. For a Code Mode SDK sub-dispatch, the child's opaque `parent` token matches the enclosing `run_code` execution's registry-assigned `token`, so promotion waits for that outer final result without exposing its live object; a runtime failure or post-policy block discards the value. Execution-object identity prevents call-id reuse or another execution from reaching the stage;
-- a scoped monotonic `tools.guard()` denial for every call arriving after capture. Guards run after the extensible pre-execute waterfall and cannot return allow, so terminal means terminal within the step regardless of listener order;
-- a scoped `agent/turn-stop` terminal policy stopping the child's turn once its output is captured. It runs after ordinary continuation and steering folding, and its terminal state survives turn close and flush, so later listeners cannot leak steering into another step or turn; ordinary queued prompts remain intact.
+`InProcessRunOptions` is `{ seed?: SessionEvent[] }`. Spawn omits it. Fork supplies a balanced completed-turn prefix and records its length so the result reader never mistakes a seeded parent message for child output.
 
-### `depthOf(agent): number`
+`depthOf(agent)` reads `AgentOptions.subagentDepth`, treating absence as top-level depth zero and rejecting malformed stored values. `SubagentDepthError` reports an attempted child depth above `maxDepth`; an unrepresentable depth above the safe-integer domain is a `RangeError`.
 
-Delegation depth rides on a merge-extensible `AgentOptions.subagentDepth` field (0 for a top-level agent, parent + 1 for a child), so a nested spawn reads its parent's depth from `parent.options.subagentDepth`. `depthOf` reads it (absent ⇒ 0).
+## Structured output
 
-### `SubagentDepthError`
+`attachStructuredRuntime(childCtx, schema)` installs the whole contract in the child's scope:
 
-Thrown by `startInProcessRun` when a spawn would exceed the request's `maxDepth` cap; carries `attemptedDepth` and `maxDepth`.
+- A `structured_output` tool registered with the requested schema validates and stages the model's value.
+- An order-190 system-prompt section tells the child that the tool call is the terminal answer.
+- Both contributions use `ownerFinal: true`, so their owners control their final presence after prompt/tool assembly while unrelated contributions remain extensible.
+- A `tools/result` observer commits a staged value only after that execution's authoritative final tool result succeeds, including the enclosing `run_code` result for Code Mode sub-dispatch.
+- A monotonic tool guard blocks later calls after capture, and `agent/turn-stop` ends the turn after the structured result commits.
+
+A clean turn that never commits the required structured value reports `error`; the driver does not re-prompt. All registrations ride the child fiber and disappear with it.
 
 ## Known Limitations and Deferred Work
 
-- **Runs expose no `sendMessage`/`resume`** — the optional runtime capabilities are absent on in-process runs; the consumer collects synchronously.
+- **Runs expose no `sendMessage`/`resume`** — the optional runtime capabilities are absent on in-process runs.
 - **Structured capture accepts the `defineTool` schema subset only** — unsupported JSON Schema constructs fail before the child is created; a provider needing a broader schema vocabulary requires a different runtime.
diff --git a/packages/subagent/subagent-inprocess/src/index.ts b/packages/subagent/subagent-inprocess/src/index.ts
index de3b042fe3..f6de7200cf 100644
--- a/packages/subagent/subagent-inprocess/src/index.ts
+++ b/packages/subagent/subagent-inprocess/src/index.ts
@@ -1,35 +1,24 @@
 /**
- * The shared in-process subagent run driver: run a child as a child
- * {@link Agent} on the SAME cordis context (`ctx.agents`) — the cheapest
- * transport, reusing the agent factory's quiescent {@link AgentHandle}
- * teardown. The concrete in-process backends are thin shells over this driver,
- * differing ONLY in the `seed` they pass (a fresh child vs. a child seeded with
- * a prefix of the parent's log); everything downstream — drive the child, read
- * its final output, map the stop reason, dispose — is identical and lives here.
- *
- * This package declares no provider and performs no import-time registration;
- * it is a library the backend packages depend on, so neither backend needs to
- * know about the other. Each accepted run does install one provider-owned
- * effect for structured-concurrency cleanup.
+ * Shared driver for in-process subagent providers. The agent factory's
+ * creation transaction owns unpublished setup and rollback; after publication
+ * the returned AgentHandle is the one quiescent lifecycle owner held by the
+ * provider's caller.
  *
  * @module @deepseek-ai/dsh-subagent-inprocess
  */
 
 import { randomUUID } from 'node:crypto'
-import type { Context, Fiber } from 'cordis'
-import { AgentId, type Agent, type AgentHandle, type AgentOptions } from '@deepseek-ai/dsh-agent'
-import { SessionId, isJsonValue, type SessionEvent, type TurnEndReason } from '@deepseek-ai/dsh-session'
+import type { Context } from 'cordis'
+import { AgentId, type Agent, type AgentOptions } from '@deepseek-ai/dsh-agent'
+import { SessionId, type SessionEvent, type TurnEndReason } from '@deepseek-ai/dsh-session'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
-import { assertSupportedOutputSchema } from '@deepseek-ai/dsh-tools'
+import { assertSubagentMaxDepth } from '@deepseek-ai/dsh-subagent'
 import type { SubagentResult, SubagentRun, SubagentStartRequest, SubagentStopReason } from '@deepseek-ai/dsh-subagent'
 import {
   attachStructuredRuntime,
   type StructuredAttachment,
 } from './structured.ts'
 
-// The runtime itself (attach) is package-internal: runs attach it inside
-// startInProcessRun's setup window, and no other package drives it. Only the
-// model-facing vocabulary is public.
 export {
   STRUCTURED_OUTPUT_TOOL,
   STRUCTURED_OUTPUT_INSTRUCTION,
@@ -37,28 +26,26 @@ export {
 
 declare module '@deepseek-ai/dsh-agent' {
   interface AgentOptions {
-    /**
-     * The agent's delegation depth in the subagent tree — 0 for a top-level
-     * (config/ACP-created) agent, parent depth + 1 for a subagent. Set by the
-     * in-process backends on every child they create so a nested spawn reads its
-     * parent's depth from `parent.options.subagentDepth` and the `depthLimit`
-     * capability can cap the tree. Merge-extensible field (the seam owns it; the
-     * loop neither sets nor reads it).
-     */
+    /** Delegation depth: zero for a top-level agent and parent depth + 1 for a child. */
     subagentDepth?: number
   }
 }
 
 /**
- * Read an agent's delegation depth (absent ⇒ a top-level agent, depth 0).
- * @param agent - the agent whose options may carry `subagentDepth`.
- * @returns 0 for a top-level agent, its parent's depth + 1 for a subagent.
+ * Read an agent's delegation depth, treating absence as top-level depth zero.
+ * @param agent - the agent whose options carry the depth.
+ * @returns its non-negative safe-integer depth.
  */
 export function depthOf(agent: Agent): number {
-  return agent.options.subagentDepth ?? 0
+  const depth = agent.options.subagentDepth
+  if (depth === undefined) return 0
+  if (!Number.isSafeInteger(depth) || depth < 0 || Object.is(depth, -0)) {
+    throw new TypeError('agent subagentDepth must be a non-negative safe integer')
+  }
+  return depth
 }
 
-/** Thrown when a spawn would exceed the request's `maxDepth` cap. */
+/** Thrown when starting a child would exceed the requested depth cap. */
 export class SubagentDepthError extends Error {
   constructor(public readonly attemptedDepth: number, public readonly maxDepth: number) {
     super(`subagent depth ${attemptedDepth} exceeds maxDepth ${maxDepth}`)
@@ -66,7 +53,7 @@ export class SubagentDepthError extends Error {
   }
 }
 
-/** Map a session `turn/end` reason to a {@link SubagentStopReason}. */
+/** Map a session turn outcome to the subagent seam's terminal vocabulary. */
 function toStopReason(reason: TurnEndReason | undefined): SubagentStopReason {
   switch (reason?.kind) {
     case 'completed':
@@ -75,9 +62,6 @@ function toStopReason(reason: TurnEndReason | undefined): SubagentStopReason {
       return 'max-tokens'
     case 'aborted':
       return 'aborted'
-    // `disposed` (torn down mid-turn) and `interrupted` (crash-closed) both mean
-    // the turn did not finish cleanly; surface them as a generic failure rather
-    // than a clean completion. A missing reason (no turn ran) is also an error.
     case 'error':
     case 'disposed':
     case 'interrupted':
@@ -86,293 +70,120 @@ function toStopReason(reason: TurnEndReason | undefined): SubagentStopReason {
   }
 }
 
-/** Extra inputs the spawn/fork backends supply to {@link startInProcessRun}. */
+/** Extra inputs the spawn and fork providers supply to the shared driver. */
 export interface InProcessRunOptions {
-  /**
-   * The child session's seed: a balanced, contiguous-from-0 prefix of the
-   * parent's log (FORK), or `undefined` for a fresh child (SPAWN).
-   */
+  /** Completed-turn seed for fork, or undefined for a fresh spawn. */
   readonly seed?: SessionEvent[]
 }
 
-/** Dispose a run-owner fiber and follow an already-started unload to quiescence. */
-async function quiesceFiber(fiber: Fiber): Promise<void> {
-  await Promise.resolve(fiber.dispose())
-  while (fiber.inertia !== undefined) await fiber.inertia
+/** Error used when cancellation wins before the child publication boundary. */
+function prePublicationAbort(): Error {
+  return new Error('subagent request was aborted before child publication')
 }
 
 /**
- * Start an in-process child agent for `request` and return a {@link SubagentRun}.
- *
- * Drives the child as a one-shot: `send(prompt)` then `whenIdle()` (the ordering
- * matters — `send` enqueues synchronously, so `whenIdle` observes the queued
- * work and resolves only on the child's `running → idle` transition, never
- * before the turn starts). The final `assistant/message` is the result output,
- * the matching `turn/end.reason` the stop reason. `dispose()` delegates to the
- * factory's {@link AgentHandle.dispose} (stop loop → await quiescence → remove
- * session); `cancel()` cancels the child's in-flight turn.
- *
- * Throws {@link SubagentDepthError} before creating anything when the child's
- * depth (parent depth + 1) would exceed `request.maxDepth`.
- * @param ctx - the provider context that owns the live run as a second
- *   structured-concurrency boundary alongside the parent agent.
- * @param request - the start request (prompt, parent, signal, per-child options).
- * @param options - the backend's optional child-session seed.
- * @returns the live run handle for the child agent.
+ * Establish and drive one in-process child. Fulfillment means the agent is
+ * already published in the registry; rejection means the agent factory's
+ * creation transaction and any partially-created child have reached quiescence.
+ * @param request - the trusted typed start request, including its required signal.
+ * @param options - the optional fork seed.
+ * @returns a ready holder-owned run.
  */
-export function startInProcessRun(
-  ctx: Context,
+export async function startInProcessRun(
   request: SubagentStartRequest,
   options: InProcessRunOptions,
-): SubagentRun {
-  // Snapshot the accepted request synchronously. The parent and signal are
-  // identity capabilities (kept live but never reread from the mutable request
-  // record); every data field is detached before asynchronous owner setup.
+): Promise<SubagentRun> {
+  assertSubagentMaxDepth(request.maxDepth)
+  if (request.signal.aborted) throw prePublicationAbort()
   const parent = request.parent
-  const signal = request.signal
-  const persona = request.persona
-  const toolFilter = request.toolFilter === undefined ? undefined : structuredClone(request.toolFilter)
-  const seed = options.seed === undefined ? undefined : structuredClone(options.seed)
   const childDepth = depthOf(parent) + 1
+  if (!Number.isSafeInteger(childDepth)) {
+    throw new RangeError('subagent child depth exceeds the safe-integer range')
+  }
   if (request.maxDepth !== undefined && childDepth > request.maxDepth) {
     throw new SubagentDepthError(childDepth, request.maxDepth)
   }
-  // Assert, then snapshot, the schema subset BEFORE any child exists (the
-  // service has already capability-gated; this rejects a schema outside the
-  // enforced subset loud). Assertion comes FIRST so a hostile value fails as
-  // OutputSchemaError, never as structuredClone's raw DataCloneError — the
-  // asserted subset is plain JSON data, which always clones. The snapshot is
-  // load-bearing: the caller keeps its reference, so attaching the ORIGINAL
-  // would let a post-start() mutation drift the enforced schema away from the
-  // asserted one — the clone (taken synchronously with the assertion, no
-  // interleaving possible) pins assertion, the model-visible parameters, and
-  // validateStructuredValue to one isolation-immutable value.
-  if (request.outputSchema !== undefined) assertSupportedOutputSchema(request.outputSchema)
-  const schema = request.outputSchema === undefined ? undefined : structuredClone(request.outputSchema)
-  // The accepted request owns a value snapshot, not the caller's mutable
-  // content array. Validate the same lossless-JSON contract Session.append
-  // enforces before any child exists, then detach it synchronously so mutation
-  // during async creation cannot change what is logged or sent to the model.
-  if (!isJsonValue(request.prompt)) {
-    throw new TypeError('subagent prompt must be losslessly JSON-serializable')
-  }
-  const prompt = structuredClone(request.prompt)
-  if (!isJsonValue(prompt)) {
-    throw new TypeError('subagent prompt must be stable losslessly JSON-serializable data')
-  }
 
   const childId = AgentId(randomUUID())
-  // The child's OWN events begin after the seed (fork seeds the parent's
-  // completed-turn prefix; spawn seeds nothing). `readResult` scopes to this
-  // boundary so a child that produces no message of its own never returns the
-  // SEEDED parent's last assistant message as its result.
   const seedLength = options.seed?.length ?? 0
   const parentHeader = parent.session.header
-  // Inherit the parent's model by default (a child with no model cannot run);
-  // an explicit `request.agentOptions.model` overrides it. The deployment
-  // persona needs no inheritance (a context-wide section both render); a
-  // per-child `request.persona` becomes a SCOPED section of the same name in
-  // the setup below, shadowing the deployment's for this child alone.
-  const agentOptions: AgentOptions = structuredClone({
-    ...parent.options.model !== undefined ? { model: parent.options.model } : {},
+  const parentModel = parent.options.model
+  const agentOptions: AgentOptions = {
+    ...parentModel !== undefined ? { model: parentModel } : {},
     ...request.agentOptions,
     subagentDepth: childDepth,
-  })
+  }
 
-  // The child's scoped world, composed in the factory's unpublished setup
-  // window. The factory awaits it before inserting or announcing the child, so
-  // a throw/rejection exposes neither id and every first assembly sees it:
-  //  - persona: a scoped `deployment:persona` section shadowing the global one;
-  //  - toolFilter: a scoped restrict() masking the global tool surface
-  //    (loud unknown-name validation lives in the registry);
-  //  - outputSchema: the structured runtime, attached as scoped registrations.
   let structured: StructuredAttachment | undefined
   const setup = (childCtx: Context): void => {
-    if (persona !== undefined) {
-      childCtx.systemPrompt.section({ name: 'deployment:persona', order: 0, text: persona })
+    if (request.persona !== undefined) {
+      childCtx.systemPrompt.section({ name: 'deployment:persona', order: 0, text: request.persona })
     }
-    if (toolFilter !== undefined) {
-      childCtx.tools.restrict(toolFilter)
-    }
-    if (schema !== undefined) {
-      structured = attachStructuredRuntime(childCtx, schema)
+    if (request.toolFilter !== undefined) childCtx.tools.restrict(request.toolFilter)
+    if (request.outputSchema !== undefined) {
+      structured = attachStructuredRuntime(childCtx, request.outputSchema)
     }
   }
 
-  // Bridge the request's abort signal to the child (the consumer also bridges
-  // its own exec.signal, but a backend-level bridge keeps the contract local).
-  // Install it after provider ownership succeeds but BEFORE awaiting creation,
-  // so an inactive provider cannot leave an orphaned listener and abort/dispose
-  // during async setup is still recorded and applied the moment a child exists.
-  // `cancelled` records that a cancel was requested at all, so the pre-turn
-  // cancel window — where the child clears the queued prompt before any
-  // `turn/end` is logged — settles as `aborted` (honoring the cancel contract)
-  // rather than falling through to the no-turn `error` mapping.
-  let cancelled = false
-  // An accessor, not an inline read: `cancelled` mutates from closures (the
-  // abort listener, run.cancel), which control-flow narrowing cannot see — an
-  // inline read at the result mapping would narrow to the initializer.
-  const isCancelled = (): boolean => cancelled
-  let child: Agent | undefined
-  let handle: AgentHandle | undefined
-  let disposeRequested = false
-  const isDisposeRequested = (): boolean => disposeRequested
-  const requestCancel = (reason: string): void => {
-    cancelled = true
-    child?.cancel(reason)
-  }
-  const onAbort = (): void => { requestCancel('subagent cancelled') }
-
-  // One run-owned Cordis fiber is the common ownership node. Install the
-  // provider effect FIRST: a start racing an already-unloading provider fails
-  // before it can mint anything under the parent. The owner fiber is then
-  // nested under the parent scope, and the provider/run handle both dispose
-  // this exact fiber. AgentFactory binds its lifecycle to `ownerCtx`, so any of
-  // the three owners moves the fiber out of ACTIVE synchronously and setup
-  // cannot publish afterward.
-  let ownerCtx: Context | undefined
-  function subagentRunOwner(inner: Context): void { ownerCtx = inner }
-  let ownerFiber: (Fiber & PromiseLike<Fiber>) | undefined
-  let ownerSetupError: unknown
-  let ownerDisposing: Promise<void> | undefined
-  const disposeOwner = (): Promise<void> => (ownerDisposing ??= ownerFiber === undefined
-    ? Promise.resolve()
-    : quiesceFiber(ownerFiber))
-  let manualDisposeRequested = false
-  const isManualDisposeRequested = (): boolean => manualDisposeRequested
-  const unlinkProvider = ctx.effect(() => () => {
-    requestCancel('subagent provider disposed')
-    return disposeOwner()
-  }, 'subagent-inprocess.run()')
-  signal?.addEventListener('abort', onAbort, { once: true })
-  if (signal?.aborted) requestCancel('subagent cancelled')
-  try {
-    ownerFiber = parent.ctx.plugin(Object.assign(subagentRunOwner, {
-      inject: ['agents', 'sessions', 'llm', 'tools', 'systemPrompt'],
-    }))
-  } catch (error: unknown) {
-    ownerSetupError = error
+  const flags = { cancelled: false }
+  const handle = await parent.ctx.agents.create({
+    agentId: childId,
+    sessionId: SessionId(randomUUID()),
+    meta: {
+      ...parentHeader.cwd !== undefined ? { cwd: parentHeader.cwd } : {},
+      parentSession: parentHeader.id,
+      ...seedLength > 0 ? { seedLength } : {},
+    },
+    ...options.seed !== undefined ? { seed: options.seed } : {},
+    agentOptions,
+    signal: request.signal,
+    setup,
+  })
+  const child = handle.agent
+  // Agent creation detaches its creation-only abort listener before returning.
+  // Close the narrow handoff race before installing the live-run listener.
+  // Static analysis does not model the abort that may land between the
+  // factory's listener detachment and this continuation.
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+  if (request.signal.aborted) {
+    flags.cancelled = true
+    await handle.dispose()
+    throw prePublicationAbort()
   }
 
-  const creation: Promise<Agent> = (async () => {
-    if (ownerSetupError !== undefined) {
-      throw ownerSetupError instanceof Error
-        ? ownerSetupError
-        : new Error('subagent run owner setup failed with a non-Error value', { cause: ownerSetupError })
-    }
-    await ownerFiber
-    if (ownerCtx === undefined) {
-      throw new Error('subagent run owner became inactive before child creation')
-    }
-    // Invoke the factory THROUGH the parent scope. Cordis binds the factory's
-    // lifecycle effect to the accessing context, so parent ownership exists
-    // before persistence/setup and publication—not as a fallible link added
-    // after the child is already visible. A disposed parent therefore rejects
-    // before any session/agent notification, and disposal during async setup
-    // wins the unpublished transaction.
-    const created = await ownerCtx.agents.create({
-      agentId: childId,
-      sessionId: SessionId(randomUUID()),
-      meta: {
-        ...parentHeader.cwd !== undefined ? { cwd: parentHeader.cwd } : {},
-        parentSession: parentHeader.id,
-        ...seedLength > 0 ? { seedLength } : {},
-      },
-      ...seed !== undefined ? { seed } : {},
-      agentOptions,
-      setup,
-    })
-    handle = created
-    child = created.agent
-
-    if (isCancelled()) created.agent.cancel('subagent cancelled')
-    return created.agent
-  })()
-
-  // Provider readiness is a distinct lifecycle boundary from accepting the
-  // request. It resolves only after the factory has published the child and
-  // returned its handle, so SubagentService can emit `subagent/start` while
-  // `ctx.agents.get(childId)` is guaranteed to resolve. The result path awaits
-  // THIS SAME promise immediately, which also observes a readiness rejection
-  // when the driver is invoked directly rather than through SubagentService.
-  const started: Promise<void> = creation.then(() => undefined)
+  const onAbort = (): void => {
+    flags.cancelled = true
+    child.cancel('subagent request aborted')
+  }
+  request.signal.addEventListener('abort', onAbort, { once: true })
 
   const result: Promise<SubagentResult> = (async () => {
     try {
-      let liveChild: Agent
-      try {
-        await started
-        // `creation` assigns `child` before it fulfills, and `started` is its
-        // direct fulfillment projection. The cast records that local invariant
-        // without manufacturing an unreachable runtime branch.
-        liveChild = child as Agent
-      } catch (error: unknown) {
-        if (isManualDisposeRequested()) return { output: [], stopReason: 'aborted' }
-        throw error instanceof Error ? error : new Error('subagent child creation failed with a non-Error value', { cause: error })
-      }
-      if (isCancelled() || isDisposeRequested()) return { output: [], stopReason: 'aborted' }
-      liveChild.send(prompt)
-      await liveChild.whenIdle()
-      // Deliberately NO re-prompt when a structured child finishes cleanly
-      // without calling structured_output: readResult maps that to `error` —
-      // the shortfall goes to the parent instead of buying extra model turns.
-      return readResult(liveChild, seedLength, isCancelled(), structured ? { captured: structured.captured() } : undefined)
+      child.send(request.prompt)
+      await child.whenIdle()
+      return readResult(
+        child,
+        seedLength,
+        flags.cancelled,
+        structured ? { captured: structured.captured() } : undefined,
+      )
     } finally {
-      signal?.removeEventListener('abort', onAbort)
+      request.signal.removeEventListener('abort', onAbort)
     }
   })()
 
-  let disposing: Promise<void> | undefined
   return {
     id: childId,
-    started,
     result,
-    cancel(reason?: string): void {
-      requestCancel(reason ?? 'subagent cancelled')
-    },
-    async dispose(): Promise<void> {
-      return (disposing ??= (async () => {
-        signal?.removeEventListener('abort', onAbort)
-        disposeRequested = true
-        manualDisposeRequested = true
-        requestCancel('subagent disposed during creation')
-        // Removing provider ownership and disposing the common run-owner fiber
-        // are the same quiescence transaction; parent disposal may already have
-        // claimed it, in which case disposeOwner follows fiber inertia.
-        await unlinkProvider()
-        try {
-          await creation
-        } catch {
-          // Creation rollback already reached quiescence; there is no handle
-          // left to dispose, and dispose must not mask result's infrastructure
-          // rejection with the same error from a finally block.
-          return
-        }
-        await disposeOwner()
-        await handle?.dispose()
-      })())
+    dispose(): Promise<void> {
+      request.signal.removeEventListener('abort', onAbort)
+      flags.cancelled = true
+      return handle.dispose()
     },
   }
 }
 
-/**
- * Read a settled child's terminal result from its session log, scoped to the
- * child's OWN events (everything at or after `seedLength` — fork seeds the
- * parent's completed-turn prefix, so a child that produced no message of its
- * own must NOT return the seeded parent's last assistant message). The output
- * is the child's last `assistant/message` content (deep-cloned — the log is
- * frozen); the stop reason is the child's last `turn/end` reason mapped to a
- * {@link SubagentStopReason}. When `cancelled` is set but no `turn/end` was
- * logged (a cancel landed in the pre-turn window, before any turn ran), the
- * run settles `aborted` per the {@link SubagentRun.cancel} contract rather than
- * the generic no-turn `error`.
- *
- * A structured run (`structured` present) additionally reports the captured
- * value on {@link SubagentResult.structured}. A structured child that finished
- * CLEANLY without ever capturing (the nudges ran out) settles `error` — a clean
- * finish without the demanded structured result is a failure, not a success
- * with a missing field; a non-`completed` reason keeps its own honest mapping.
- */
+/** Read one settled child's result from events after its optional fork seed. */
 function readResult(
   child: Agent,
   seedLength: number,
@@ -380,17 +191,20 @@ function readResult(
   structured?: { captured?: { value: unknown } | undefined },
 ): SubagentResult {
   const own = child.session.events.slice(seedLength)
-  const lastMessage = own.findLast((e): e is SessionEvent<'assistant/message'> => e.type === 'assistant/message')
-  const lastEnd = own.findLast((e): e is SessionEvent<'turn/end'> => e.type === 'turn/end')
-  const output: ContentBlock[] = lastMessage ? structuredClone(lastMessage.data.content) : []
-  const stopReason: SubagentStopReason = lastEnd === undefined && cancelled
+  const lastMessage = own.findLast((event): event is SessionEvent<'assistant/message'> => event.type === 'assistant/message')
+  const lastEnd = own.findLast((event): event is SessionEvent<'turn/end'> => event.type === 'turn/end')
+  const output: ContentBlock[] = lastMessage?.data.content ?? []
+  const recorded = toStopReason(lastEnd?.data.reason)
+  // Disposal can tear the owner down before the loop records its ordinary
+  // `aborted` end, yielding `disposed` instead. A requested cancellation owns
+  // every non-completed in-flight outcome; a turn already completed stays so.
+  const stopReason: SubagentStopReason = cancelled && recorded !== 'completed'
     ? 'aborted'
-    : toStopReason(lastEnd?.data.reason)
-  if (structured) {
-    if (structured.captured) return { output, structured: structured.captured.value, stopReason }
-    // No capture on a cleanly-completed turn: an ERROR when the run was left
-    // to finish (the nudges ran out), but ABORTED when a cancel is why the
-    // nudging stopped — the cancel contract outranks the schema shortfall.
+    : recorded
+  if (structured !== undefined) {
+    if (structured.captured !== undefined) {
+      return { output, structured: structured.captured.value, stopReason }
+    }
     if (stopReason === 'completed') return { output, stopReason: cancelled ? 'aborted' : 'error' }
   }
   return { output, stopReason }
diff --git a/packages/subagent/subagent-inprocess/src/structured.ts b/packages/subagent/subagent-inprocess/src/structured.ts
index dff63486ed..f81d82ef62 100644
--- a/packages/subagent/subagent-inprocess/src/structured.ts
+++ b/packages/subagent/subagent-inprocess/src/structured.ts
@@ -16,12 +16,12 @@
  *
  * The child scope's registrations enforce the contract:
  *
- * - `systemPrompt.protect()` declaratively protects the capture tool and its
- *   instruction. The service restores their canonical pre-waterfall state
+ * - `ownerFinal: true` on the capture tool and instruction declares that the
+ *   owning registrations control their final presence. Prompt assembly restores their canonical state
  *   after EVERY assembly listener. Canonical absence is protected too: pure
  *   Code Mode keeps `structured_output` in the SDK only and never grows a
- *   second native wire tool. Code Mode's owner independently protects its SDK
- *   and `run_code` transport. The loop logs the finalized assembly as the
+ *   second native wire tool. Code Mode independently declares its SDK section
+ *   and `run_code` transport owner-final. The loop logs the finalized assembly as the
  *   request header, so the demand is reconstructable log state, never a
  *   wire-only mutation.
  * - `agent/turn-stop` (serial, scoped): stop the child's turn once its output
@@ -79,8 +79,8 @@ export interface StructuredAttachment {
  * agent-creation `setup` window with the child's scope context — every
  * registration rides the child's fiber and unwinds with the child.
  * @param childCtx - the child agent's scope context (`setup`'s argument).
- * @param schema - the isolation-cloned, already-asserted schema subset to
- *   enforce (see `assertSupportedOutputSchema` in dsh-tools).
+ * @param schema - the trusted, already-asserted schema subset to enforce (see
+ *   `assertSupportedOutputSchema` in dsh-tools).
  * @returns the attachment handle (read `captured()` after the child settles).
  */
 export function attachStructuredRuntime(childCtx: Context, schema: StructuredOutputSchema): StructuredAttachment {
@@ -110,15 +110,16 @@ export function attachStructuredRuntime(childCtx: Context, schema: StructuredOut
 
   childCtx.tools.register({
     ...schemaEntry,
+    ownerFinal: true,
     execute(args: unknown, exec: ToolExecution): Promise<ContentBlock[]> {
       const violations = validateStructuredValue(schema, args)
       // ToolArgsError → isError result with INVALID_ARGS: the model retries
       // within the same turn, exactly like a schema-validated defineTool call.
       if (violations.length > 0) throw new ToolArgsError(violations)
       // Two-phase commit, keyed by THIS execution: later transformable
-      // waterfalls may still turn the success into an error. Snapshot the
-      // validated value independently of the already-frozen pipeline arguments.
-      staged.set(exec, { value: structuredClone(args) })
+      // waterfalls may still turn the success into an error. ToolRegistry has
+      // already frozen model-bound arguments at the actual input boundary.
+      staged.set(exec, { value: args })
       return Promise.resolve([{ type: 'text', text: 'Structured output recorded.' }])
     },
   })
@@ -127,16 +128,7 @@ export function attachStructuredRuntime(childCtx: Context, schema: StructuredOut
     name: `tool:${STRUCTURED_OUTPUT_TOOL}`,
     order: 190,
     text: STRUCTURED_OUTPUT_INSTRUCTION,
-  })
-
-  // Service-owned finalization, not waterfall ordering. The canonical
-  // assembly determines both presence and absence: native/both modes restore
-  // the capture schema on the wire, while pure Code Mode removes any injected
-  // native entry. ToolRegistry's own protection independently restores the SDK
-  // section and run_code transport that carry the same schema.
-  childCtx.systemPrompt.protect({
-    sections: [`tool:${STRUCTURED_OUTPUT_TOOL}`],
-    tools: [STRUCTURED_OUTPUT_TOOL],
+    ownerFinal: true,
   })
 
   // Stop the child's turn once its output is captured. This monotonic serial
diff --git a/packages/subagent/subagent-inprocess/tests/structured.spec.ts b/packages/subagent/subagent-inprocess/tests/structured.spec.ts
index 1e63617154..f989d727c8 100644
--- a/packages/subagent/subagent-inprocess/tests/structured.spec.ts
+++ b/packages/subagent/subagent-inprocess/tests/structured.spec.ts
@@ -36,7 +36,7 @@ const SCHEMA: StructuredOutputSchema = {
 }
 
 /**
- * Real loop + scripted mock model + an INLINE spawn-shaped provider over the
+ * Real loop + scripted mock model + an INLINE fresh-conversation provider over the
  * shared driver. The concrete backend plugins are deliberately NOT loaded —
  * they would devDep-cycle this package (spawn/fork already depend on the
  * driver), and the runtime under test is the driver's; plugin-level structured
@@ -65,7 +65,7 @@ async function setup(script: Script, options: SetupOptions = {}) {
     name: 'spawn',
     capabilities: { outputSchema: true, depthLimit: true, toolFilter: false, persona: false },
     inheritsParentContext: false,
-    start: (request: SubagentStartRequest) => startInProcessRun(ctx, request, {}),
+    start: (request: SubagentStartRequest) => startInProcessRun(request, {}),
   })
   ctx.llm.registerAdapter(['mock'], adapter)
   const parent = ctx.agentLoop.create(AgentId('parent'), { model: 'mock' })
@@ -73,7 +73,13 @@ async function setup(script: Script, options: SetupOptions = {}) {
 }
 
 function structuredRequest(parent: SubagentStartRequest['parent'], extra?: Partial<SubagentStartRequest>): SubagentStartRequest {
-  return { prompt: [{ type: 'text', text: 'produce the answer' }], parent, outputSchema: SCHEMA, ...extra }
+  return {
+    prompt: [{ type: 'text', text: 'produce the answer' }],
+    parent,
+    signal: new AbortController().signal,
+    outputSchema: SCHEMA,
+    ...extra,
+  }
 }
 
 /** The tool names of one recorded model request. */
@@ -86,7 +92,7 @@ describe('in-process structured output', () => {
     const { ctx, parent } = await setup([
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 42, note: 'done' }),
     ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(result.structured).toEqual({ answer: 42, note: 'done' })
@@ -98,7 +104,7 @@ describe('in-process structured output', () => {
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 1 }),
       textResponse('MUST NOT BE CONSUMED'),
     ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     await run.result
     // Default continuation would run a second step after the tool call; the
     // structured runtime's turn-continuation veto stops the turn instead.
@@ -129,7 +135,7 @@ describe('in-process structured output', () => {
         return Promise.resolve([{ type: 'text', text: 'ran' }])
       },
     })
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(result.structured).toEqual({ answer: 5 })
@@ -157,7 +163,7 @@ describe('in-process structured output', () => {
         return Promise.resolve([{ type: 'text', text: 'ran' }])
       },
     })
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     // Registered after the child and prepended: this listener returns allow
     // after every downstream pre-execute decision. The service-owned guard
     // runs after the waterfall and can only deny, so the body still cannot run.
@@ -194,7 +200,7 @@ describe('in-process structured output', () => {
         return Promise.resolve([{ type: 'text', text: 'ran' }])
       },
     })
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     // The call ran BEFORE captured was set: the deny gate only guards the
     // window after the terminal answer landed.
@@ -203,46 +209,20 @@ describe('in-process structured output', () => {
     await run.dispose()
   })
 
-  it('snapshots the schema at start(): caller mutation after start cannot drift enforcement', async () => {
-    const mutable: StructuredOutputSchema = {
-      type: 'object',
-      properties: { answer: { type: 'number' } },
-      required: ['answer'],
-      additionalProperties: false,
-    }
-    const pristine = structuredClone(mutable)
-    const { ctx, parent, adapter } = await setup([
-      toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 3 }),
-    ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent, { outputSchema: mutable }))
-    // Mutate the caller's object AFTER start() returned but before the child's
-    // first request assembles: with a live reference this would reach both the
-    // model-visible parameters and validateStructuredValue.
-    ;(mutable.properties as Record<string, unknown>).answer = { type: 'string' }
-    const result = await run.result
-    expect(result.structured).toEqual({ answer: 3 })
-    // The child's request carried the PRISTINE schema, not the mutated one.
-    const childRequest = adapter.requests.at(-1)
-    const captureTool = (childRequest?.tools ?? []).find(tool => tool.name === STRUCTURED_OUTPUT_TOOL)
-    expect(captureTool?.parameters).toEqual(pristine)
-    await run.dispose()
-  })
-
   it('a later-prepended continuation wrapper cannot resurrect a captured turn', async () => {
     const { ctx, parent, adapter } = await setup([
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 7 }),
       textResponse('MUST NOT BE CONSUMED'),
     ])
     ctx.on('agent/turn-continuation', () => Promise.resolve<ContinuationDecision>({ action: 'stop' }))
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
     let wrapperInstalled = false
-    // Register this observer only after start() returns. The child session-start
-    // boundary is after its unpublished setup attached structured output but
-    // before the loop can run; install a prepended wrapper there. It awaits the
+    // Register before the ready-only start. The child session-start boundary is
+    // after unpublished setup attached structured output but before the loop
+    // can run. The wrapper awaits the
     // explicit downstream stop above, then overwrites that result with continue.
     // The later terminal checkpoint still wins.
     ctx.on('agent/session-start', (child) => {
-      if (child.id !== run.id) return
+      if (child === parent) return
       wrapperInstalled = true
       child.ctx.on('agent/turn-continuation', async (_subject, _turn, _decision, next): Promise<ContinuationDecision> => {
         const downstream = await next()
@@ -250,6 +230,7 @@ describe('in-process structured output', () => {
         return { action: 'continue' }
       }, { prepend: true })
     })
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     expect(wrapperInstalled).toBe(true)
     expect(result.structured).toEqual({ answer: 7 })
@@ -268,7 +249,7 @@ describe('in-process structured output', () => {
     // would turn the stop back into continue. The terminal checkpoint runs
     // afterwards and discards that steering.
     ctx.on('agent/turn-continuation', () => Promise.resolve<ContinuationDecision>({ action: 'stop' }))
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     ctx.on('agent/session-start', (child) => {
       if (child.id !== run.id) return
       child.ctx.on('agent/turn-continuation', async (subject, _turn, _decision, next): Promise<ContinuationDecision> => {
@@ -294,7 +275,7 @@ describe('in-process structured output', () => {
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 'not-a-number' }),
       toolCallResponse('c2', STRUCTURED_OUTPUT_TOOL, { answer: 7 }),
     ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     expect(result.structured).toEqual({ answer: 7 })
     expect(result.stopReason).toBe('completed')
@@ -311,7 +292,7 @@ describe('in-process structured output', () => {
       textResponse('here is my answer in prose'),
       textResponse('MUST NOT BE CONSUMED'),
     ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     expect(result.stopReason).toBe('error')
     expect(result.structured).toBeUndefined()
@@ -325,7 +306,7 @@ describe('in-process structured output', () => {
   it('an errored child keeps its honest error result (no capture expected)', async () => {
     // Script exhaustion on the first call → the child turn errors.
     const { ctx, parent, adapter } = await setup([])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     expect(result.stopReason).toBe('error')
     expect(adapter.requests.length).toBe(1)
@@ -334,12 +315,13 @@ describe('in-process structured output', () => {
 
   it('a cancel landing after a clean capture-less turn settles aborted, not error', async () => {
     const { ctx, parent } = await setup([textResponse('prose, no capture')])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const controller = new AbortController()
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent, { signal: controller.signal }))
     // Cancel synchronously inside the turn's end recording: the cancel
     // contract outranks the schema shortfall, so the result maps to aborted.
     ctx.on('session/event', (session, event) => {
       const child = ctx.agents.get(run.id)
-      if (session === child?.session && event.type === 'turn/end') run.cancel('cancelled at turn end')
+      if (session === child?.session && event.type === 'turn/end') controller.abort('cancelled at turn end')
     })
     const result = await run.result
     expect(result.stopReason).toBe('aborted')
@@ -348,20 +330,18 @@ describe('in-process structured output', () => {
 
   it('rejects a schema outside the subset loud, before any child exists', async () => {
     const { ctx, parent } = await setup([])
-    expect(() => ctx.subagents.start('spawn', structuredRequest(parent, {
+    await expect(ctx.subagents.start('spawn', structuredRequest(parent, {
       outputSchema: { type: 'object', oneOf: [] } as unknown as StructuredOutputSchema,
-    }))).toThrow(/unsupported output schema/)
+    }))).rejects.toThrow(/unsupported output schema/)
     expect(ctx.agents.get(AgentId('parent'))).toBeDefined()
   })
 
-  it('a schema carrying non-JSON values fails as OutputSchemaError, never as a raw clone error', async () => {
+  it('a schema carrying non-JSON values fails as OutputSchemaError at the validation boundary', async () => {
     const { ctx, parent } = await setup([])
-    // Assertion runs BEFORE the defensive structuredClone: a function-valued
-    // annotation must surface as the subset violation it is, not escape as
-    // structuredClone's DataCloneError.
-    expect(() => ctx.subagents.start('spawn', structuredRequest(parent, {
+    // Semantic assertion runs before provider startup.
+    await expect(ctx.subagents.start('spawn', structuredRequest(parent, {
       outputSchema: { type: 'object', default: () => {} } as unknown as StructuredOutputSchema,
-    }))).toThrow(/unsupported output schema.*annotation must be JSON data/)
+    }))).rejects.toThrow(/unsupported output schema.*annotation must be JSON data/)
   })
 
   it('a post-execute BLOCK on the capture call denies the capture: log and result agree on failure', async () => {
@@ -377,7 +357,7 @@ describe('in-process structured output', () => {
       }
       return next()
     })
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     // No capture was committed: the run reports the schema shortfall...
     expect(result.structured).toBeUndefined()
@@ -403,7 +383,7 @@ describe('in-process structured output', () => {
       }
       return next()
     })
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(result.structured).toEqual({ answer: 8 })
@@ -415,7 +395,7 @@ describe('in-process structured output', () => {
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 8 }),
       textResponse('capture was rejected'),
     ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     // Registered after attachment and prepended, so it wraps every listener
     // the child installed. It delegates first, then converts the apparent
     // capture success into the pipeline's authoritative failure.
@@ -442,7 +422,7 @@ describe('in-process structured output', () => {
     // replace it (AgentOptions has no prompt field — the instruction is
     // per-request wire state added by the final-request listener).
     ctx.systemPrompt.section({ name: 'test:persona', order: 10, text: 'You are a counter.' })
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     await run.result
     const childRequest = adapter.requests.at(-1)!
     expect(childRequest.system).toContain('You are a counter.')
@@ -463,7 +443,7 @@ describe('in-process structured output', () => {
         return { logs: [], value: 'captured' }
       },
     })
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
 
     // This listener is registered after the child's protection and prepended.
     // Service finalization still restores the stripped transport and prompt
@@ -507,7 +487,7 @@ describe('in-process structured output', () => {
         } as never
       },
     })
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
 
     const result = await run.result
     expect(result.structured).toBeUndefined()
@@ -536,7 +516,7 @@ describe('in-process structured output', () => {
     ctx.on('tools/post-execute', (exec, _result, next) => exec.name === RUN_CODE_NAME
       ? Promise.resolve({ kind: 'block' as const, feedback: [{ type: 'text' as const, text: 'outer blocked' }] })
       : next())
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
 
     const result = await run.result
     expect(result.structured).toBeUndefined()
@@ -553,7 +533,7 @@ describe('in-process structured output', () => {
     parent.send([{ type: 'text', text: 'hello' }])
     await parent.whenIdle()
     expect(adapter.requests[0]!.system ?? '').not.toContain(STRUCTURED_OUTPUT_INSTRUCTION)
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     await run.result
     // The loop always assembles a base prompt (the harness identity section),
     // so the instruction APPENDS — never replaces.
@@ -584,7 +564,7 @@ describe('in-process structured output', () => {
       await parent.whenIdle()
       expect(toolNames(adapter.requests[0]!)).not.toContain(STRUCTURED_OUTPUT_TOOL)
 
-      const run = ctx.subagents.start('spawn', structuredRequest(parent))
+      const run = await ctx.subagents.start('spawn', structuredRequest(parent))
       await run.result
       const childRequest = adapter.requests[1]!
       expect(toolNames(childRequest)).toContain(STRUCTURED_OUTPUT_TOOL)
@@ -617,8 +597,8 @@ describe('in-process structured output', () => {
           return toolCallResponse('c2', STRUCTURED_OUTPUT_TOOL, args)
         },
       ])
-      const runA = ctx.subagents.start('spawn', structuredRequest(parent))
-      const runB = ctx.subagents.start('spawn', structuredRequest(parent, { outputSchema: otherSchema }))
+      const runA = await ctx.subagents.start('spawn', structuredRequest(parent))
+      const runB = await ctx.subagents.start('spawn', structuredRequest(parent, { outputSchema: otherSchema }))
       const [a, b] = await Promise.all([runA.result, runB.result])
       expect(a.structured).toEqual({ answer: 1 })
       expect(b.structured).toEqual({ verdict: 'real' })
@@ -647,7 +627,7 @@ describe('in-process structured output', () => {
           variables: { ...replaced.variables },
         }
       })
-      const run = ctx.subagents.start('spawn', structuredRequest(parent))
+      const run = await ctx.subagents.start('spawn', structuredRequest(parent))
       const result = await run.result
       expect(result.structured).toEqual({ answer: 5 })
       const entries = adapter.requests[0]!.tools!.filter(tool => tool.name === STRUCTURED_OUTPUT_TOOL)
@@ -672,7 +652,7 @@ describe('in-process structured output', () => {
           variables: { ...replaced.variables },
         }
       })
-      const run = ctx.subagents.start('spawn', structuredRequest(parent))
+      const run = await ctx.subagents.start('spawn', structuredRequest(parent))
       const result = await run.result
       expect(result.structured).toEqual({ answer: 5 })
       const entry = adapter.requests[0]!.tools!.find(tool => tool.name === STRUCTURED_OUTPUT_TOOL)
@@ -697,7 +677,7 @@ describe('in-process structured output', () => {
         execute: () => Promise.resolve([{ type: 'text', text: 'x' }]),
       })
       ctx.systemPrompt.section({ name: 'after-band', order: 200, text: 'AFTER-BAND' })
-      const run = ctx.subagents.start('spawn', structuredRequest(parent))
+      const run = await ctx.subagents.start('spawn', structuredRequest(parent))
       await run.result
       const request = adapter.requests[0]!
       const names = toolNames(request)
@@ -731,7 +711,7 @@ describe('in-process structured output', () => {
           variables: { ...replaced.variables },
         }
       })
-      const run = ctx.subagents.start('spawn', structuredRequest(parent))
+      const run = await ctx.subagents.start('spawn', structuredRequest(parent))
       const result = await run.result
       expect(result.structured).toEqual({ answer: 3 })
       const request = adapter.requests[0]!
@@ -759,7 +739,7 @@ describe('in-process structured output', () => {
         toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 4 }),
       ])
       expect(ctx.tools.get(STRUCTURED_OUTPUT_TOOL)).toBeUndefined()
-      const run = ctx.subagents.start('spawn', structuredRequest(parent))
+      const run = await ctx.subagents.start('spawn', structuredRequest(parent))
       // A backend hot-reload mid-run must not unregister the capture tool out
       // from under the live child: the registration rides the CHILD's fiber.
       await disposeProvider()
@@ -800,7 +780,7 @@ describe('in-process structured output', () => {
     const { ctx, parent } = await setup([
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 1 }),
     ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     // A prepended post-execute listener blocks the first capture without
     // delegating. The final-result notification discards that execution's
     // stage when it observes the error.
@@ -841,7 +821,7 @@ describe('in-process structured output', () => {
     const { ctx, parent } = await setup([
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 1 }),
     ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     // Block the first capture after its body stages a value. Its final error
     // discards that execution's stage.
     let blocks = 1
@@ -879,7 +859,7 @@ describe('in-process structured output', () => {
     const { ctx, parent } = await setup([
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 1 }),
     ])
-    const run = ctx.subagents.start('spawn', structuredRequest(parent))
+    const run = await ctx.subagents.start('spawn', structuredRequest(parent))
     // Discard the first capture's stage via a final post-execute block.
     let blocks = 1
     ctx.on('tools/post-execute', (exec, _result, next) => {
diff --git a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts
index 648ee5935f..0005246523 100644
--- a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts
+++ b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts
@@ -1,5 +1,5 @@
-import { describe, expect, it, vi } from 'vitest'
-import { Context, type Fiber } from 'cordis'
+import { describe, expect, it } from 'vitest'
+import { Context } from 'cordis'
 import LlmService from '@deepseek-ai/dsh-llm'
 import SessionStore from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
@@ -13,13 +13,6 @@ import { depthOf, SubagentDepthError, startInProcessRun } from '../src/index.ts'
 
 type Script = ConstructorParameters<typeof MockAdapter>[0]
 
-/**
- * Drives the shared in-process run driver DIRECTLY (no provider package), so the
- * driver's own contract — depth read/cap, the one-shot drive, the result read —
- * is covered independently of which backend (spawn/fork) calls it. The only
- * mocked boundary is the model; the real agent loop, SubagentService, and
- * dsh-invariants are mounted, so a malformed child session log fails the test.
- */
 async function setup(script: Script) {
   const ctx = new Context()
   await ctx.plugin(LlmService)
@@ -35,224 +28,127 @@ async function setup(script: Script) {
   return { ctx, parent }
 }
 
-function text(blocks: { type: string; text?: string }[]): string {
-  return blocks.filter(b => b.type === 'text').map(b => b.text).join('')
+function request(parent: Agent, signal = new AbortController().signal) {
+  return { prompt: [{ type: 'text' as const, text: 'child task' }], parent, signal }
+}
+
+function text(blocks: readonly { type: string; text?: string }[]): string {
+  return blocks.filter(block => block.type === 'text').map(block => block.text).join('')
 }
 
 describe('depthOf', () => {
-  it('reads 0 for an agent with no subagentDepth, the set value otherwise', async () => {
+  it('reads zero for a top-level agent and an explicit child depth', async () => {
     const { parent } = await setup([])
     expect(depthOf(parent)).toBe(0)
-    const withDepth = { options: { subagentDepth: 3 } } as unknown as Agent
-    expect(depthOf(withDepth)).toBe(3)
+    expect(depthOf({ options: { subagentDepth: 3 } } as unknown as Agent)).toBe(3)
+  })
+
+  it.each([Number.NaN, 1.5, -1, -0, Number.MAX_SAFE_INTEGER + 1])('rejects malformed depth %s', (value) => {
+    expect(() => depthOf({ options: { subagentDepth: value } } as unknown as Agent))
+      .toThrow('non-negative safe integer')
   })
 })
 
 describe('startInProcessRun', () => {
-  it('rejects a non-JSON prompt before acquiring any run ownership', async () => {
-    const { ctx, parent } = await setup([])
-    expect(() => startInProcessRun(ctx, {
-      prompt: [{ type: 'text', text: Number.NaN as unknown as string }],
-      parent,
-    }, {})).toThrow('subagent prompt must be losslessly JSON-serializable')
-  })
-
-  it('rejects a prompt whose getter becomes non-JSON while it is snapshotted', async () => {
-    const { ctx, parent } = await setup([])
-    let reads = 0
-    const prompt = [{
-      type: 'text' as const,
-      get text(): string {
-        reads += 1
-        return reads === 1 ? 'valid during pre-check' : Number.NaN as unknown as string
-      },
-    }]
-
-    expect(() => startInProcessRun(ctx, { prompt, parent }, {}))
-      .toThrow('subagent prompt must be stable losslessly JSON-serializable data')
-    expect(reads).toBe(2)
-  })
-
-  it('rejects when the run-owner fiber settles without installing its context', async () => {
-    const { ctx, parent } = await setup([])
-    function inertOwner(): void {}
-    const inertFiber = ctx.plugin(inertOwner)
-    await inertFiber
-    const parentWithoutOwnerContext = {
-      options: parent.options,
-      session: parent.session,
-      ctx: { plugin: () => inertFiber },
-    } as unknown as Agent
-
-    const run = startInProcessRun(ctx, {
-      prompt: [{ type: 'text', text: 'must never start' }],
-      parent: parentWithoutOwnerContext,
-    }, {})
-    await expect(run.result).rejects.toThrow('subagent run owner became inactive before child creation')
-    await run.dispose()
-  })
-
-  it('normalizes a non-Error thrown while installing the run-owner fiber', async () => {
-    const { ctx, parent } = await setup([])
-    const setupFailure = 'non-Error owner setup failure'
-    const parentWithFailingOwnerSetup = {
-      options: parent.options,
-      session: parent.session,
-      ctx: { plugin: () => { throw setupFailure } },
-    } as unknown as Agent
-
-    const run = startInProcessRun(ctx, {
-      prompt: [{ type: 'text', text: 'must never start' }],
-      parent: parentWithFailingOwnerSetup,
-    }, {})
-    await expect(run.result).rejects.toMatchObject({
-      message: 'subagent run owner setup failed with a non-Error value',
-      cause: setupFailure,
-    })
-    await run.dispose()
-  })
-
-  it('normalizes a non-Error rejected by asynchronous child creation', async () => {
-    const { ctx, parent } = await setup([])
-    const creationFailure = 'non-Error child creation failure'
-    function inertOwner(): void {}
-    const ownerFiber = ctx.plugin(inertOwner)
-    await ownerFiber
-    const rejectWithNonError = (): Promise<never> => {
-      // Deliberately violate the promise contract to exercise boundary normalization.
-      // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors
-      return Promise.reject(creationFailure)
-    }
-    const rejectingOwnerCtx = {
-      agents: { create: rejectWithNonError },
-    } as unknown as Context
-    const parentWithRejectingFactory = {
-      options: parent.options,
-      session: parent.session,
-      ctx: {
-        plugin(plugin: (inner: Context) => void) {
-          plugin(rejectingOwnerCtx)
-          return ownerFiber
-        },
-      },
-    } as unknown as Agent
-
-    const run = startInProcessRun(ctx, {
-      prompt: [{ type: 'text', text: 'must never start' }],
-      parent: parentWithRejectingFactory,
-    }, {})
-    await expect(run.result).rejects.toMatchObject({
-      message: 'subagent child creation failed with a non-Error value',
-      cause: creationFailure,
-    })
-    await run.dispose()
-  })
-
-  it('follows owner-fiber inertia when raw teardown was already in flight', async () => {
-    const { ctx, parent } = await setup([])
-    const gate = Promise.withResolvers<undefined>()
-    let inertia: Promise<undefined> | undefined = gate.promise
-    const fakeFiber = {
-      dispose: vi.fn(() => undefined),
-      get inertia() { return inertia },
-    } as unknown as Fiber & PromiseLike<Fiber>
-    const rejectingOwnerCtx = {
-      agents: { create: () => Promise.reject(new Error('creation stopped by teardown')) },
-    } as unknown as Context
-    const parentWithDisposingOwner = {
-      options: parent.options,
-      session: parent.session,
-      ctx: {
-        plugin(plugin: (inner: Context) => void) {
-          plugin(rejectingOwnerCtx)
-          return fakeFiber
-        },
-      },
-    } as unknown as Agent
-    const run = startInProcessRun(ctx, {
-      prompt: [{ type: 'text', text: 'must never start' }],
-      parent: parentWithDisposingOwner,
-    }, {})
-
-    let settled = false
-    const disposing = run.dispose().then(() => { settled = true })
-    await Promise.resolve()
-    await Promise.resolve()
-    expect(fakeFiber.dispose).toHaveBeenCalledOnce()
-    expect(settled).toBe(false)
-
-    inertia = undefined
-    gate.resolve(undefined)
-    await disposing
-    await expect(run.result).resolves.toEqual({ output: [], stopReason: 'aborted' })
-  })
-
-  it('does not attach an abort listener when provider ownership is already inactive', async () => {
-    const { ctx, parent } = await setup([])
-    let providerCtx: Context | undefined
-    function provider(inner: Context): void { providerCtx = inner }
-    const providerFiber = await ctx.plugin(provider)
-    await providerFiber.dispose()
-    if (providerCtx === undefined) throw new Error('provider context was not captured')
-    const inactiveProviderCtx = providerCtx
-
-    const controller = new AbortController()
-    const addListener = vi.spyOn(controller.signal, 'addEventListener')
-    expect(() => startInProcessRun(inactiveProviderCtx, {
-      prompt: [{ type: 'text', text: 'must never start' }],
-      parent,
-      signal: controller.signal,
-    }, {})).toThrow(/inactive context/)
-    expect(addListener).not.toHaveBeenCalled()
-  })
-
-  it('drives a fresh child (no seed) to completion and returns its output', async () => {
-    const { ctx, parent } = await setup([textResponse('driver child answer')])
-    const run = startInProcessRun(ctx, { prompt: [{ type: 'text', text: 'do X' }], parent }, {})
+  it('returns only after publication, drives a fresh child, and disposes it', async () => {
+    const { ctx, parent } = await setup([textResponse('driver answer')])
+    const run = await startInProcessRun(request(parent), {})
+    expect(ctx.agents.get(run.id)).toBeDefined()
     const result = await run.result
     expect(result.stopReason).toBe('completed')
-    expect(text(result.output)).toBe('driver child answer')
+    expect(text(result.output)).toBe('driver answer')
     expect(depthOf(ctx.agents.get(run.id)!)).toBe(1)
     await run.dispose()
-  })
-
-  it('snapshots the prompt before asynchronous child creation', async () => {
-    const { ctx, parent } = await setup([textResponse('done')])
-    const prompt = [{ type: 'text' as const, text: 'original prompt' }]
-    const run = startInProcessRun(ctx, { prompt, parent }, {})
-
-    prompt[0]!.text = 'mutated after start'
-    prompt.push({ type: 'text', text: 'also injected' })
-    await run.result
-
-    const child = ctx.agents.get(run.id)!
-    const userMessage = child.session.events.find(event => event.type === 'user/message')
-    expect(userMessage?.type === 'user/message' && userMessage.data.content)
-      .toEqual([{ type: 'text', text: 'original prompt' }])
     await run.dispose()
+    expect(ctx.agents.get(run.id)).toBeUndefined()
   })
 
-  it('throws SubagentDepthError when the child would exceed maxDepth', async () => {
-    const { ctx, parent } = await setup([])
-    expect(() => startInProcessRun(ctx, { prompt: [{ type: 'text', text: 'p' }], parent, maxDepth: 0 }, {}))
-      .toThrow(SubagentDepthError)
-  })
-
-  it('seeds the child session when a seed is supplied', async () => {
-    // Drive the parent through one real turn, then seed the child with that
-    // completed-turn prefix — the child must SEE the parent's history but its
-    // result is scoped to its OWN events (not the seeded parent message).
-    const { ctx, parent } = await setup([textResponse('parent turn'), textResponse('seeded child reply')])
-    parent.send([{ type: 'text', text: 'parent q' }])
+  it('seeds a forked child but reads only the child-owned output', async () => {
+    const { ctx, parent } = await setup([textResponse('parent answer'), textResponse('child answer')])
+    parent.send([{ type: 'text', text: 'parent question' }])
     await parent.whenIdle()
     const seed = parent.session.events.slice()
-    const run = startInProcessRun(ctx, { prompt: [{ type: 'text', text: 'child q' }], parent }, { seed })
+    const run = await startInProcessRun(request(parent), { seed })
     const result = await run.result
-    expect(result.stopReason).toBe('completed')
-    expect(text(result.output)).toBe('seeded child reply')
+    expect(text(result.output)).toBe('child answer')
     const child = ctx.agents.get(run.id)!
-    // The child inherited the parent's prefix.
-    expect(child.session.events.slice(0, seed.length).some(e => e.type === 'user/message')).toBe(true)
+    expect(child.session.header.seedLength).toBe(seed.length)
+    expect(child.session.events.slice(0, seed.length)).toEqual(seed)
     await run.dispose()
   })
+
+  it('rejects invalid and exceeded depth before publication', async () => {
+    const { parent } = await setup([])
+    await expect(startInProcessRun({ ...request(parent), maxDepth: -1 }, {}))
+      .rejects.toThrow('non-negative safe integer')
+    await expect(startInProcessRun({ ...request(parent), maxDepth: 0 }, {}))
+      .rejects.toBeInstanceOf(SubagentDepthError)
+    const maxParent = { options: { subagentDepth: Number.MAX_SAFE_INTEGER } } as unknown as Agent
+    await expect(startInProcessRun(request(maxParent), {})).rejects.toBeInstanceOf(RangeError)
+  })
+
+  it('rejects an already-aborted request without publishing a child', async () => {
+    const { ctx, parent } = await setup([])
+    const beforeAgents = ctx.agents.list().length
+    const beforeSessions = ctx.sessions.list().length
+    const controller = new AbortController()
+    controller.abort('too late')
+    await expect(startInProcessRun(request(parent, controller.signal), {}))
+      .rejects.toThrow('aborted before child publication')
+    expect(ctx.agents.list()).toHaveLength(beforeAgents)
+    expect(ctx.sessions.list()).toHaveLength(beforeSessions)
+  })
+
+  it('uses the request signal after publication and dispose as cancellation paths', async () => {
+    const { parent } = await setup(['hang', 'hang'])
+    const controller = new AbortController()
+    const signalled = await startInProcessRun(request(parent, controller.signal), {})
+    await new Promise(resolve => setTimeout(resolve, 30))
+    controller.abort('stop child')
+    await expect(signalled.result).resolves.toMatchObject({ stopReason: 'aborted' })
+    await signalled.dispose()
+
+    const disposed = await startInProcessRun(request(parent), {})
+    await new Promise(resolve => setTimeout(resolve, 30))
+    await disposed.dispose()
+    await expect(disposed.result).resolves.toMatchObject({ stopReason: 'aborted' })
+  })
+
+  it('cleans a failed unpublished setup before rejecting', async () => {
+    const { ctx, parent } = await setup([])
+    const beforeAgents = ctx.agents.list().length
+    const beforeSessions = ctx.sessions.list().length
+    await expect(startInProcessRun({
+      ...request(parent),
+      toolFilter: { deny: ['unknown-tool'] },
+    }, {})).rejects.toThrow('unknown global tool')
+    expect(ctx.agents.list()).toHaveLength(beforeAgents)
+    expect(ctx.sessions.list()).toHaveLength(beforeSessions)
+  })
+
+  it('closes the abort handoff after the factory detaches its creation listener', async () => {
+    const { ctx, parent } = await setup([])
+    const controller = new AbortController()
+    const beforeAgents = ctx.agents.list().length
+    const beforeSessions = ctx.sessions.list().length
+    const parentWithAbortAtHandoff = {
+      options: parent.options,
+      session: parent.session,
+      ctx: {
+        agents: {
+          create: async (options: Parameters<typeof ctx.agents.create>[0]) => {
+            const handle = await ctx.agents.create(options)
+            // `create()` has detached its creation-only listener, but the
+            // provider continuation has not installed its live-run listener.
+            controller.abort('handoff race')
+            return handle
+          },
+        },
+      },
+    } as unknown as Agent
+    await expect(startInProcessRun(request(parentWithAbortAtHandoff, controller.signal), {}))
+      .rejects.toThrow('aborted before child publication')
+    expect(ctx.agents.list()).toHaveLength(beforeAgents)
+    expect(ctx.sessions.list()).toHaveLength(beforeSessions)
+  })
 })
diff --git a/packages/subagent/subagent-spawn/README.md b/packages/subagent/subagent-spawn/README.md
index 4a86a003fd..852a2cef72 100644
--- a/packages/subagent/subagent-spawn/README.md
+++ b/packages/subagent/subagent-spawn/README.md
@@ -1,16 +1,16 @@
 # @deepseek-ai/dsh-subagent-spawn
 
-The in-process **spawn** subagent backend: a [`SubagentProvider`](../subagent/README.md) that runs each child as a **fresh** child [`Agent`](../../core/agent) on the same cordis context (`ctx.agents`) — its own session, its own (or the parent's) model, zero inherited conversation. The cheapest transport, reusing the agent factory's quiescent [`AgentHandle`](../../core/agent) teardown.
+The spawn provider creates a fresh child `Agent` in the current process. The child has its own session, sees no parent conversation history, and reuses the host's agent factory and LLM/tool services.
 
-The run mechanics live in the shared [`@deepseek-ai/dsh-subagent-inprocess`](../subagent-inprocess/README.md) driver (`startInProcessRun`); this backend just passes **no seed** (a fresh child). The [fork](../subagent-fork/README.md) backend is an independent peer over the same driver — neither knows about the other.
+## Behavior
 
-## What it does
+`start(request)` delegates to [`startInProcessRun`](../subagent-inprocess/README.md) with no seed and awaits publication before returning. The child receives parent working-directory/session lineage and inherits the parent model unless overridden, but starts with an empty conversation.
 
-`start(request)` delegates to `startInProcessRun(ctx, request, {})` with no seed: a fresh child agent with the parent's `cwd`/`parentSession` lineage and (by default) the parent's model. The driver creates one run-owner fiber under `parent.ctx`; parent teardown, this provider's teardown, and manual disposal all converge there before child publication. Its `run.started` boundary resolves only after the fresh child is published, so `subagent/start` observers see a live registry entry. See the [driver README](../subagent-inprocess/README.md) for the full lifecycle (depth check, one-shot drive, result read, dispose).
+The shared driver owns depth checking, persona and tool-filter setup, structured output, required-signal cancellation, one-shot execution, result reading, and quiescent disposal. A startup rejection leaves no published child; provider unload after fulfillment does not revoke the holder-owned run.
 
 ## Capabilities
 
-`{ outputSchema: true, depthLimit: true, toolFilter: true, persona: true }`. It constructs the child, so it enforces a recursion cap and composes the child's persona, global-tool restriction, and [structured runtime](../subagent-inprocess/README.md) inside the agent-creation setup window. At apply it registers this one named provider on `ctx.subagents`; per-run contributions belong to each child's scope.
+Spawn advertises `{ outputSchema: true, depthLimit: true, toolFilter: true, persona: true }` because it controls the child's creation window and can enforce all four features.
 
 ## Config
 
@@ -20,5 +20,5 @@ The run mechanics live in the shared [`@deepseek-ai/dsh-subagent-inprocess`](../
 
 ## Known Limitations and Deferred Work
 
-- **Runs expose no `sendMessage`/`resume`** — the optional runtime capabilities are absent on in-process runs; the consumer collects synchronously.
+- **Runs expose no `sendMessage`/`resume`** — the optional runtime capabilities are absent on in-process runs.
 - **Fresh means no parent transcript** — the child inherits cwd, lineage, model, and explicitly configured persona/tool restrictions, but none of the parent's conversation; use the fork provider when completed-turn context is required.
diff --git a/packages/subagent/subagent-spawn/src/index.ts b/packages/subagent/subagent-spawn/src/index.ts
index 835cf34aae..6d2d8f3a11 100644
--- a/packages/subagent/subagent-spawn/src/index.ts
+++ b/packages/subagent/subagent-spawn/src/index.ts
@@ -53,16 +53,16 @@ class SpawnProvider implements SubagentProvider {
   // Context contract: a spawned child starts fresh — it never sees the parent conversation.
   readonly inheritsParentContext = false
 
-  constructor(readonly name: string, private readonly ctx: Context) {}
+  constructor(readonly name: string) {}
 
   start(request: SubagentStartRequest) {
     // Fresh child: no seed. The shared driver mints ids, stamps cwd/lineage/
     // depth, drives the one-shot (including the structured capture when the
     // request carries an outputSchema), and maps the result.
-    return startInProcessRun(this.ctx, request, {})
+    return startInProcessRun(request, {})
   }
 }
 
 export function apply(ctx: Context, config: Config): void {
-  ctx.subagents.registerProvider(new SpawnProvider(config.providerName, ctx))
+  ctx.subagents.registerProvider(new SpawnProvider(config.providerName))
 }
diff --git a/packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts b/packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts
index 3d23fca285..9e4e489882 100644
--- a/packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts
+++ b/packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts
@@ -9,7 +9,7 @@ import AgentRegistry, { AgentId } from '@deepseek-ai/dsh-agent'
 import { SessionId } from '@deepseek-ai/dsh-session'
 import AgentLoop from '@deepseek-ai/dsh-agent-loop'
 import * as Invariants from '@deepseek-ai/dsh-invariants'
-import SubagentService from '@deepseek-ai/dsh-subagent'
+import SubagentService, { type SubagentStartRequest } from '@deepseek-ai/dsh-subagent'
 import { MockAdapter, maxTokensResponse, textResponse, toolCallResponse } from '../../../core/agent-loop/tests/mock-adapter.ts'
 import * as spawn from '../src/index.ts'
 import { depthOf, STRUCTURED_OUTPUT_TOOL, SubagentDepthError } from '@deepseek-ai/dsh-subagent-inprocess'
@@ -44,11 +44,15 @@ function text(blocks: { type: string; text?: string }[]): string {
   return blocks.filter(b => b.type === 'text').map(b => b.text).join('')
 }
 
+function start(ctx: Context, provider: string, request: Omit<SubagentStartRequest, 'signal'> & { signal?: AbortSignal }) {
+  return ctx.subagents.start(provider, { signal: request.signal ?? new AbortController().signal, ...request })
+}
+
 describe('dsh-subagent-spawn', () => {
   it('runs a fresh child to completion and returns its final assistant output', async () => {
     // One model call for the child: a plain text answer.
     const { ctx, parent } = await setup([textResponse('child answer')])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'do X' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'do X' }], parent })
     const result = await run.result
     expect(result.stopReason).toBe('completed')
     expect(text(result.output)).toBe('child answer')
@@ -62,11 +66,11 @@ describe('dsh-subagent-spawn', () => {
       if (info.provider === 'spawn') childAtStart = ctx.agents.get(info.id)
     })
 
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'do X' }], parent })
+    const starting = start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'do X' }], parent })
     // Creation is asynchronous; no lifecycle claim is made while the child is
     // still inside its unpublished setup transaction.
     expect(childAtStart).toBeUndefined()
-    await run.started
+    const run = await starting
     expect(childAtStart).toBe(ctx.agents.get(run.id))
     expect(childAtStart?.id).toBe(run.id)
 
@@ -76,7 +80,7 @@ describe('dsh-subagent-spawn', () => {
 
   it('gives the child its OWN session (not the parent\'s), with parentSession lineage', async () => {
     const { ctx, parent } = await setup([textResponse('hi')])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
     await run.result
     const child = ctx.agents.get(run.id)!
     expect(child.session.header.id).not.toBe(parent.session.header.id)
@@ -92,7 +96,7 @@ describe('dsh-subagent-spawn', () => {
     const parentEventCount = parent.session.events.length
     expect(parentEventCount).toBeGreaterThan(0)
 
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'child prompt' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'child prompt' }], parent })
     await run.result
     const child = ctx.agents.get(run.id)!
     // The child's first user/message is its OWN prompt, not the parent's history.
@@ -103,7 +107,7 @@ describe('dsh-subagent-spawn', () => {
 
   it('disposes the child to quiescence (agent removed from the registry)', async () => {
     const { ctx, parent } = await setup([textResponse('x')])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
     await run.result
     expect(ctx.agents.get(run.id)).toBeDefined()
     await run.dispose()
@@ -114,7 +118,7 @@ describe('dsh-subagent-spawn', () => {
   it('stamps child depth = parent depth + 1 (via the merged AgentOptions field)', async () => {
     const { ctx, parent } = await setup([textResponse('x')])
     expect(depthOf(parent)).toBe(0)
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
     await run.result
     const child = ctx.agents.get(run.id)!
     expect(depthOf(child)).toBe(1)
@@ -124,13 +128,13 @@ describe('dsh-subagent-spawn', () => {
   it('refuses to spawn past maxDepth (depthLimit capability)', async () => {
     const { ctx, parent } = await setup([])
     // parent is depth 0, child would be depth 1 — cap at 0 forbids any child.
-    expect(() => ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent, maxDepth: 0 }))
-      .toThrow(SubagentDepthError)
+    await expect(start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent, maxDepth: 0 }))
+      .rejects.toThrow(SubagentDepthError)
   })
 
   it('maps a child that hit its token ceiling to stopReason "max-tokens"', async () => {
     const { ctx, parent } = await setup([maxTokensResponse('cut off')])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
     const result = await run.result
     expect(result.stopReason).toBe('max-tokens')
     await run.dispose()
@@ -140,14 +144,14 @@ describe('dsh-subagent-spawn', () => {
     // Empty script: the child's first model call throws "script exhausted", the
     // turn ends `error`, and there is no assistant/message → empty output.
     const { ctx, parent } = await setup([])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
     const result = await run.result
     expect(result.stopReason).toBe('error')
     expect(result.output).toEqual([])
     await run.dispose()
   })
 
-  it('settles aborted (without running the child) when the request signal is ALREADY aborted', async () => {
+  it('rejects without publishing when the request signal is already aborted', async () => {
     // Regression: a signal aborted BEFORE the run starts never fires an `abort`
     // event, so the listener can't catch it. The driver must check the
     // already-aborted case up front and settle `aborted` without running the
@@ -156,43 +160,15 @@ describe('dsh-subagent-spawn', () => {
     const controller = new AbortController()
     controller.abort()
     const { ctx, parent } = await setup([])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent, signal: controller.signal })
-    const result = await run.result
-    expect(result.stopReason).toBe('aborted')
-    expect(result.output).toEqual([])
-    await run.dispose()
+    await expect(start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent, signal: controller.signal }))
+      .rejects.toThrow('aborted before child publication')
   })
 
-  it('cancelling BEFORE the child turn starts settles aborted, not error', async () => {
-    // Regression: a cancel landing in the pre-turn window clears the queued
-    // prompt before any `turn/end` is logged. Deriving the stop reason from
-    // `turn/end` alone then mis-maps the no-turn case to `error`; the run must
-    // honor the cancel contract and settle `aborted`. The cancel is synchronous
-    // (same tick as start, before the loop's queued-wait continuation runs), so
-    // the turn is dropped and the empty script is never consumed.
-    const { ctx, parent } = await setup([])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
-    run.cancel('early')
-    const result = await run.result
-    expect(result.stopReason).toBe('aborted')
-    expect(result.output).toEqual([])
-    await run.dispose()
-  })
-
-  it('a cancel from agent/queued maps a no-turn child log to aborted', async () => {
-    const { ctx, parent } = await setup([])
-    ctx.on('agent/queued', (agent) => {
-      if (agent.id === run.id) run.cancel('queued-window')
-    })
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
-    const result = await run.result
-    expect(result).toMatchObject({ stopReason: 'aborted', output: [] })
-    const child = ctx.agents.get(run.id)!
-    expect(child.session.events.some(event => event.type === 'turn/end')).toBe(false)
-    await run.dispose()
-  })
-
-  it('dispose during async child creation waits for rollback and leaves no orphan', async () => {
+  it('same-tick cancellation rejects start and prevents child publication', async () => {
+    // Regression: cancellation before publication used to set a flag but let the
+    // async factory publish a child anyway, so `started` fulfilled and lifecycle
+    // observers saw an agent for an attempt the caller had already cancelled.
+    // The empty script also proves no model turn can run.
     const { ctx, parent } = await setup([])
     const beforeAgents = ctx.agents.list().length
     const beforeSessions = ctx.sessions.list().length
@@ -200,22 +176,36 @@ describe('dsh-subagent-spawn', () => {
     ctx.on('session/created', () => void published.push('session/created'))
     ctx.on('agent/created', () => void published.push('agent/created'))
     ctx.on('agent/session-start', () => void published.push('agent/session-start'))
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
+    ctx.on('subagent/start', () => void published.push('subagent/start'))
+    ctx.on('subagent/end', () => void published.push('subagent/end'))
+    const controller = new AbortController()
+    const starting = start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent, signal: controller.signal })
+    controller.abort('early')
 
-    // Same tick: the factory has reserved ids and entered its async setup
-    // transaction, but has not published the child yet.
-    await run.dispose()
-    await expect(run.result).resolves.toMatchObject({ stopReason: 'aborted', output: [] })
+    await expect(starting).rejects.toThrow()
+    await Promise.resolve()
     expect(ctx.agents.list()).toHaveLength(beforeAgents)
     expect(ctx.sessions.list()).toHaveLength(beforeSessions)
     expect(published).toEqual([])
   })
 
+  it('a cancel from agent/queued maps a no-turn child log to aborted', async () => {
+    const { ctx, parent } = await setup([])
+    const controller = new AbortController()
+    ctx.on('agent/queued', () => { controller.abort('queued-window') })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent, signal: controller.signal })
+    const result = await run.result
+    expect(result).toMatchObject({ stopReason: 'aborted', output: [] })
+    const child = ctx.agents.get(run.id)!
+    expect(child.session.events.some(event => event.type === 'turn/end')).toBe(false)
+    await run.dispose()
+  })
+
   it('cancelling a running child settles the run as aborted (the abort bridge + cancel())', async () => {
     // 'hang' makes the child's model stream one chunk then wait until aborted.
     const controller = new AbortController()
     const { ctx, parent } = await setup(['hang'])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent, signal: controller.signal })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent, signal: controller.signal })
     // Let the child's turn start, then abort via the request signal (the
     // backend bridges it to child.cancel()).
     await new Promise(r => setTimeout(r, 30))
@@ -225,29 +215,18 @@ describe('dsh-subagent-spawn', () => {
     await run.dispose()
   })
 
-  it('run.cancel() also cancels the child directly', async () => {
+  it('dispose cancels the child and reaches quiescence', async () => {
     const { ctx, parent } = await setup(['hang'])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
     await new Promise(r => setTimeout(r, 30))
-    run.cancel('test cancel')
+    await run.dispose()
     const result = await run.result
     expect(result.stopReason).toBe('aborted')
-    await run.dispose()
-  })
-
-  it('run.cancel() with no reason uses the default cancel reason', async () => {
-    const { ctx, parent } = await setup(['hang'])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
-    await new Promise(r => setTimeout(r, 30))
-    run.cancel()
-    const result = await run.result
-    expect(result.stopReason).toBe('aborted')
-    await run.dispose()
   })
 
   it('does not expose the optional runtime methods (sendMessage/resume) in this cut', async () => {
     const { ctx, parent } = await setup([textResponse('x')])
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent })
     expect('sendMessage' in run).toBe(false)
     expect('resume' in run).toBe(false)
     await run.result
@@ -263,7 +242,7 @@ describe('dsh-subagent-spawn', () => {
       meta: { cwd: '/tmp/parent-workspace' },
       agentOptions: { model: 'mock' },
     })
-    const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent: parentHandle.agent })
+    const run = await start(ctx, 'spawn', { prompt: [{ type: 'text', text: 'p' }], parent: parentHandle.agent })
     await run.result
     const child = ctx.agents.get(run.id)!
     expect(child.session.header.cwd).toBe('/tmp/parent-workspace')
@@ -280,7 +259,7 @@ describe('dsh-subagent-spawn', () => {
       agentOptions: {},
     })
     // The request supplies the child's model explicitly.
-    const run = ctx.subagents.start('spawn', {
+    const run = await start(ctx, 'spawn', {
       prompt: [{ type: 'text', text: 'p' }],
       parent: parentHandle.agent,
       agentOptions: { model: 'mock' },
@@ -312,7 +291,7 @@ describe('dsh-subagent-spawn', () => {
     const { ctx, parent } = await setup([
       toolCallResponse('c1', STRUCTURED_OUTPUT_TOOL, { answer: 42 }),
     ])
-    const run = ctx.subagents.start('spawn', {
+    const run = await start(ctx, 'spawn', {
       prompt: [{ type: 'text', text: 'produce the answer' }],
       parent,
       outputSchema: { type: 'object', properties: { answer: { type: 'number' } }, required: ['answer'] },
@@ -325,7 +304,7 @@ describe('dsh-subagent-spawn', () => {
     await run.dispose()
   })
 
-  it('a backend unload mid-structured-run settles the run and releases the runtime', async () => {
+  it('a backend unload does not revoke an accepted holder-owned run', async () => {
     // Rebuild the stack by hand so we hold the backend's fiber.
     const ctx = new Context()
     const adapter = new MockAdapter(['hang'])
@@ -340,52 +319,27 @@ describe('dsh-subagent-spawn', () => {
     const fiber = await ctx.plugin(spawn, { providerName: 'spawn' })
     ctx.llm.registerAdapter(['mock'], adapter)
     const parent = ctx.agentLoop.create(AgentId('parent'), { model: 'mock' })
-    const run = ctx.subagents.start('spawn', {
+    const controller = new AbortController()
+    const run = await start(ctx, 'spawn', {
       prompt: [{ type: 'text', text: 'q' }],
       parent,
+      signal: controller.signal,
       outputSchema: { type: 'object', properties: { a: { type: 'number' } } },
     })
-    // Let the child's step start streaming, then unload the backend. The
-    // backend owns the child agent, so the unload tears the child down and
-    // the run settles — releasing its own runtime acquisition on the way out.
+    // Provider removal prevents new starts but the returned run belongs to its
+    // holder and remains live.
     await new Promise(resolve => setTimeout(resolve, 30))
     await fiber.dispose()
+    expect(ctx.subagents.getProvider('spawn')).toBeUndefined()
+    expect(ctx.agents.get(run.id)).toBeDefined()
+    controller.abort('test complete')
     const result = await run.result
-    expect(result.stopReason).toBe('error')
+    expect(result.stopReason).toBe('aborted')
     expect(ctx.tools.get(STRUCTURED_OUTPUT_TOOL)).toBeUndefined()
     await run.dispose()
   })
 
-  it('a backend unload during child creation prevents every publication notification', async () => {
-    const ctx = new Context()
-    await ctx.plugin(LlmService)
-    await ctx.plugin(SessionStore)
-    await ctx.plugin(SystemPrompt)
-    await ctx.plugin(ToolRegistry)
-    await ctx.plugin(AgentRegistry)
-    await ctx.plugin(Invariants)
-    await ctx.plugin(AgentLoop, { agents: [] })
-    await ctx.plugin(SubagentService)
-    const fiber = await ctx.plugin(spawn, { providerName: 'spawn' })
-    ctx.llm.registerAdapter(['mock'], new MockAdapter([]))
-    const parent = ctx.agentLoop.create(AgentId('parent'), { model: 'mock' })
-    const published: string[] = []
-    ctx.on('session/created', () => void published.push('session/created'))
-    ctx.on('agent/created', () => void published.push('agent/created'))
-    ctx.on('agent/session-start', () => void published.push('agent/session-start'))
-
-    const run = ctx.subagents.start('spawn', {
-      prompt: [{ type: 'text', text: 'must never run' }], parent,
-    })
-    await fiber.dispose()
-    await run.result.catch(() => undefined)
-    await run.dispose()
-
-    expect(ctx.agents.get(run.id)).toBeUndefined()
-    expect(published).toEqual([])
-  })
-
-  it('a start racing an already-unloading backend cannot mint a run-owner fiber', async () => {
+  it('a start racing an already-unloading backend cannot begin child creation', async () => {
     const ctx = new Context()
     await ctx.plugin(LlmService)
     await ctx.plugin(SessionStore)
@@ -402,10 +356,10 @@ describe('dsh-subagent-spawn', () => {
     ctx.on('agent/created', () => void published.push('agent/created'))
 
     const unloading = fiber.dispose()
-    expect(() => ctx.subagents.start('spawn', {
-      prompt: [{ type: 'text', text: 'must never start' }], parent,
-    })).toThrow(/inactive context/)
     await unloading
+    await expect(start(ctx, 'spawn', {
+      prompt: [{ type: 'text', text: 'must never start' }], parent,
+    })).rejects.toThrow(/no subagent provider/)
 
     expect(parent.ctx.fiber.getEffects()).toHaveLength(parentEffects)
     expect(published).toEqual([])
@@ -432,7 +386,7 @@ describe('dsh-subagent-spawn', () => {
       parent.send([{ type: 'text', text: 'hi' }])
       await parent.whenIdle()
 
-      const run = ctx.subagents.start('spawn', {
+      const run = await start(ctx, 'spawn', {
         prompt: [{ type: 'text', text: 'do X' }],
         parent,
         persona: 'You are the tersest test runner.',
@@ -455,7 +409,7 @@ describe('dsh-subagent-spawn', () => {
         name: 'forbidden_tool', description: 'global', parameters: {},
         execute: () => Promise.resolve([{ type: 'text', text: 'ran' }]),
       })
-      const run = ctx.subagents.start('spawn', {
+      const run = await start(ctx, 'spawn', {
         prompt: [{ type: 'text', text: 'do X' }],
         parent,
         toolFilter: { deny: ['forbidden_tool'] },
@@ -475,13 +429,11 @@ describe('dsh-subagent-spawn', () => {
     it('an unknown toolFilter name fails the spawn loudly with no orphaned child', async () => {
       const { ctx, parent } = await setup([])
       const before = ctx.agents.list().length
-      const run = ctx.subagents.start('spawn', {
+      await expect(start(ctx, 'spawn', {
         prompt: [{ type: 'text', text: 'do X' }],
         parent,
         toolFilter: { deny: ['no_such_tool'] },
-      })
-      await expect(run.result).rejects.toThrow(/unknown tool "no_such_tool"/)
-      await run.dispose()
+      })).rejects.toThrow(/unknown global tool "no_such_tool"/)
       expect(ctx.agents.list().length).toBe(before)
     })
   })
@@ -501,12 +453,10 @@ describe('dsh-subagent-spawn', () => {
     ctx.on('session/created', () => void published.push('session/created'))
     ctx.on('agent/created', () => void published.push('agent/created'))
     ctx.on('agent/session-start', () => void published.push('agent/session-start'))
-    const run = ctx.subagents.start('spawn', {
+    await expect(start(ctx, 'spawn', {
       prompt: [{ type: 'text', text: 'do X' }],
       parent: parentHandle.agent,
-    })
-    await expect(run.result).rejects.toThrow(/inactive context/)
-    await run.dispose()
+    })).rejects.toThrow(/inactive context/)
     expect(ctx.agents.list().length).toBe(before)
     expect(ctx.sessions.list()).toHaveLength(sessionsBefore)
     expect(published).toEqual([])
@@ -524,18 +474,16 @@ describe('dsh-subagent-spawn', () => {
     ctx.on('agent/created', () => void published.push('agent/created'))
     ctx.on('agent/session-start', () => void published.push('agent/session-start'))
 
-    const run = ctx.subagents.start('spawn', {
+    const starting = start(ctx, 'spawn', {
       prompt: [{ type: 'text', text: 'must never run' }],
       parent: parentHandle.agent,
     })
-    // The factory has entered its awaited unpublished setup transaction. Parent
-    // ownership was installed before that await, so disposal wins without an
+    // The factory has entered its awaited unpublished setup transaction. The
+    // parent context owns that transaction, so disposal wins without an
     // observer ever seeing the child.
     await parentHandle.dispose()
-    await expect(run.result).rejects.toThrow(/owner disposed during setup|inactive context/)
-    await run.dispose()
+    await expect(starting).rejects.toThrow(/owner disposed during setup|inactive context/)
 
-    expect(ctx.agents.get(run.id)).toBeUndefined()
     expect(published).toEqual([])
   })
 })
diff --git a/packages/subagent/subagent/README.md b/packages/subagent/subagent/README.md
index 2d11d874f7..d520b7aa80 100644
--- a/packages/subagent/subagent/README.md
+++ b/packages/subagent/subagent/README.md
@@ -1,44 +1,66 @@
 # @deepseek-ai/dsh-subagent
 
-The **subagent seam**: an abstract `SubagentService` (`ctx.subagents`) for an agent delegating work to another agent. A *subagent* is a child agent; a `SubagentProvider` is one transport for running it.
+The subagent seam lets one agent delegate work to a child through a named provider. Callers use one service API (`ctx.subagents`); providers decide whether the child runs in this process, in another process, or through a future transport.
 
-This package is the interface third of the capability seam, split so each concern evolves (and swaps) independently:
+## Package roles
+
+The family separates the stable interface from implementations and model-facing tools:
 
 | Package | Role |
 |---|---|
-| `@deepseek-ai/dsh-subagent` (this) | the interface: registry service + vocabulary types |
-| `@deepseek-ai/dsh-subagent-spawn` | an implementation: fresh in-process child |
-| `@deepseek-ai/dsh-subagent-fork` | an implementation: in-process child seeded from the parent's log |
-| `@deepseek-ai/dsh-subagent-acp` | an implementation: ACP client driving another process |
-| `@deepseek-ai/dsh-tool-subagent` | the model-facing tool over `ctx.subagents` |
+| `@deepseek-ai/dsh-subagent` | Provider registry, request/result types, and lifecycle events. |
+| `@deepseek-ai/dsh-subagent-spawn` | Fresh in-process child. |
+| `@deepseek-ai/dsh-subagent-fork` | In-process child seeded with completed parent turns. |
+| `@deepseek-ai/dsh-subagent-acp` | Fresh out-of-process ACP child. |
+| `@deepseek-ai/dsh-tool-subagent` | Model-facing tool over one configured provider. |
 
-Unlike the bash seam (one executor per context, second load throws), **multiple providers coexist** here. Each registers under a unique name and a caller picks one by name — the shape mirrors the LLM adapter registry (`LlmService.registerAdapter`), not the single-service bash executor. This is the requirement that rules out the bash shape: an agent may want an in-process child for a cheap subtask and an out-of-process ACP child for an isolated one, in the same runtime.
+Multiple providers may coexist under different names. This lets a deployment expose, for example, a cheap in-process child and an isolated ACP child without changing the service contract.
 
-## Service API (`ctx.subagents`)
+## Service API
 
-| Member | Semantics |
+`SubagentService` has four main operations:
+
+| Member | Meaning |
 |---|---|
-| `registerProvider(provider)` | Register a frozen acceptance snapshot under `provider.name`; later caller mutation cannot change registry behavior or HMR cleanup, while `start` stays bound to the original provider receiver. Throws `SubagentError('DUPLICATE_PROVIDER')` on a name clash. Effect-scoped (HMR-safe); returns the disposer. |
-| `getProvider(name)` | Look up the frozen registry snapshot (`undefined` if absent). |
-| `list()` | Registered provider names (insertion order). |
-| `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), validate every requested START-TIME capability (`UNSUPPORTED_CAPABILITY` for the first unmet one — before any child is created), then delegate to `provider.start`. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. |
+| `registerProvider(provider)` | Register one trusted same-process implementation by name. Registration is effect-scoped; removing it prevents new starts but does not revoke runs already returned to callers. Duplicate names fail loud. |
+| `getProvider(name)` | Return the provider, or `undefined` when absent. |
+| `list()` | Return provider names in insertion order. |
+| `start(name, request)` | Validate requested capabilities and semantic values, then await the provider until a real child is ready. Fulfillment returns a holder-owned `SubagentRun`; rejection means the provider has already cleaned every partial startup resource. |
 
-## Capabilities: two kinds, discovered two ways
+`SubagentStartRequest.signal` is required and is the canonical cancellation channel. An abort before publication makes `start()` reject after rollback; an abort after publication cancels the live child. The request may also select a model, require structured output, cap delegation depth, restrict child tools, or set a child persona.
 
-- **Start-time features** (`outputSchema`, `depthLimit`, `toolFilter/persona`) are a static `provider.capabilities` descriptor, checked by the service BEFORE a run exists. A request that needs one the provider lacks is **rejected loud** (`UNSUPPORTED_CAPABILITY`), never accepted-then-ignored.
-- **Runtime features** (steering, resume) are **optional methods** on `SubagentRun` (`sendMessage?`, `resume?`). The method's presence IS the capability; TS narrowing is the discovery mechanism — a consumer cannot call an absent method without narrowing first, so there is no silent degradation path.
+Same-process requests, descriptors, results, and event payloads are trusted typed values borrowed as immutable. The service does not clone or freeze them; serialization and hostile-input validation belong at actual process, worker, persistence, and model boundaries.
 
-Beside `capabilities` sits one DESCRIPTIVE fact, not validated by the service: `provider.inheritsParentContext` — whether a child sees the parent conversation (`fork`: true — seeded with the completed-turn prefix; `spawn`/`acp`: false). The model-facing consumer (`dsh-tool-subagent`) derives truthful tool wording from it.
+## Capabilities
 
-## Run lifecycle
+Start-time features are advertised in `provider.capabilities` because the service must reject an unsupported request before child creation:
 
-`provider.start(request)` returns a `SubagentRun`: a handle with `started` (the publication/readiness promise), `result` (the terminal outcome), `cancel()`, `dispose()`, and the optional runtime methods. `started` resolves only after the provider has established a real child and rejects if the attempt fails or is cancelled first. `result` resolves with a `SubagentResult` (`output`, optional `structured`, `stopReason`) — it does **not** reject on a child-level failure (a model/transport failure resolves with `stopReason: 'error'`), so the consumer maps a non-`completed` reason to an `isError` tool result. The consumer MUST `dispose()` on every path (success, error, abort) to reach child quiescence and avoid leaking an idle child / session.
+- `outputSchema` — enforce a structured final result.
+- `depthLimit` — enforce `maxDepth`.
+- `toolFilter` — apply the requested child tool restriction.
+- `persona` — apply a per-child persona.
 
-The service also announces provider lifecycle: `subagent/provider-added` (the frozen registry snapshot) fires after a registration and `subagent/provider-removed` (the accepted name) after an unregistration, so a consumer deriving state from a named provider (the model-facing tool wording) mirrors registry membership instead of assuming load order — the cordis Loader starts sibling plugins concurrently, so "listed earlier" does not mean "registered earlier". Run lifecycle is gated by provider readiness: `subagent/start` (payload `SubagentRunInfo`) fires only after `run.started` fulfills, and `subagent/end` (payload `SubagentRunEndInfo`) fires only for that announced run; readiness rejection emits neither. For spawn/fork, the start listener can resolve the published child via `ctx.agents.get(info.id)`; a remote provider need not have a local registry entry. Both events are **observe-only** plain emits. The service observes `result` immediately even while readiness is pending, clones its output before the caller can mutate it, and buffers that end payload until start has fired; a rejecting result cannot become an unhandled detached promise, start always precedes end, and a listener cannot corrupt the caller's result. `subagent/end` carries the cloned output as `lastAssistantMessage` on the settle path and omits it on infrastructure rejection. Any run-affecting decision is out of scope for this observe-only surface.
+Runtime features are optional methods on `SubagentRun`: `sendMessage?` steers a live child, while `resume?` asynchronously creates a continuation run. Method presence is the capability check.
+
+`inheritsParentContext` is descriptive rather than enforceable. It says only whether the child sees completed parent conversation history (`fork` does; `spawn` and ACP do not), not whether it inherits tools, services, or authority.
+
+## Ownership and lifecycle
+
+`provider.start(request): Promise<SubagentRun>` is the ownership-transfer boundary. Before fulfillment, the provider owns setup and must cancel, roll back, and quiesce partial resources on every failure. After fulfillment, the caller owns the run and must call `dispose()` on every path.
+
+`SubagentRun.result` resolves to `{ output, structured?, stopReason }`. Child-level failures resolve with a non-`completed` reason; only an infrastructure fault that the seam cannot represent may reject. `dispose()` is idempotent, cancels remaining work, and waits for the child resources to quiesce.
+
+The service emits `subagent/start` only after `start()` has fulfilled. It attaches the result observer before that synchronous notification, so even an already-settled child still produces `subagent/start` before `subagent/end`. In-process start observers can resolve the published child through `ctx.agents.get(info.id)`; remote providers need not publish a local agent.
+
+Run events are scoped to the delegating parent. Every listener is independently contained: a synchronous throw or rejected returned promise is logged without starving peer listeners or changing the run.
+
+Provider additions and removals also emit `subagent/provider-added` and `subagent/provider-removed`. Consumers such as the model-facing tool use those events because Cordis may load sibling plugins concurrently; configuration order does not prove registration order.
+
+## Collection model
+
+The current model-facing tool collects synchronously: it awaits the child result and disposes the run before returning. Background collection and polling remain outside this seam. See the [capability-seam RFC](../../../docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md) and `src/types.ts` for the complete contracts.
 
 ## Known Limitations and Deferred Work
 
-- **The consumer collects synchronously** — it starts a run and awaits `result`; steering (`sendMessage`) is part of the contract but intentionally unused, and background / poll / spill semantics are deferred to a future redesign unifying long-running-tool handling across subagents and bash ([the seam RFC](../../../docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md)).
-- **The lifecycle events are observe-only** — a run-affecting `subagent/end` (an awaited continuation/decision surface) is deferred until a consumer needs one (`FIXME(subagent-continuation)`).
-
-See `src/types.ts` for the full contracts.
+- **The current consumer collects synchronously** — the model-facing tool starts a run and awaits `result`; steering (`sendMessage`) is part of the seam but intentionally unused, and background/poll/spill semantics are deferred to a future long-running-runtime design.
+- **The lifecycle events are observe-only** — a run-affecting `subagent/end` continuation or decision surface is deferred until a consumer needs one.
diff --git a/packages/subagent/subagent/src/index.ts b/packages/subagent/subagent/src/index.ts
index e1f4fac594..6332a0a458 100644
--- a/packages/subagent/subagent/src/index.ts
+++ b/packages/subagent/subagent/src/index.ts
@@ -1,41 +1,21 @@
 /**
  * The subagent seam (`ctx.subagents`): a named-provider registry plus a
- * capability-validating `start` surface. A subagent is an agent delegating
- * work to another agent; a {@link SubagentProvider} is one transport for
- * running that child (in-process spawn/fork, ACP to another process, and —
- * later — A2A, the Codex app-server, the Claude Code Agent SDK).
+ * capability-validating asynchronous start surface. Providers establish a
+ * child before returning its run, so fulfillment is the single publication and
+ * ownership-transfer boundary.
  *
- * Unlike the bash seam (one executor per context, second load throws), MULTIPLE
- * providers coexist here: each registers under a unique name and a caller picks
- * one by name. The shape mirrors the LLM adapter registry
- * (`LlmService.registerAdapter`), not the single-service bash executor.
- *
- * This package is the INTERFACE third of the capability seam. Implementations
- * (`@deepseek-ai/dsh-subagent-spawn`, `-fork`, `-acp`) and the model-facing
- * consumer (`@deepseek-ai/dsh-tool-subagent`) are separate packages.
- *
- * Scope (first cut): the consumer collects synchronously — it starts a run and
- * awaits {@link SubagentRun.result}. Steering ({@link SubagentRun.sendMessage})
- * is part of the contract but intentionally unused; background / poll / spill
- * semantics are deferred to a future redesign that unifies long-running-tool
- * handling across subagents and bash.
- *
- * The `subagent/start` / `subagent/end` lifecycle events carry an OBSERVE-ONLY
- * payload; `subagent/end` additionally carries the child's `lastAssistantMessage`
- * — see `docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md`.
- * FIXME(subagent-continuation): a control-flow `subagent/end` (an awaited
- * waterfall returning a stop/continue decision, like the other interception
- * seams) would require reshaping this emit into a waterfall, awaiting listeners
- * before settling, and a `resume` capability on the in-process provider — part
- * of the deferred background/steering redesign, NOT this observe-only cut.
+ * Same-process providers are trusted typed collaborators. Requests, provider
+ * descriptors, results, and lifecycle payloads are borrowed immutable values;
+ * serialization and hostile-input validation belong at real process, worker,
+ * persistence, and model boundaries.
  *
  * @module @deepseek-ai/dsh-subagent
  */
 
 import { Context, Service } from 'cordis'
 import { scopeTarget } from '@deepseek-ai/dsh-scope'
-import { assertSupportedOutputSchema } from '@deepseek-ai/dsh-tools'
 import type { Scoped } from '@deepseek-ai/dsh-scope'
+import { assertSupportedOutputSchema } from '@deepseek-ai/dsh-tools'
 import { HarnessError } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
 import type { Agent, AgentId } from '@deepseek-ai/dsh-agent'
@@ -57,6 +37,21 @@ export type {
   SubagentStopReasonMap,
 } from './types.ts'
 
+/**
+ * Reject a recursion cap that cannot represent an exact delegation depth.
+ * @param maxDepth - the optional runtime value to validate.
+ */
+export function assertSubagentMaxDepth(maxDepth: unknown): void {
+  if (maxDepth !== undefined && (
+    typeof maxDepth !== 'number'
+    || !Number.isSafeInteger(maxDepth)
+    || maxDepth < 0
+    || Object.is(maxDepth, -0)
+  )) {
+    throw new TypeError('subagent maxDepth must be a non-negative safe integer')
+  }
+}
+
 declare module 'cordis' {
   interface Context {
     subagents: SubagentService
@@ -64,88 +59,59 @@ declare module 'cordis' {
 
   interface Events {
     /**
-     * A provider became resolvable in the {@link SubagentService} registry.
-     * Consumers that derive state from a named provider (e.g. the model-facing
-     * tool wording in `dsh-tool-subagent`) react HERE instead of assuming load
-     * order — the cordis Loader starts sibling plugins concurrently, so
-     * "listed earlier in cordis.yml" does not mean "registered earlier".
-     * @param provider - the registry's frozen acceptance snapshot of the provider.
+     * A provider became resolvable in the registry.
+     * @param provider - the registered provider.
      * @mode emit
      */
     'subagent/provider-added'(provider: SubagentProvider): void
     /**
-     * A provider left the registry (its plugin's fiber was disposed — an
-     * unload or an HMR reload). Consumers holding provider-derived state drop
-     * it here; a reload re-fires `subagent/provider-added` with the fresh
-     * provider. Delivered with per-listener containment: a throwing
-     * subscriber is logged, never starves later subscribers, and never
-     * disrupts the provider's teardown.
-     * @param name - the registry name that no longer resolves.
+     * A provider left the registry. Accepted runs remain holder-owned.
+     * @param name - the provider name that no longer resolves.
      * @mode emit
      */
     'subagent/provider-removed'(name: string): void
     /**
-     * A subagent run started — emitted only after {@link SubagentRun.started}
-     * fulfills, when the provider has established a live child. For an
-     * in-process provider, `ctx.agents.get(info.id)` is therefore guaranteed to
-     * resolve during this notification. A readiness rejection emits neither
-     * lifecycle event; every emitted start is paired with
-     * {@link Events['subagent/end']}.
-     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed
-     * by the DELEGATING PARENT — a listener registered through the parent's
-     * `agent.ctx` observes only its own delegations; a plain plugin listener
-     * observes every run.
-     * @param info - which provider started which child agent.
+     * A provider established a ready child. For in-process providers,
+     * `ctx.agents.get(info.id)` resolves during this notification.
+     * Scope-filtered dispatch keys the carrier by the delegating parent, so a
+     * parent-scoped listener observes only its own delegations. Paired with
+     * `subagent/end`.
+     * @param info - the provider and ready child identity.
      * @mode emit
      */
     'subagent/start'(this: Scoped<SubagentService>, info: SubagentRunInfo): void
     /**
-     * A started subagent run settled — emitted when {@link SubagentRun.result}
-     * resolves (any stop reason) or rejects (reported as `error`). Paired with
-     * {@link Events['subagent/start']}; a run whose readiness rejected emits
-     * neither event.
-     * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed
-     * by the DELEGATING PARENT — a listener registered through the parent's
-     * `agent.ctx` observes only its own delegations; a plain plugin listener
-     * observes every run.
-     * @param info - the run identity plus stop reason and final output.
+     * A ready child settled. Scope-filtered dispatch uses the same delegating
+     * parent carrier as `subagent/start`, so the lifecycle pair reaches the
+     * same scoped audience.
+     * @param info - the run identity and terminal outcome.
      * @mode emit
      */
     'subagent/end'(this: Scoped<SubagentService>, info: SubagentRunEndInfo): void
   }
 }
 
-/** Identifying detail for a started subagent run (the `subagent/start` payload). */
+/** Observe-only identifying detail for a ready subagent run. */
 export interface SubagentRunInfo {
-  /** The provider that started the run. */
-  provider: string
+  /** The provider that established the run. */
+  readonly provider: string
   /** The child agent's id. */
-  id: AgentId
+  readonly id: AgentId
 }
 
-/** Outcome detail for a settled subagent run (the `subagent/end` payload). */
+/** Observe-only outcome detail for a settled subagent run. */
 export interface SubagentRunEndInfo {
   /** The provider that ran it. */
-  provider: string
+  readonly provider: string
   /** The child agent's id. */
-  id: AgentId
+  readonly id: AgentId
   /** The terminal stop reason. */
-  stopReason: SubagentResult['stopReason']
-  /**
-   * The child's final assistant output ({@link SubagentResult.output}), carried
-   * onto the end event so an observer sees WHAT the subagent produced without
-   * holding the run. Absent when the run rejected at the infrastructure level
-   * (no {@link SubagentResult} was produced — the seam only knows `stopReason:
-   * 'error'`).
-   */
-  lastAssistantMessage?: ContentBlock[]
+  readonly stopReason: SubagentResult['stopReason']
+  /** The child's final assistant output, absent on infrastructure rejection. */
+  readonly lastAssistantMessage?: ContentBlock[]
 }
 
-/**
- * Typed error for subagent-seam failures. Extends {@link HarnessError}, so the
- * `code` string (`DUPLICATE_PROVIDER`, `NO_PROVIDER`, `UNSUPPORTED_CAPABILITY`)
- * is shared, machine-routable taxonomy.
- */
+/** Typed error for provider lookup, registration, and capability failures. */
 export class SubagentError extends HarnessError {
   constructor(message: string, code: string, options?: ErrorOptions) {
     super(message, code, options)
@@ -153,10 +119,7 @@ export class SubagentError extends HarnessError {
   }
 }
 
-/**
- * The `subagents` service: a registry of named {@link SubagentProvider}s and a
- * capability-checked {@link start} surface.
- */
+/** Named provider registry and capability-checked start surface. */
 export class SubagentService extends Service {
   private providers = new Map<string, SubagentProvider>()
 
@@ -165,202 +128,88 @@ export class SubagentService extends Service {
   }
 
   /**
-   * Register a provider under its `provider.name`. Throws {@link SubagentError}
-   * (`DUPLICATE_PROVIDER`) if the name is already taken. The registry snapshots
-   * the name, static descriptors, and `start` callback identity at acceptance;
-   * later caller mutation cannot change lookup, capability validation, consumer
-   * wording, dispatch, or HMR cleanup. The callback remains bound to the
-   * original provider object, so provider-owned mutable state stays live.
-   * Effect-scoped: disposed with the calling fiber (HMR-safe). Emits
-   * `subagent/provider-added` after the registration and
-   * `subagent/provider-removed` on unregistration, so consumers can mirror
-   * provider lifecycle instead of assuming load order.
-   * @param provider - the provider; its `name` is the registry key.
-   * @returns the disposer that unregisters the provider. The exact
-   *   Cordis effect disposer (single-shot): composite (generator) effects may
-   *   yield it directly — exact identity nests the teardown in order.
+   * Register a provider under its name. Registration is effect-scoped and HMR
+   * safe; removing a provider blocks new starts but does not revoke runs that
+   * were already returned to their holders.
+   * @param provider - the trusted provider implementation.
+   * @returns the exact Cordis effect disposer.
    */
   registerProvider(provider: SubagentProvider): () => Promise<void> | void {
-    // Snapshot the accepted registration contract before entering the effect.
-    // Cleanup must never re-read caller-owned `provider.name`: an HMR host may
-    // mutate or reuse the provider object before its old fiber unloads. Binding
-    // preserves the provider method's receiver while making replacement of the
-    // public callback field after registration inert.
-    const capabilities: SubagentCapabilities = Object.freeze({
-      outputSchema: provider.capabilities.outputSchema,
-      depthLimit: provider.capabilities.depthLimit,
-      toolFilter: provider.capabilities.toolFilter,
-      persona: provider.capabilities.persona,
-    })
-    const snapshot: SubagentProvider = Object.freeze({
-      name: provider.name,
-      capabilities,
-      inheritsParentContext: provider.inheritsParentContext,
-      start: provider.start.bind(provider),
-    })
-    const dispose = this.ctx.effect(function* (this: SubagentService) {
-      if (this.providers.has(snapshot.name)) {
-        throw new SubagentError(`a subagent provider named "${snapshot.name}" is already registered`, 'DUPLICATE_PROVIDER')
+    const name = provider.name
+    return this.ctx.effect(function* (this: SubagentService) {
+      if (this.providers.has(name)) {
+        throw new SubagentError(`a subagent provider named "${name}" is already registered`, 'DUPLICATE_PROVIDER')
       }
-      this.providers.set(snapshot.name, snapshot)
-      // Yield the rollback BEFORE emitting `subagent/provider-added`: a
-      // throwing added-listener then unregisters the provider (and announces
-      // the removal) instead of leaking it into the registry. The removal
-      // announcement itself is contained PER LISTENER ({@link emitLifecycle}):
-      // it runs inside this disposer, where a propagating subscriber would
-      // disrupt the backend fiber's teardown and starve later mirrors.
+      this.providers.set(name, provider)
       yield () => {
-        this.providers.delete(snapshot.name)
-        this.emitLifecycle('subagent/provider-removed', snapshot.name)
+        this.providers.delete(name)
+        this.emitLifecycle('subagent/provider-removed', name)
       }
-      this.ctx.emit('subagent/provider-added', snapshot)
+      // A throwing added-listener unwinds the yielded rollback, matching the
+      // repository's fail-loud registration semantics.
+      this.ctx.emit('subagent/provider-added', provider)
     }.bind(this), 'subagents.registerProvider()')
-    // The EXACT cordis effect disposer, not a wrapper: a composite (generator)
-    // effect that owns a teardown ORDER must be able to yield THIS function —
-    // cordis nests a disposer out of the fiber's concurrent sibling list by
-    // exact function identity, so a wrapper would silently break the nesting
-    // (the agents.register() lesson). Fire-and-forget callers may still
-    // discard the (always-resolved) promise.
-    return dispose
   }
 
   /**
-   * Look up the registry's frozen provider snapshot by its accepted name
-   * (`undefined` if absent).
-   * @param name - the provider name accepted at registration.
-   * @returns the frozen acceptance snapshot, or undefined when the name is unknown.
+   * Look up a provider by name.
+   * @param name - the provider name.
+   * @returns the provider, or undefined when absent.
    */
   getProvider(name: string): SubagentProvider | undefined {
     return this.providers.get(name)
   }
 
   /**
-   * The names of all registered providers (insertion order).
-   * @returns the registered provider names.
+   * List registered provider names in insertion order.
+   * @returns the registered names.
    */
   list(): string[] {
     return [...this.providers.keys()]
   }
 
   /**
-   * Start a subagent run on the named provider. Resolves the provider (throws
-   * `NO_PROVIDER` if absent), validates every requested START-TIME capability
-   * against {@link SubagentProvider.capabilities} (throws `UNSUPPORTED_CAPABILITY`
-   * for the first unmet one — fail loud, before any child is created), then
-   * delegates to {@link SubagentProvider.start}, then emits `subagent/start` /
-   * `subagent/end` only after the run's readiness boundary fulfills. A provider
-   * that fails before establishing a child emits neither event.
-   * @param name - the provider to run on.
-   * @param request - the child's prompt, capabilities, and options.
-   * @returns the live run (its `result` resolves when the child settles).
+   * Establish a ready child on the named provider. Capability and semantic
+   * checks run before delegation. Provider ownership lasts until its promise
+   * fulfills; a rejection therefore has no run for the caller to dispose and
+   * emits no run lifecycle events.
+   * @param name - the provider to use.
+   * @param request - child prompt, parent, signal, and optional capabilities.
+   * @returns the ready holder-owned run.
    */
-  start(name: string, request: SubagentStartRequest): SubagentRun {
-    // Parent is the lifecycle scope identity accepted at start. Never reread it
-    // from the caller-owned request after the provider/result async boundary,
-    // or start/end could be dispatched into different agent scopes.
-    const parent = request.parent
+  async start(name: string, request: SubagentStartRequest): Promise<SubagentRun> {
     const provider = this.providers.get(name)
-    if (!provider) {
+    if (provider === undefined) {
       throw new SubagentError(`no subagent provider registered for "${name}"`, 'NO_PROVIDER')
     }
     this.assertCapabilities(provider, request)
+    assertSubagentMaxDepth(request.maxDepth)
     if (request.outputSchema !== undefined) assertSupportedOutputSchema(request.outputSchema)
 
-    // Detach every data field before crossing into a provider. Parent/signal
-    // are live identity capabilities and stay exact; the mutable request record
-    // and its arrays/objects are never retained, so every backend (including an
-    // async out-of-process one) observes the request accepted at start.
-    const accepted: SubagentStartRequest = {
-      prompt: structuredClone(request.prompt),
-      parent,
-      ...request.signal !== undefined ? { signal: request.signal } : {},
-      ...request.agentOptions !== undefined ? { agentOptions: structuredClone(request.agentOptions) } : {},
-      ...request.outputSchema !== undefined ? { outputSchema: structuredClone(request.outputSchema) } : {},
-      ...request.maxDepth !== undefined ? { maxDepth: request.maxDepth } : {},
-      ...request.toolFilter !== undefined ? { toolFilter: structuredClone(request.toolFilter) } : {},
-      ...request.persona !== undefined ? { persona: request.persona } : {},
-    }
-    const run = provider.start(accepted)
-
-    // Observe result settlement IMMEDIATELY, before waiting on readiness. A
-    // provider may fail both promises in the same turn; deferring the rejection
-    // handler until `started` fulfilled would leave `result` transiently
-    // unhandled. The settled event is buffered until start has been announced,
-    // preserving start → end order even for an already-settled scripted run.
-    let readiness: 'pending' | 'started' | 'failed' = 'pending'
-    let pendingEnd: SubagentRunEndInfo | undefined
-    const deliverEnd = (info: SubagentRunEndInfo): void => {
-      if (readiness === 'started') this.emitLifecycle('subagent/end', info, parent)
-      else if (readiness === 'pending') pendingEnd = info
-      // A pre-publication readiness failure has no lifecycle pair; result
-      // remains observable by the run's consumer, but telemetry must not claim
-      // that a child started.
-    }
+    const parent = request.parent
+    const run = await provider.start(request)
+    // Attach the terminal observer before dispatching start. Promise reactions
+    // still run after this synchronous start emission, preserving start → end.
     void run.result.then(
       (result) => {
-        // Snapshot before the caller's own `await run.result` continuation. Even
-        // when readiness is still pending, buffering the clone rather than the
-        // caller-owned result keeps the eventual observe-only event immutable
-        // with respect to consumer mutation.
-        let lastAssistantMessage: SubagentResult['output'] | undefined
-        try {
-          lastAssistantMessage = structuredClone(result.output)
-        } catch (error: unknown) {
-          this.ctx.logger.warn(`subagent: could not clone ${name} output for subagent/end: ${String(error)}`)
-        }
-        deliverEnd({
+        this.emitLifecycle('subagent/end', {
           provider: name,
           id: run.id,
           stopReason: result.stopReason,
-          ...lastAssistantMessage !== undefined ? { lastAssistantMessage } : {},
-        })
-      },
-      () => { deliverEnd({ provider: name, id: run.id, stopReason: 'error' }) },
-    )
-
-    // Readiness is the publication boundary owned by the provider. For
-    // in-process runs, fulfillment means the agent registry already contains
-    // `run.id`; for ACP it means the remote session exists. Emit start with
-    // per-listener containment, then flush an outcome that settled unusually
-    // early. A readiness rejection is handled here and deliberately emits no
-    // false start/end pair; the result path above remains independently handled.
-    void run.started.then(
-      () => {
-        readiness = 'started'
-        this.emitLifecycle('subagent/start', { provider: name, id: run.id }, parent)
-        if (pendingEnd !== undefined) {
-          const info = pendingEnd
-          pendingEnd = undefined
-          this.emitLifecycle('subagent/end', info, parent)
-        }
+          lastAssistantMessage: result.output,
+        }, parent)
       },
       () => {
-        readiness = 'failed'
-        pendingEnd = undefined
+        this.emitLifecycle('subagent/end', { provider: name, id: run.id, stopReason: 'error' }, parent)
       },
     )
+    this.emitLifecycle('subagent/start', { provider: name, id: run.id }, parent)
     return run
   }
 
   /**
-   * Emit a `subagent/*` lifecycle event with PER-LISTENER containment: dispatch
-   * each subscriber individually and log (never propagate) a thrown one, so one
-   * bad subscriber can neither strand the already-live run, surface as an
-   * unhandled rejection on the detached settle hook, NOR starve the listeners
-   * registered after it. A single try/catch around `ctx.emit` would not do the
-   * last part — cordis `emit` runs listeners in a `.map(cb => cb())` that halts
-   * on the first throw — so this resolves the listener callbacks via
-   * `ctx.events.dispatch` and contains each call, the same guarantee
-   * `BashExecutor.notifyTaskDone` gives its own listener set.
-   *
-   * `subagent/provider-removed` routes through here too: it fires inside the
-   * provider registration's DISPOSER, where a propagating listener would
-   * disrupt the backend fiber's teardown (dispose must reach quiescence) and a
-   * starved later listener would leave a mirror consumer (`dsh-tool-subagent`)
-   * holding a tool for a provider that no longer exists. `subagent/provider-added`
-   * deliberately does NOT: it fires at registration time, where a throwing
-   * listener unwinds the yielded rollback — the same fail-loud register-time
-   * semantics as the system-prompt registries.
+   * Emit lifecycle events with per-listener synchronous and asynchronous
+   * exception containment. Payloads are borrowed immutable values.
    */
   private emitLifecycle(name: 'subagent/start', info: SubagentRunInfo, parent: Agent): void
   private emitLifecycle(name: 'subagent/end', info: SubagentRunEndInfo, parent: Agent): void
@@ -370,27 +219,22 @@ export class SubagentService extends Service {
     info: SubagentRunInfo | SubagentRunEndInfo | string,
     parent?: Agent,
   ): void {
-    // Run lifecycle events dispatch in the DELEGATING PARENT's scope (a
-    // parent-scoped listener observes only its own delegations); the
-    // provider-removed registry notification stays unfiltered. The carrier is
-    // args[0] of the dispatch call, exactly as cordis' own emit spells it.
     const dispatchArgs: unknown[] = parent === undefined
       ? [name, info]
       : [scopeTarget(this, parent), name, info]
     for (const callback of this.ctx.events.dispatch('emit', dispatchArgs)) {
       try {
-        callback(info)
+        const returned: unknown = callback(info)
+        void Promise.resolve(returned).catch((error: unknown) => {
+          this.ctx.logger.warn(`subagent: ${name} listener rejected: ${renderThrown(error)}`)
+        })
       } catch (error: unknown) {
-        this.ctx.logger.warn(`subagent: ${name} listener threw: ${String(error)}`)
+        this.ctx.logger.warn(`subagent: ${name} listener threw: ${renderThrown(error)}`)
       }
     }
   }
 
-  /**
-   * Reject a request that needs a start-time capability the provider lacks.
-   * Each optional request field maps to one {@link SubagentCapabilities} flag;
-   * the first unmet one throws `UNSUPPORTED_CAPABILITY`.
-   */
+  /** Reject the first requested capability that the provider lacks. */
   private assertCapabilities(provider: SubagentProvider, request: SubagentStartRequest): void {
     const needs: { when: boolean; cap: keyof SubagentCapabilities }[] = [
       { when: request.outputSchema !== undefined, cap: 'outputSchema' },
@@ -409,4 +253,13 @@ export class SubagentService extends Service {
   }
 }
 
+/** Render any listener-thrown value without letting coercion escape containment. */
+function renderThrown(value: unknown): string {
+  try {
+    return value instanceof Error ? `${value.name}: ${value.message}` : String(value)
+  } catch {
+    return '<unrenderable thrown value>'
+  }
+}
+
 export default SubagentService
diff --git a/packages/subagent/subagent/src/types.ts b/packages/subagent/subagent/src/types.ts
index 003d6a6a3d..f08d8a0622 100644
--- a/packages/subagent/subagent/src/types.ts
+++ b/packages/subagent/subagent/src/types.ts
@@ -8,7 +8,7 @@
 
 import type { Agent, AgentId, AgentOptions } from '@deepseek-ai/dsh-agent'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
-import type { StructuredOutputSchema } from '@deepseek-ai/dsh-tools'
+import type { StructuredOutputSchema, ToolRestriction } from '@deepseek-ai/dsh-tools'
 
 /**
  * Which START-TIME features a provider supports. Checked by the service
@@ -24,13 +24,13 @@ import type { StructuredOutputSchema } from '@deepseek-ai/dsh-tools'
  */
 export interface SubagentCapabilities {
   /** Honor {@link SubagentStartRequest.outputSchema} (structured final output). */
-  outputSchema: boolean
+  readonly outputSchema: boolean
   /** Enforce {@link SubagentStartRequest.maxDepth} (recursion cap). */
-  depthLimit: boolean
+  readonly depthLimit: boolean
   /** Enforce {@link SubagentStartRequest.toolFilter} (child tool scoping). */
-  toolFilter: boolean
+  readonly toolFilter: boolean
   /** Honor {@link SubagentStartRequest.persona} (a per-child persona). */
-  persona: boolean
+  readonly persona: boolean
 }
 
 /**
@@ -41,22 +41,24 @@ export interface SubagentCapabilities {
  */
 export interface SubagentStartRequest {
   /** The task/prompt for the child agent (a user message in the child session). */
-  prompt: ContentBlock[]
+  readonly prompt: ContentBlock[]
   /**
    * The spawning ("parent") agent — the one whose tool call started this
    * subagent. REQUIRED: in-process backends read `parent.session.header` for
    * the working directory, the `parentSession` lineage to stamp on the child,
    * and the parent's delegation depth. Out-of-process backends (ACP) ignore it.
    */
-  parent: Agent
+  readonly parent: Agent
   /**
    * Cancellation signal from the spawning context (the tool's `exec.signal`).
-   * A provider that honors it aborts the child when the signal fires; the
-   * consumer also bridges it to {@link SubagentRun.cancel} explicitly.
+   * This is the canonical cancellation channel both before and after startup:
+   * a provider rejects `start()` after cleaning partial resources when it
+   * fires before publication, and cancels a published child when it fires
+   * afterward.
    */
-  signal?: AbortSignal
+  readonly signal: AbortSignal
   /** Per-child agent options (model, system prompt). */
-  agentOptions?: AgentOptions
+  readonly agentOptions?: AgentOptions
   /**
    * Optional structured-output schema — an object-rooted JSON Schema within the
    * enforced subset (see `assertSupportedOutputSchema` in dsh-tools; a schema
@@ -67,12 +69,14 @@ export interface SubagentStartRequest {
    * data — a caller holding foreign-realm data materializes it first.
    * Requesting it against a provider that lacks the capability is rejected at start.
    */
-  outputSchema?: StructuredOutputSchema
+  readonly outputSchema?: StructuredOutputSchema
   /**
-   * Optional recursion cap (max delegation depth below this child). Requires
-   * {@link SubagentCapabilities.depthLimit}; rejected at start otherwise.
+   * Optional absolute delegation-depth cap for the child being started: its
+   * computed depth must be less than or equal to this non-negative safe
+   * integer. Requires {@link SubagentCapabilities.depthLimit}; rejected at
+   * start otherwise.
    */
-  maxDepth?: number
+  readonly maxDepth?: number
   /**
    * Optional child tool scoping. Requires {@link SubagentCapabilities.toolFilter};
    * rejected at start otherwise. In-process backends apply it as a scoped
@@ -80,7 +84,7 @@ export interface SubagentStartRequest {
    * from the child's prompt AND refuse to execute (one visibility), with loud
    * unknown-name validation.
    */
-  toolFilter?: { allow?: string[]; deny?: string[] }
+  readonly toolFilter?: ToolRestriction
   /**
    * Optional per-child persona. Requires {@link SubagentCapabilities.persona};
    * rejected at start otherwise. In-process backends register it as a scoped
@@ -88,7 +92,7 @@ export interface SubagentStartRequest {
    * persona for this child alone — same template semantics as the deployment
    * persona (strict `{{…}}` interpolation against the registered variables).
    */
-  persona?: string
+  readonly persona?: string
 }
 
 /**
@@ -100,7 +104,7 @@ export interface SubagentStartRequest {
 export interface SubagentStopReasonMap {
   /** The child finished its turn normally. */
   completed: 'completed'
-  /** The run was cancelled (parent signal, explicit `cancel()`, or peer cancel). */
+  /** The run was cancelled by its request signal or by disposal. */
   aborted: 'aborted'
   /** The child failed (model error, transport error). */
   error: 'error'
@@ -118,7 +122,7 @@ export type SubagentStopReason = SubagentStopReasonMap[keyof SubagentStopReasonM
  */
 export interface SubagentResult {
   /** The child's final assistant output (the last assistant message's content). */
-  output: ContentBlock[]
+  readonly output: ContentBlock[]
   /**
    * The structured result after a requested `outputSchema` was successfully
    * satisfied. Requesting a schema does not guarantee presence: a provider can
@@ -126,32 +130,24 @@ export interface SubagentResult {
    * valid capture. Shape is validated against the request schema by the
    * provider; `unknown` here because the seam is schema-agnostic.
    */
-  structured?: unknown
+  readonly structured?: unknown
   /** Why the run ended. A non-`completed` reason means `output` may be partial. */
-  stopReason: SubagentStopReason
+  readonly stopReason: SubagentStopReason
 }
 
 /**
  * A live subagent run: a handle the consumer holds while a child executes.
- * Returned by {@link SubagentProvider.start} (via the service). The consumer
- * awaits {@link result}, may {@link cancel} mid-flight, and MUST {@link dispose}
- * on every path to reach child quiescence (no leaked idle child / session).
+ * Returned by {@link SubagentProvider.start} (via the service) only after the
+ * child is ready. The consumer awaits {@link result} and MUST {@link dispose}
+ * on every path to cancel any remaining work and reach child quiescence.
  *
  * {@link sendMessage} and {@link resume} are OPTIONAL: a provider that supports
  * the runtime capability defines the method; one that doesn't omits it. The
  * presence of the method IS the capability — narrow before calling.
  */
 export interface SubagentRun {
-  /** The child agent's id (local in-process runs publish it in `ctx.agents`; remote transports need not). */
+  /** The child agent's id (local in-process runs are already published in `ctx.agents`; remote transports need not publish locally). */
   readonly id: AgentId
-  /**
-   * The provider's publication/readiness boundary. Resolves only after a real
-   * child is established: an in-process agent is live in `ctx.agents`, or a
-   * remote transport has created its child session. Rejects when the attempt
-   * fails or is cancelled before that boundary. The service emits the paired
-   * `subagent/start`/`subagent/end` lifecycle only after this fulfills.
-   */
-  readonly started: Promise<void>
   /**
    * Resolves with the child's terminal {@link SubagentResult} when the run
    * settles. Does NOT reject on a child-level failure — a model/transport
@@ -160,12 +156,10 @@ export interface SubagentRun {
    * cannot represent as a stop reason.
    */
   readonly result: Promise<SubagentResult>
-  /** Request cancellation of the in-flight run; {@link result} settles `aborted`. */
-  cancel(reason?: string): void
   /**
-   * Reach child quiescence and release the run's resources (in-process: dispose
-   * the owned agent handle and remove its session; ACP: kill the subprocess).
-   * Idempotent; awaits the child actually stopping, not merely requesting it.
+   * Cancel remaining work, reach child quiescence, and release the run's
+   * resources (in-process: dispose the owned agent and remove its session;
+   * ACP: kill and reap the subprocess). Idempotent.
    */
   dispose(): Promise<void>
   /**
@@ -177,7 +171,7 @@ export interface SubagentRun {
    * OPTIONAL (resume capability): send a follow-up task to a settled child,
    * continuing its session, and return a fresh run for the continuation.
    */
-  resume?(content: ContentBlock[]): SubagentRun
+  resume?(content: ContentBlock[]): Promise<SubagentRun>
 }
 
 /**
@@ -185,8 +179,8 @@ export interface SubagentRun {
  * spawn/fork, ACP to another process, …). Implementations register under a
  * unique name via {@link SubagentService.registerProvider}; multiple providers
  * coexist in one context (unlike the single-implementation bash seam). The
- * service freezes the public descriptor and callback identity at registration;
- * the captured `start` remains bound to the original provider receiver.
+ * Providers are trusted same-process implementations; callers treat their
+ * descriptors and returned values as borrowed immutable data.
  */
 export interface SubagentProvider {
   /** Unique registry name (e.g. `spawn`, `fork`, `acp`). */
@@ -194,22 +188,24 @@ export interface SubagentProvider {
   /** The start-time features this provider supports (see {@link SubagentCapabilities}). */
   readonly capabilities: SubagentCapabilities
   /**
-   * The provider's context contract: `true` when a child SEES the parent
+   * The provider's conversation-history descriptor: `true` when a child SEES the parent
    * conversation (fork — the child is seeded with the parent's completed-turn
    * prefix), `false` when it starts fresh (spawn, ACP). A DESCRIPTIVE fact,
    * not a start-time capability: the service validates nothing against it —
    * the model-facing consumer (`dsh-tool-subagent`) derives truthful tool
    * wording from it, so a tool bound to a fork provider stops telling the
-   * model the child "does not see this conversation".
+   * model the child "does not see this conversation". This descriptor concerns
+   * conversation history only; it says nothing about tool registrations,
+   * injected services, or authority inheritance.
    */
   readonly inheritsParentContext: boolean
   /**
-   * Start preparing a child run and return its handle synchronously. The
+   * Establish a child and return its handle only after publication. The
    * service has already validated that every requested start-time capability
    * is supported, so an implementation may assume e.g. `request.maxDepth` is
-   * honorable when present. The returned {@link SubagentRun.started} must mark
-   * the real publication/readiness boundary; the result path must observe that
-   * promise immediately so a pre-start rejection cannot become unhandled.
+   * honorable when present. If setup fails or `request.signal` aborts before
+   * fulfillment, the provider owns and cleans all partial resources before this
+   * promise rejects. Ownership transfers to the caller only on fulfillment.
    */
-  start(request: SubagentStartRequest): SubagentRun
+  start(request: SubagentStartRequest): Promise<SubagentRun>
 }
diff --git a/packages/subagent/subagent/tests/service.spec.ts b/packages/subagent/subagent/tests/service.spec.ts
index 7b9e828c37..23c2caf445 100644
--- a/packages/subagent/subagent/tests/service.spec.ts
+++ b/packages/subagent/subagent/tests/service.spec.ts
@@ -5,6 +5,7 @@ import { HarnessError } from '@deepseek-ai/dsh-llm'
 import { carrierKeyOf } from '@deepseek-ai/dsh-scope'
 import SubagentService, {
   SubagentError,
+  assertSubagentMaxDepth,
   type SubagentCapabilities,
   type SubagentProvider,
   type SubagentResult,
@@ -12,580 +13,218 @@ import SubagentService, {
   type SubagentStartRequest,
 } from '@deepseek-ai/dsh-subagent'
 
-/** A minimal parent Agent stand-in — the service only reads `parent.id`. */
 function fakeParent(id = 'parent-1'): Agent {
   return { id: AgentId(id) } as unknown as Agent
 }
 
-const ALL_CAPS: SubagentCapabilities = { outputSchema: true, depthLimit: true, toolFilter: true, persona: false }
+const ALL_CAPS: SubagentCapabilities = { outputSchema: true, depthLimit: true, toolFilter: true, persona: true }
 const NO_CAPS: SubagentCapabilities = { outputSchema: false, depthLimit: false, toolFilter: false, persona: false }
 
-/** A scripted provider whose run settles immediately with a fixed result. */
+function baseRequest(overrides: Partial<SubagentStartRequest> = {}): SubagentStartRequest {
+  return {
+    prompt: [{ type: 'text', text: 'do a thing' }],
+    parent: fakeParent(),
+    signal: new AbortController().signal,
+    ...overrides,
+  }
+}
+
 class StubProvider implements SubagentProvider {
-  startCount = 0
   readonly inheritsParentContext = false
+  startCount = 0
+
   constructor(
     readonly name: string,
     readonly capabilities: SubagentCapabilities = ALL_CAPS,
-    private readonly result: SubagentResult = { output: [{ type: 'text', text: 'ok' }], stopReason: 'completed' },
+    private readonly outcome: SubagentResult = {
+      output: [{ type: 'text', text: 'ok' }],
+      stopReason: 'completed',
+    },
   ) {}
 
-  start(request: SubagentStartRequest): SubagentRun {
-    this.startCount++
+  async start(request: SubagentStartRequest): Promise<SubagentRun> {
+    this.startCount += 1
     return {
       id: AgentId(`child:${this.name}:${request.parent.id}`),
-      started: Promise.resolve(),
-      result: Promise.resolve(this.result),
-      cancel() {},
+      result: Promise.resolve(this.outcome),
       async dispose() {},
     }
   }
 }
 
-function baseRequest(overrides: Partial<SubagentStartRequest> = {}): SubagentStartRequest {
-  return { prompt: [{ type: 'text', text: 'do a thing' }], parent: fakeParent(), ...overrides }
+async function service(): Promise<{ ctx: Context; subagents: SubagentService }> {
+  const ctx = new Context()
+  await ctx.plugin(SubagentService)
+  return { ctx, subagents: ctx.subagents }
 }
 
 describe('SubagentService', () => {
-  it('announces provider lifecycle: added on register, removed on dispose', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
+  it('registers, lists, looks up, starts, and removes providers', async () => {
+    const { ctx, subagents } = await service()
     const added: string[] = []
     const removed: string[] = []
     ctx.on('subagent/provider-added', provider => void added.push(provider.name))
     ctx.on('subagent/provider-removed', name => void removed.push(name))
-
-    const dispose = ctx.subagents.registerProvider(new StubProvider('alpha'))
-    expect(added).toEqual(['alpha'])
-    expect(removed).toEqual([])
-
-    await dispose()
-    expect(removed).toEqual(['alpha'])
-  })
-
-  it('rolls back the registration when a provider-added listener throws', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    let threw = false
-    const off = ctx.on('subagent/provider-added', () => {
-      if (!threw) { threw = true; throw new Error('boom added listener') }
-    })
-
-    expect(() => ctx.subagents.registerProvider(new StubProvider('alpha'))).toThrow('boom added listener')
-    expect(ctx.subagents.getProvider('alpha')).toBeUndefined() // nothing leaked
-
-    off()
-    ctx.subagents.registerProvider(new StubProvider('alpha'))
-    expect(ctx.subagents.getProvider('alpha')).toBeDefined()
-  })
-
-  it('contains a throwing provider-removed listener: later mirrors still hear it, teardown completes', async () => {
-    // provider-removed fires inside the registration's DISPOSER, so a
-    // propagating listener would disrupt the backend's teardown; and cordis
-    // emit halts on the first throw, so an uncontained one would starve every
-    // mirror registered after it (a stale model-facing tool). Both are
-    // prevented by per-listener containment.
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    const warnings: string[] = []
-    ctx.logger.warn = ((message: unknown) => void warnings.push(String(message))) as typeof ctx.logger.warn
-    ctx.on('subagent/provider-removed', () => { throw new Error('boom removed listener') })
-    const heard: string[] = []
-    ctx.on('subagent/provider-removed', name => void heard.push(name))
-
-    const dispose = ctx.subagents.registerProvider(new StubProvider('alpha'))
-    expect(() => void dispose()).not.toThrow()
-    expect(heard).toEqual(['alpha']) // the listener AFTER the thrower still ran
-    expect(ctx.subagents.getProvider('alpha')).toBeUndefined() // teardown reached quiescence
-    expect(warnings.some(w => w.includes('boom removed listener'))).toBe(true)
-  })
-
-  it('registers a provider and starts a run on it by name', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
     const provider = new StubProvider('alpha')
-    ctx.subagents.registerProvider(provider)
 
-    expect(ctx.subagents.list()).toEqual(['alpha'])
-    expect(ctx.subagents.getProvider('alpha')).toMatchObject({ name: 'alpha' })
-
-    const run = ctx.subagents.start('alpha', baseRequest())
-    expect(provider.startCount).toBe(1)
-    await expect(run.result).resolves.toMatchObject({ stopReason: 'completed' })
-  })
-
-  it('lets multiple providers coexist (the defining requirement)', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    ctx.subagents.registerProvider(new StubProvider('spawn'))
-    ctx.subagents.registerProvider(new StubProvider('acp'))
-
-    expect(ctx.subagents.list()).toEqual(['spawn', 'acp'])
-    expect(ctx.subagents.getProvider('spawn')).toBeDefined()
-    expect(ctx.subagents.getProvider('acp')).toBeDefined()
-  })
-
-  it('throws NO_PROVIDER when starting on an unregistered name', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    try {
-      ctx.subagents.start('missing', baseRequest())
-      expect.fail('expected NO_PROVIDER')
-    } catch (error: unknown) {
-      expect(error).toBeInstanceOf(SubagentError)
-      expect((error as SubagentError).code).toBe('NO_PROVIDER')
-    }
-  })
-
-  it('rejects duplicate provider names with DUPLICATE_PROVIDER', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    ctx.subagents.registerProvider(new StubProvider('dup'))
-    try {
-      ctx.subagents.registerProvider(new StubProvider('dup'))
-      expect.fail('expected DUPLICATE_PROVIDER')
-    } catch (error: unknown) {
-      expect(error).toBeInstanceOf(SubagentError)
-      expect((error as SubagentError).code).toBe('DUPLICATE_PROVIDER')
-    }
-  })
-
-  it('unregisters a provider when its owning fiber is disposed (HMR safety)', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-
-    const fiber = await ctx.plugin(Object.assign((inner: Context) => {
-      inner.subagents.registerProvider(new StubProvider('scoped'))
-    }, { inject: ['subagents'] }))
-    expect(ctx.subagents.list()).toEqual(['scoped'])
-
-    await fiber.dispose()
-    expect(ctx.subagents.list()).toEqual([])
-  })
-
-  it('snapshots a provider registration so caller mutation cannot corrupt dispatch or HMR cleanup', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    const capabilities: SubagentCapabilities = {
-      outputSchema: true,
-      depthLimit: true,
-      toolFilter: true,
-      persona: true,
-    }
-    const provider = new StubProvider('stable', capabilities)
-    const added: SubagentProvider[] = []
-    const removed: string[] = []
-    ctx.on('subagent/provider-added', registered => void added.push(registered))
-    ctx.on('subagent/provider-removed', name => void removed.push(name))
-    const owner = await ctx.plugin({
-      name: 'mutable-provider-owner',
-      inject: ['subagents'],
-      apply(pluginCtx: Context) {
-        pluginCtx.subagents.registerProvider(provider)
-      },
-    })
-    const accepted = ctx.subagents.getProvider('stable')
-
-    const mutable = provider as unknown as {
-      name: string
-      capabilities: SubagentCapabilities
-      inheritsParentContext: boolean
-      start: SubagentProvider['start']
-    }
-    mutable.name = 'mutated'
-    capabilities.outputSchema = false
-    capabilities.depthLimit = false
-    capabilities.toolFilter = false
-    capabilities.persona = false
-    mutable.capabilities = NO_CAPS
-    mutable.inheritsParentContext = true
-    const replacementStart = vi.fn((_request: SubagentStartRequest): SubagentRun => {
-      throw new Error('replacement start must not run')
-    })
-    mutable.start = replacementStart
-
-    expect(added).toEqual([accepted])
-    expect(accepted).not.toBe(provider)
-    expect(Object.isFrozen(accepted)).toBe(true)
-    expect(Object.isFrozen(accepted?.capabilities)).toBe(true)
-    expect(accepted).toMatchObject({
-      name: 'stable',
-      capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: true },
-      inheritsParentContext: false,
-    })
-    expect(ctx.subagents.list()).toEqual(['stable'])
-    expect(ctx.subagents.getProvider('mutated')).toBeUndefined()
-
-    const run = ctx.subagents.start('stable', baseRequest({
-      outputSchema: { type: 'object', properties: { answer: { type: 'string' } } },
-      maxDepth: 2,
-      toolFilter: { deny: ['bash'] },
-      persona: 'reviewer',
-    }))
+    const dispose = subagents.registerProvider(provider)
+    expect(subagents.list()).toEqual(['alpha'])
+    expect(subagents.getProvider('alpha')).toBe(provider)
+    const run = await subagents.start('alpha', baseRequest())
     await expect(run.result).resolves.toMatchObject({ stopReason: 'completed' })
     expect(provider.startCount).toBe(1)
-    expect(replacementStart).not.toHaveBeenCalled()
 
-    await owner.dispose()
-    expect(removed).toEqual(['stable'])
-    expect(ctx.subagents.list()).toEqual([])
-    expect(() => ctx.subagents.registerProvider(new StubProvider('stable'))).not.toThrow()
-  })
-
-  it('re-registers a name after its prior registration is disposed (not wedged)', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-
-    const dispose = ctx.subagents.registerProvider(new StubProvider('reuse'))
-    expect(ctx.subagents.list()).toEqual(['reuse'])
     await dispose()
-    expect(ctx.subagents.list()).toEqual([])
-
-    const disposeAgain = ctx.subagents.registerProvider(new StubProvider('reuse'))
-    expect(ctx.subagents.list()).toEqual(['reuse'])
-    await disposeAgain()
-    expect(ctx.subagents.list()).toEqual([])
+    expect(added).toEqual(['alpha'])
+    expect(removed).toEqual(['alpha'])
+    expect(subagents.getProvider('alpha')).toBeUndefined()
   })
 
-  describe('start-time capability validation (fail loud, before any child)', () => {
-    it.each([
-      { field: 'outputSchema', request: baseRequest({ outputSchema: { type: 'object', properties: { x: { type: 'string' } } } }) },
-      { field: 'maxDepth', request: baseRequest({ maxDepth: 2 }) },
-      { field: 'toolFilter', request: baseRequest({ toolFilter: { deny: ['bash'] } }) },
-    ])('rejects $field against a provider that lacks the capability — before start() runs', ({ request }) => {
-      const ctx = new Context()
-      return ctx.plugin(SubagentService).then(() => {
-        const provider = new StubProvider('weak', NO_CAPS)
-        ctx.subagents.registerProvider(provider)
-        try {
-          ctx.subagents.start('weak', request)
-          expect.fail('expected UNSUPPORTED_CAPABILITY')
-        } catch (error: unknown) {
-          expect(error).toBeInstanceOf(SubagentError)
-          expect((error as SubagentError).code).toBe('UNSUPPORTED_CAPABILITY')
-        }
-        // The child was never started — the check is pre-spawn.
-        expect(provider.startCount).toBe(0)
-      })
-    })
-
-    it('allows a capability request when the provider supports it', async () => {
-      const ctx = new Context()
-      await ctx.plugin(SubagentService)
-      const provider = new StubProvider('strong', ALL_CAPS)
-      ctx.subagents.registerProvider(provider)
-      ctx.subagents.start('strong', baseRequest({ outputSchema: { type: 'object', properties: { x: { type: 'string' } } }, maxDepth: 1 }))
-      expect(provider.startCount).toBe(1)
-    })
+  it('rolls registration back when provider-added throws', async () => {
+    const { ctx, subagents } = await service()
+    ctx.on('subagent/provider-added', () => { throw new Error('added boom') })
+    expect(() => { subagents.registerProvider(new StubProvider('alpha')) }).toThrow('added boom')
+    expect(subagents.getProvider('alpha')).toBeUndefined()
   })
 
-  it('emits subagent/start then subagent/end around a run', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    ctx.subagents.registerProvider(new StubProvider('events'))
-
-    const started = vi.fn()
-    const ended = vi.fn()
-    ctx.on('subagent/start', started)
-    ctx.on('subagent/end', ended)
-
-    const run = ctx.subagents.start('events', baseRequest())
-    await run.started
-    expect(started).toHaveBeenCalledWith(expect.objectContaining({ provider: 'events', id: run.id }))
-
-    await run.result
-    // `subagent/end` fires from a `.then` on the result — let the microtask run.
-    await Promise.resolve()
-    expect(ended).toHaveBeenCalledWith(expect.objectContaining({ provider: 'events', id: run.id, stopReason: 'completed' }))
+  it('rejects duplicate and absent provider names with typed errors', async () => {
+    const { subagents } = await service()
+    subagents.registerProvider(new StubProvider('dup'))
+    expect(() => { subagents.registerProvider(new StubProvider('dup')) })
+      .toThrow(expect.objectContaining({ code: 'DUPLICATE_PROVIDER' }))
+    await expect(subagents.start('missing', baseRequest()))
+      .rejects.toMatchObject({ code: 'NO_PROVIDER' })
   })
 
-  it('waits for provider readiness and observes an early result rejection without reordering lifecycle', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    const readiness = Promise.withResolvers<undefined>()
-    ctx.subagents.registerProvider({
-      name: 'delayed-start',
-      capabilities: NO_CAPS,
-      inheritsParentContext: false,
-      start: () => ({
-        id: AgentId('delayed-child'),
-        started: readiness.promise,
-        // Already rejected: SubagentService must attach its result handler in
-        // the same synchronous start() call, before awaiting readiness.
-        result: Promise.reject(new Error('early infrastructure fault')),
-        cancel() {},
-        async dispose() {},
-      }),
-    })
-    const lifecycle: string[] = []
-    ctx.on('subagent/start', () => void lifecycle.push('start'))
-    ctx.on('subagent/end', info => void lifecycle.push(`end:${info.stopReason}`))
-
-    const run = ctx.subagents.start('delayed-start', baseRequest())
-    await expect(run.result).rejects.toThrow('early infrastructure fault')
-    expect(lifecycle).toEqual([])
-
-    readiness.resolve(undefined)
-    await run.started
-    expect(lifecycle).toEqual(['start', 'end:error'])
+  it.each([
+    ['outputSchema', { outputSchema: { type: 'object', properties: {} } }],
+    ['depthLimit', { maxDepth: 1 }],
+    ['toolFilter', { toolFilter: { deny: ['bash'] } }],
+    ['persona', { persona: 'reviewer' }],
+  ] as const)('rejects unsupported %s before provider startup', async (_capability, override) => {
+    const { subagents } = await service()
+    const provider = new StubProvider('weak', NO_CAPS)
+    subagents.registerProvider(provider)
+    await expect(subagents.start('weak', baseRequest(override)))
+      .rejects.toMatchObject({ code: 'UNSUPPORTED_CAPABILITY' })
+    expect(provider.startCount).toBe(0)
   })
 
-  it('emits no lifecycle pair when readiness rejects before a child exists', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    const readiness = Promise.withResolvers<undefined>()
+  it('validates depth and schema semantics before provider startup', async () => {
+    const { subagents } = await service()
+    const provider = new StubProvider('strong')
+    subagents.registerProvider(provider)
+    await expect(subagents.start('strong', baseRequest({ maxDepth: -1 })))
+      .rejects.toThrow('non-negative safe integer')
+    await expect(subagents.start('strong', baseRequest({ outputSchema: { type: 'string' } as never })))
+      .rejects.toThrow()
+    expect(provider.startCount).toBe(0)
+    expect(() => { assertSubagentMaxDepth(undefined) }).not.toThrow()
+  })
+
+  it('publishes lifecycle only after async provider start and keeps parent scope', async () => {
+    const { ctx, subagents } = await service()
+    const ready = Promise.withResolvers<SubagentRun>()
     const result = Promise.withResolvers<SubagentResult>()
-    ctx.subagents.registerProvider({
-      name: 'never-started',
+    subagents.registerProvider({
+      name: 'deferred',
       capabilities: NO_CAPS,
       inheritsParentContext: false,
-      start: () => ({
-        id: AgentId('never-started-child'),
-        started: readiness.promise,
-        result: result.promise,
-        cancel() {},
-        async dispose() {},
-      }),
+      start: () => ready.promise,
+    })
+    const parent = fakeParent('delegator')
+    const events: string[] = []
+    const keys: unknown[] = []
+    ctx.on('subagent/start', function () { events.push('start'); keys.push(carrierKeyOf(this)) })
+    ctx.on('subagent/end', function () { events.push('end'); keys.push(carrierKeyOf(this)) })
+
+    const starting = subagents.start('deferred', baseRequest({ parent }))
+    await Promise.resolve()
+    expect(events).toEqual([])
+    ready.resolve({ id: AgentId('child'), result: result.promise, async dispose() {} })
+    const run = await starting
+    expect(events).toEqual(['start'])
+    result.resolve({ output: [{ type: 'text', text: 'answer' }], stopReason: 'completed' })
+    await run.result
+    await Promise.resolve()
+    expect(events).toEqual(['start', 'end'])
+    expect(keys).toEqual([parent, parent])
+  })
+
+  it('emits no run lifecycle when provider startup rejects', async () => {
+    const { ctx, subagents } = await service()
+    subagents.registerProvider({
+      name: 'failed',
+      capabilities: NO_CAPS,
+      inheritsParentContext: false,
+      start: async () => { throw new Error('setup rolled back') },
     })
     const lifecycle = vi.fn()
     ctx.on('subagent/start', lifecycle)
     ctx.on('subagent/end', lifecycle)
-
-    const run = ctx.subagents.start('never-started', baseRequest())
-    readiness.reject(new Error('publication rolled back'))
-    await expect(run.started).rejects.toThrow('publication rolled back')
-    result.resolve({ output: [], stopReason: 'aborted' })
-    await run.result
-    await Promise.resolve()
+    await expect(subagents.start('failed', baseRequest())).rejects.toThrow('setup rolled back')
     expect(lifecycle).not.toHaveBeenCalled()
   })
 
-  it('pins start and end to the parent accepted at start despite caller mutation', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    const gate = Promise.withResolvers<SubagentResult>()
-    let acceptedRequest: SubagentStartRequest | undefined
-    ctx.subagents.registerProvider({
-      name: 'deferred',
-      capabilities: NO_CAPS,
-      inheritsParentContext: false,
-      start: (accepted) => {
-        acceptedRequest = accepted
-        return {
-          id: AgentId('deferred-child'),
-          started: Promise.resolve(),
-          result: gate.promise,
-          cancel() {},
-          async dispose() {},
-        }
-      },
+  it('emits an enriched end event and maps result rejection to error telemetry', async () => {
+    const { ctx, subagents } = await service()
+    const completed = new StubProvider('completed', NO_CAPS, {
+      output: [{ type: 'text', text: 'answer' }],
+      stopReason: 'completed',
     })
-    const accepted = fakeParent('accepted-parent')
-    const replacement = fakeParent('replacement-parent')
-    const keys: unknown[] = []
-    ctx.on('subagent/start', function () { keys.push(carrierKeyOf(this)) })
-    ctx.on('subagent/end', function () { keys.push(carrierKeyOf(this)) })
-    const request = baseRequest({ parent: accepted })
-
-    const run = ctx.subagents.start('deferred', request)
-    request.parent = replacement
-    request.prompt[0] = { type: 'text', text: 'mutated prompt' }
-    expect(acceptedRequest?.parent).toBe(accepted)
-    expect(acceptedRequest?.prompt).toEqual([{ type: 'text', text: 'do a thing' }])
-    expect(acceptedRequest?.prompt).not.toBe(request.prompt)
-    gate.resolve({ output: [], stopReason: 'completed' })
-    await run.result
-    await Promise.resolve()
-
-    expect(keys).toEqual([accepted, accepted])
-  })
-
-  it('carries lastAssistantMessage (the child output) onto the end event', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    ctx.subagents.registerProvider(new StubProvider(
-      'enriched',
-      ALL_CAPS,
-      { output: [{ type: 'text', text: 'the child answer' }], stopReason: 'completed' },
-    ))
-
-    const started = vi.fn()
+    subagents.registerProvider(completed)
     const ended = vi.fn()
-    ctx.on('subagent/start', started)
     ctx.on('subagent/end', ended)
-
-    const run = ctx.subagents.start('enriched', baseRequest())
-    await run.started
-    expect(started).toHaveBeenCalledWith(expect.objectContaining({ provider: 'enriched', id: run.id }))
-
+    const run = await subagents.start('completed', baseRequest())
     await run.result
     await Promise.resolve()
     expect(ended).toHaveBeenCalledWith(expect.objectContaining({
-      provider: 'enriched',
-      id: run.id,
+      provider: 'completed',
+      lastAssistantMessage: [{ type: 'text', text: 'answer' }],
       stopReason: 'completed',
-      lastAssistantMessage: [{ type: 'text', text: 'the child answer' }],
     }))
-  })
 
-  it('observe-only: a subagent/end listener mutating lastAssistantMessage cannot corrupt the caller\'s result', async () => {
-    // The subagent/end emit fires from a detached `.then` registered before
-    // start() returns — i.e. BEFORE the caller's own `await run.result`
-    // continuation. If the event shared the result.output reference, a mutating
-    // listener would change the SubagentResult the caller consumes. The service
-    // deep-clones output onto the event, so the listener mutates only its copy.
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    ctx.subagents.registerProvider(new StubProvider(
-      'clone',
-      ALL_CAPS,
-      { output: [{ type: 'text', text: 'original' }], stopReason: 'completed' },
-    ))
-
-    ctx.on('subagent/end', (info) => {
-      // A hostile/buggy listener reaches in and mutates the event's array.
-      const blocks = info.lastAssistantMessage
-      if (blocks?.[0]?.type === 'text') blocks[0].text = 'HIJACKED'
-      blocks?.push({ type: 'text', text: 'injected' })
-    })
-
-    const run = ctx.subagents.start('clone', baseRequest())
-    const result = await run.result
-    await Promise.resolve() // let the detached settle hook (and its listener) run
-    // The caller's result.output is untouched by the listener's mutation.
-    expect(result.output).toEqual([{ type: 'text', text: 'original' }])
-  })
-
-  it('omits lastAssistantMessage on the reject path (no SubagentResult was produced)', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    ctx.subagents.registerProvider({
-      name: 'rej',
+    const failure = Promise.withResolvers<SubagentResult>()
+    subagents.registerProvider({
+      name: 'infra',
       capabilities: NO_CAPS,
       inheritsParentContext: false,
-      start: () => ({
-        id: AgentId('rej-child'),
-        started: Promise.resolve(),
-        result: Promise.reject(new Error('infra fault')),
-        cancel() {},
-        dispose: async () => {},
-      }),
+      async start() {
+        return { id: AgentId('infra-child'), result: failure.promise, async dispose() {} }
+      },
     })
-
-    const ended = vi.fn()
-    ctx.on('subagent/end', ended)
-    const run = ctx.subagents.start('rej', baseRequest())
-    await run.result.catch(() => {})
+    const failedRun = await subagents.start('infra', baseRequest())
+    failure.reject(new Error('transport'))
+    await expect(failedRun.result).rejects.toThrow('transport')
     await Promise.resolve()
-
-    const endInfo = ended.mock.calls[0]![0] as Record<string, unknown>
-    expect(endInfo.stopReason).toBe('error')
-    expect('lastAssistantMessage' in endInfo).toBe(false) // no output exists on reject
+    expect(ended).toHaveBeenCalledWith(expect.objectContaining({ provider: 'infra', stopReason: 'error' }))
   })
 
-  it('contains a structuredClone failure: emits subagent/end without lastAssistantMessage (no unhandled rejection)', async () => {
-    // The clone runs inside onFulfilled, OUTSIDE emitLifecycle's per-listener
-    // containment. An uncloneable output (here a content block carrying a
-    // function) would otherwise throw and become an unhandled rejection on the
-    // detached `.then`. The handler must instead log and emit the event WITHOUT
-    // lastAssistantMessage, still carrying the real stopReason.
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    const warn = vi.fn(); ctx.logger.warn = warn as never
-    // An output value structuredClone cannot handle (a function is uncloneable).
-    const uncloneable = [{ type: 'text', text: 'x', evil: () => 0 }] as unknown as SubagentResult['output']
-    ctx.subagents.registerProvider({
-      name: 'unclone',
-      capabilities: NO_CAPS,
-      inheritsParentContext: false,
-      start: () => ({
-        id: AgentId('unclone-child'),
-        started: Promise.resolve(),
-        result: Promise.resolve({ output: uncloneable, stopReason: 'completed' } as SubagentResult),
-        cancel() {},
-        dispose: async () => {},
-      }),
-    })
+  it('contains synchronous and asynchronous lifecycle observer failures', async () => {
+    const { ctx, subagents } = await service()
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => void warnings.push(String(message))) as typeof ctx.logger.warn
+    const heard: string[] = []
+    ctx.on('subagent/provider-removed', () => { throw new Error('sync boom') })
+    // Runtime listeners may return thenables even though the declaration's observable result is void.
+    // eslint-disable-next-line @typescript-eslint/no-misused-promises -- exercises rejected-listener containment
+    ctx.on('subagent/provider-removed', async () => { throw new Error('async boom') })
+    ctx.on('subagent/provider-removed', () => { throw { toString: () => { throw new Error('coercion') } } })
+    ctx.on('subagent/provider-removed', name => void heard.push(name))
+    const dispose = subagents.registerProvider(new StubProvider('contained'))
 
-    const ended = vi.fn()
-    ctx.on('subagent/end', ended)
-    const run = ctx.subagents.start('unclone', baseRequest())
-    await run.result
+    await dispose()
     await Promise.resolve()
-
-    const endInfo = ended.mock.calls[0]![0] as Record<string, unknown>
-    expect(endInfo.stopReason).toBe('completed')        // the real outcome is preserved
-    expect('lastAssistantMessage' in endInfo).toBe(false) // clone failed → omitted, not crashed
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('could not clone'))
+    expect(heard).toEqual(['contained'])
+    expect(warnings.some(message => message.includes('sync boom'))).toBe(true)
+    expect(warnings.some(message => message.includes('async boom'))).toBe(true)
+    expect(warnings.some(message => message.includes('<unrenderable thrown value>'))).toBe(true)
   })
 
-  it('emits subagent/end with stopReason "error" when the run result promise rejects', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    // A provider whose run.result REJECTS (an infrastructure fault — the seam
-    // contract says child-level failures resolve with stopReason 'error', but a
-    // rejection is still surfaced as an 'error' telemetry event).
-    ctx.subagents.registerProvider({
-      name: 'rejecter',
-      capabilities: NO_CAPS,
-      inheritsParentContext: false,
-      start: () => ({
-        id: AgentId('rej-child'),
-        started: Promise.resolve(),
-        result: Promise.reject(new Error('infra fault')),
-        cancel() {},
-        dispose: async () => {},
-      }),
-    })
-
-    const ended = vi.fn()
-    ctx.on('subagent/end', ended)
-    const run = ctx.subagents.start('rejecter', baseRequest())
-    // Observe (and swallow) the rejection the consumer would see, then let the
-    // detached `.then` settle the telemetry emit.
-    await run.result.catch(() => {})
-    await Promise.resolve()
-    expect(ended).toHaveBeenCalledWith(expect.objectContaining({ provider: 'rejecter', id: run.id, stopReason: 'error' }))
-  })
-
-  it('contains a throwing subagent/start listener per-listener: a later listener still observes the event and start() returns the run', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    ctx.subagents.registerProvider(new StubProvider('contain'))
-    // Two listeners; the FIRST throws. Per-listener containment means the second
-    // must STILL run (a single try/catch around ctx.emit would let the first
-    // throw halt the dispatch and starve the second — the round-2 regression).
-    const second = vi.fn()
-    ctx.on('subagent/start', () => { throw new Error('bad start listener') })
-    ctx.on('subagent/start', second)
-
-    const run = ctx.subagents.start('contain', baseRequest())
-    expect(run.id).toBeDefined()
-    await run.started
-    expect(second).toHaveBeenCalledWith(expect.objectContaining({ provider: 'contain', id: run.id }))
-    await expect(run.result).resolves.toMatchObject({ stopReason: 'completed' })
-  })
-
-  it('contains a throwing subagent/end listener per-listener: a later listener still observes the settle, no unhandled rejection', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SubagentService)
-    ctx.subagents.registerProvider(new StubProvider('contain-end'))
-    const second = vi.fn()
-    ctx.on('subagent/end', () => { throw new Error('bad end listener') })
-    ctx.on('subagent/end', second)
-
-    const run = ctx.subagents.start('contain-end', baseRequest())
-    await run.result
-    // Let the detached `.then` + the contained emit run.
-    await Promise.resolve()
-    await Promise.resolve()
-    expect(second).toHaveBeenCalledWith(expect.objectContaining({ provider: 'contain-end', id: run.id, stopReason: 'completed' }))
-  })
-
-  it('SubagentError extends the shared HarnessError base', () => {
-    const err = new SubagentError('boom', 'NO_PROVIDER')
-    expect(err).toBeInstanceOf(HarnessError)
-    expect(err.name).toBe('SubagentError')
-    expect(err.code).toBe('NO_PROVIDER')
+  it('SubagentError participates in the harness error taxonomy', () => {
+    const error = new SubagentError('boom', 'NO_PROVIDER')
+    expect(error).toBeInstanceOf(HarnessError)
+    expect(error.name).toBe('SubagentError')
+    expect(error.code).toBe('NO_PROVIDER')
   })
 })
diff --git a/packages/subagent/tool-subagent/README.md b/packages/subagent/tool-subagent/README.md
index e7ff177c90..1e338bbec6 100644
--- a/packages/subagent/tool-subagent/README.md
+++ b/packages/subagent/tool-subagent/README.md
@@ -1,32 +1,34 @@
 # @deepseek-ai/dsh-tool-subagent
 
-The model-facing `subagent` tool: delegate a self-contained task to a child agent and return its final output. Pure schema + lifecycle shaping over the [`ctx.subagents`](../subagent/README.md) provider registry — an in-process, ACP, or future A2A backend swaps in without changing what the model sees.
+The `subagent` tool lets the model delegate one self-contained task and collect the child's final output. It is a thin consumer of `ctx.subagents`; changing the configured provider changes the transport without changing the model-facing execution contract.
 
-## Provider selection is config, not model-facing
+## Provider selection
 
-This plugin binds to **exactly one** provider (`Config.provider`). The model sees only `{ description, prompt }` — there is no provider/type parameter in the schema. To expose more than one transport, load the plugin more than once, each bound to a different provider **and a distinct `toolName`** (the tool registry rejects a duplicate name, so a second load that kept the default `subagent` name would throw). Keeping selection in config (not the schema) is the deliberate split: the *service* holds a multi-provider registry; the *tool* picks one.
+Each plugin instance binds to exactly one provider. The model sees `{ description, prompt }`, not a provider selector. To expose multiple transports, load the plugin multiple times with distinct `toolName` values.
 
-## The description states the provider's context contract
+The description is derived from `provider.inheritsParentContext`: spawn and ACP tell the model to provide a standalone prompt, while fork says the child already sees completed conversation turns. The plugin follows `subagent/provider-added` and `subagent/provider-removed`, so concurrent Cordis plugin loading does not create a registration-order dependency.
 
-The tool description and the `prompt` parameter description are DERIVED from the bound provider's `inheritsParentContext` (`providerWording`): a fresh-context provider (spawn, ACP) gets the standalone-prompt wording ("it does not see this conversation"), an inheriting provider (fork) tells the model the child already sees the conversation's completed turns and its prompt should state only what is new. Because the description is fixed at tool registration, the tool **mirrors the provider's lifecycle** (`subagent/provider-added`/`-removed`): it registers when the bound provider is (or becomes) available and unregisters when the provider goes away — no load-order requirement (the cordis Loader starts sibling entries concurrently, so "listed first" never guaranteed "registered first"), and an HMR reload of the backend re-derives the wording from the fresh provider. While the provider is absent the tool simply does not exist (a `ctx.logger` note records the wait; a typo'd provider name shows up as a tool that never materializes).
+## Lifecycle
 
-| Config key | Meaning |
+`execute` passes the tool execution's abort signal directly as the required `SubagentStartRequest.signal`, awaits `ctx.subagents.start(...)`, then awaits `run.result` inside a `try/finally` that always calls `run.dispose()`. The same signal therefore covers startup and live execution, while disposal guarantees quiescence on success, failure, and abort.
+
+A non-`completed` stop reason becomes an `isError` tool result; partial child output is never reported as success. The current tool blocks the parent turn until collection finishes; background and polling modes are deferred.
+
+## Config
+
+| Key | Meaning |
 |---|---|
-| `provider` (required) | The `ctx.subagents` provider name to start runs on (`spawn`, `fork`, `acp`, …). |
-| `toolName` | The model-facing tool name to register (default `subagent`). Set a distinct value per load when exposing multiple providers, e.g. `subagent` + `subagent_acp`. |
-| `agentOptions` | Default per-child `{ model? }` applied to every spawned child. |
-| `persona` | Per-child persona that shadows the deployment persona; requires the provider's `persona` capability. |
-| `toolFilter` | Per-child `{ allow?, deny? }` restriction over global tools; requires the provider's `toolFilter` capability. |
-| `maxDepth` | Maximum delegation depth; requires the provider's `depthLimit` capability. |
+| `provider` | Required `ctx.subagents` provider name. |
+| `toolName` | Model-facing tool name (default `subagent`). Must be unique per plugin instance. |
+| `agentOptions` | Default child agent options, currently including `model`. |
+| `persona` | Per-child persona; requires provider `persona` capability. |
+| `toolFilter` | Per-child global-tool restriction; requires provider `toolFilter` capability. |
+| `maxDepth` | Absolute delegation-depth cap; requires provider `depthLimit` capability. |
 
-## Lifecycle (synchronous collect)
-
-`execute` starts a run on the configured provider and **awaits `run.result` inside a `try/finally` that always `dispose()`s the run** — the owned child agent/session is torn down on every path (success, error, abort), never leaked. The tool's abort signal (`exec.signal`) is bridged to `run.cancel()`. A non-`completed` stop reason (aborted/error/max-tokens/refusal) maps to an `isError` tool result rather than returning partial output as success.
-
-Background / poll collection is deferred (see the [RFC](../../../docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md)); this cut blocks the parent turn until the child finishes.
+`toolFilter` changes the child's visible global tool layer; it is not a parent-derived authority ceiling. See the [agent-scope security non-goal](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals).
 
 ## Known Limitations and Deferred Work
 
-- **Delegation blocks the parent turn** — synchronous collect only; background start + poll collection is deferred to the long-running-runtime redesign.
+- **Delegation blocks the parent turn** — synchronous collect only; background start and poll collection are deferred to the long-running-runtime redesign.
 - **Duplicate `toolName` across waiting loads is detected late** (`TODO(subagent-dup-toolname)`) — two loads waiting on providers collide only when a provider arrives, and the throw rolls back the provider's fiber rather than the misconfigured tool's; config-time detection needs a cross-fiber registry of intended names.
 - **Child policy is fixed per tool registration** — `model`, persona, tool filter, and depth cap come from this plugin load's config, not model-call arguments; exposing another policy requires another distinctly named tool.
diff --git a/packages/subagent/tool-subagent/src/index.ts b/packages/subagent/tool-subagent/src/index.ts
index 4f2a1bc33d..322a76e825 100644
--- a/packages/subagent/tool-subagent/src/index.ts
+++ b/packages/subagent/tool-subagent/src/index.ts
@@ -11,10 +11,12 @@
  * — there is no provider/type parameter in the model-facing schema. The model
  * sees only `{ description, prompt }`.
  *
- * The tool DESCRIPTION is derived from the bound provider's context contract
- * ({@link providerWording}): a fresh-context provider (spawn, ACP) gets the
- * standalone-prompt wording, an inheriting provider (fork) tells the model the
- * child already sees the conversation's completed turns. The tool MIRRORS the
+ * The tool DESCRIPTION is derived from the bound provider's conversation-history
+ * descriptor ({@link providerWording}): a fresh-conversation provider (spawn,
+ * ACP) gets the standalone-prompt wording, while a seeded-conversation provider
+ * (fork) tells the model the child already sees the conversation's completed
+ * turns. This descriptor says nothing about Cordis scope, services, tools, or
+ * authority. The tool MIRRORS the
  * provider's lifecycle via `subagent/provider-added`/`-removed` — it registers
  * when the provider is (or becomes) available and unregisters when the
  * provider goes away — so no load-order requirement exists and an HMR reload
@@ -35,6 +37,7 @@ import z from 'schemastery'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import type { AgentOptions } from '@deepseek-ai/dsh-agent'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
+import { assertSubagentMaxDepth } from '@deepseek-ai/dsh-subagent'
 import type { SubagentProvider, SubagentResult, SubagentRun, SubagentStartRequest } from '@deepseek-ai/dsh-subagent'
 
 export const name = 'tool-subagent'
@@ -84,8 +87,9 @@ export interface Config {
    * Recursion cap applied to every child this tool spawns (see
    * `SubagentStartRequest.maxDepth`): a spawn whose child would sit deeper
    * than this in the delegation tree is rejected. Requires the provider's
-   * `depthLimit` capability. Omitted ⇒ unbounded (bound it in deployments
-   * that expose this tool to children).
+   * `depthLimit` capability. Must be a non-negative safe integer and is
+   * validated when the plugin loads. Omitted ⇒ unbounded (bound it in
+   * deployments that expose this tool to children).
    */
   maxDepth?: number
 }
@@ -115,7 +119,7 @@ export const Config: z<Config> = z.object({
     allow: z.array(z.string()).default(undefined as unknown as string[]),
     deny: z.array(z.string()).default(undefined as unknown as string[]),
   }).default(undefined as unknown as { allow: string[]; deny: string[] }),
-  maxDepth: z.number(),
+  maxDepth: z.natural().max(Number.MAX_SAFE_INTEGER),
 })
 
 /**
@@ -152,16 +156,19 @@ function stopReasonError(result: SubagentResult): string | undefined {
 }
 
 /**
- * Model-facing wording per context contract ({@link SubagentProvider.inheritsParentContext}).
+ * Model-facing wording from the provider's conversation-history descriptor
+ * ({@link SubagentProvider.inheritsParentContext}).
  * A fresh child needs a standalone prompt; a forked child already sees the
  * conversation's completed turns — telling the model to restate everything
  * (or, worse, that the child "does not see this conversation") would be false
  * for a fork. Exported for tests.
- * @param inherits - the bound provider's context contract.
+ * @param inheritsConversation - whether the child's conversation is seeded
+ *   with the parent's completed turns; this says nothing about tool, service,
+ *   scope, or authority inheritance.
  * @returns the tool `description` and the `prompt` parameter description.
  */
-export function providerWording(inherits: boolean): { description: string; promptDescription: string } {
-  if (inherits) {
+export function providerWording(inheritsConversation: boolean): { description: string; promptDescription: string } {
+  if (inheritsConversation) {
     return {
       description:
         'Delegate a task to a subagent that INHERITS this conversation: a child agent seeded with all '
@@ -188,6 +195,9 @@ export function providerWording(inherits: boolean): { description: string; promp
 }
 
 export function apply(ctx: Context, config: Config): void {
+  // Keep misconfiguration at plugin load even when a caller invokes apply()
+  // directly and bypasses Schemastery's natural/max metadata.
+  assertSubagentMaxDepth(config.maxDepth)
   // Misconfiguration fails loud AT LOAD (the check is self-contained): an
   // explicit `toolFilter: {}` would otherwise pass the capability gate and
   // kill every delegation later, in the child-setup `restrict({})` throw.
@@ -232,24 +242,14 @@ export function apply(ctx: Context, config: Config): void {
         const request: SubagentStartRequest = {
           prompt: [{ type: 'text', text: args.prompt }],
           parent,
-          ...exec.signal ? { signal: exec.signal } : {},
+          signal: exec.signal ?? new AbortController().signal,
           ...config.agentOptions !== undefined ? { agentOptions: config.agentOptions } : {},
           ...config.persona !== undefined ? { persona: config.persona } : {},
           ...config.toolFilter !== undefined ? { toolFilter: config.toolFilter } : {},
           ...config.maxDepth !== undefined ? { maxDepth: config.maxDepth } : {},
         }
 
-        const run: SubagentRun = ctx.subagents.start(config.provider, request)
-
-        // Bridge the tool's abort signal to the run: if the parent step is
-        // aborted while the child is in flight, cancel the child too.
-        const onAbort = (): void => { run.cancel('parent step aborted') }
-        exec.signal?.addEventListener('abort', onAbort, { once: true })
-        // `addEventListener` does NOT fire for a signal already aborted before this
-        // line, so a step cancelled before the tool ran would never reach the
-        // child. Cancel explicitly in that case — the bridge must honor an
-        // already-aborted signal, not lean on each provider re-checking it.
-        if (exec.signal?.aborted) run.cancel('parent step aborted')
+        const run: SubagentRun = await ctx.subagents.start(config.provider, request)
 
         try {
           const result = await run.result
@@ -261,7 +261,6 @@ export function apply(ctx: Context, config: Config): void {
           }
           return [{ type: 'text', text: outputText(result.output) }]
         } finally {
-          exec.signal?.removeEventListener('abort', onAbort)
           // Always reach child quiescence — never leak a live idle child/session.
           await run.dispose()
         }
diff --git a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts
index 95d26dabdf..5830513cf4 100644
--- a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts
+++ b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts
@@ -113,11 +113,9 @@ describe('dsh-tool-subagent', () => {
       name: 'weird',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
       inheritsParentContext: false,
-      start: () => ({
+      start: async () => ({
         id: AgentId('weird-child'),
-        started: Promise.resolve(),
         result: Promise.resolve({ output: [{ type: 'text', text: 'partial' }], stopReason: 'frobnicated' as never }),
-        cancel() {},
         dispose: async () => {},
       }),
     })
@@ -140,13 +138,11 @@ describe('dsh-tool-subagent', () => {
       name: 'capture',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
       inheritsParentContext: false,
-      start: (request) => {
+      start: async (request) => {
         seen = request
         return {
           id: AgentId('capture-child'),
-          started: Promise.resolve(),
           result: Promise.resolve({ output: [{ type: 'text', text: 'ok' }], stopReason: 'completed' as const }),
-          cancel() {},
           dispose: async () => {},
         }
       },
@@ -171,13 +167,11 @@ describe('dsh-tool-subagent', () => {
       name: 'bare',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
       inheritsParentContext: false,
-      start: (request) => {
+      start: async (request) => {
         seen = request
         return {
           id: AgentId('bare-child'),
-          started: Promise.resolve(),
           result: Promise.resolve({ output: [{ type: 'text', text: 'ok' }], stopReason: 'completed' as const }),
-          cancel() {},
           dispose: async () => {},
         }
       },
@@ -220,7 +214,7 @@ describe('dsh-tool-subagent', () => {
     await ctx.plugin(SystemPrompt)
     await ctx.plugin(ToolRegistry)
     await ctx.plugin(SubagentService)
-    const backend = await ctx.plugin(mock, { name: 'mock' }) // spawn-shaped (inherits: false)
+    const backend = await ctx.plugin(mock, { name: 'mock' }) // fresh conversation (descriptor: false)
     await ctx.plugin(tool, { provider: 'mock' })
     expect(ctx.tools.schemas().find(s => s.name === 'subagent')!.description).toContain('does not see this conversation')
 
@@ -228,7 +222,7 @@ describe('dsh-tool-subagent', () => {
     await backend.dispose()
     expect(ctx.tools.schemas().some(s => s.name === 'subagent')).toBe(false)
 
-    // Backend reloads with a DIFFERENT contract: the wording is re-derived
+    // Backend reloads with a DIFFERENT conversation-history descriptor: the wording is re-derived
     // from the fresh provider, not served stale from the first mount.
     await ctx.plugin(mock, { name: 'mock', inheritsParentContext: true })
     expect(ctx.tools.schemas().find(s => s.name === 'subagent')!.description).toContain('INHERITS this conversation')
@@ -273,7 +267,7 @@ describe('dsh-tool-subagent', () => {
     expect(ctx.tools.schemas().some(s => s.name === 'subagent')).toBe(true)
   })
 
-  it('derives spawn-shaped wording from a fresh-context provider (default mock)', async () => {
+  it('derives spawn-shaped wording from a fresh-conversation provider (default mock)', async () => {
     const ctx = await setup({ provider: 'mock' })
     const schema = ctx.tools.schemas().find(s => s.name === 'subagent')!
     expect(schema.description).toContain('does not see this conversation')
@@ -281,7 +275,7 @@ describe('dsh-tool-subagent', () => {
     expect(props['prompt']!.description).toContain('include everything it needs')
   })
 
-  it('derives fork-shaped wording from an inheriting provider (the description stops lying)', async () => {
+  it('derives fork-shaped wording from a seeded-conversation provider (the description stops lying)', async () => {
     const ctx = await setup({ provider: 'mock', toolName: 'subagent' }, { inheritsParentContext: true })
     const schema = ctx.tools.schemas().find(s => s.name === 'subagent')!
     expect(schema.description).toContain('INHERITS this conversation')
@@ -302,11 +296,9 @@ describe('dsh-tool-subagent', () => {
       name: 'spy',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
       inheritsParentContext: false,
-      start: () => ({
+      start: async () => ({
         id: AgentId('spy-child'),
-        started: Promise.resolve(),
         result: Promise.resolve({ output: [{ type: 'text', text: 'ok' }], stopReason: 'completed' as const }),
-        cancel() {},
         dispose: async () => void disposed(),
       }),
     })
@@ -326,11 +318,9 @@ describe('dsh-tool-subagent', () => {
       name: 'spy',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
       inheritsParentContext: false,
-      start: () => ({
+      start: async () => ({
         id: AgentId('spy-child'),
-        started: Promise.resolve(),
         result: Promise.resolve({ output: [], stopReason: 'error' as const }),
-        cancel() {},
         dispose: async () => void disposed(),
       }),
     })
@@ -341,7 +331,7 @@ describe('dsh-tool-subagent', () => {
     expect(disposed).toHaveBeenCalledTimes(1)
   })
 
-  it('bridges the tool abort signal to run.cancel()', async () => {
+  it('passes the tool abort signal as the provider cancellation channel', async () => {
     const cancelled = vi.fn()
     const ctx = new Context()
     await ctx.plugin(SystemPrompt)
@@ -351,17 +341,17 @@ describe('dsh-tool-subagent', () => {
       name: 'spy',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
       inheritsParentContext: false,
-      start: () => {
+      start: async (request) => {
+        if (request.signal.aborted) throw new Error('start aborted')
         let resolveResult: (r: { output: never[]; stopReason: 'aborted' }) => void
         const result = new Promise<{ output: never[]; stopReason: 'aborted' }>((res) => { resolveResult = res })
+        request.signal.addEventListener('abort', () => {
+          cancelled()
+          resolveResult({ output: [], stopReason: 'aborted' })
+        }, { once: true })
         return {
           id: AgentId('spy-child'),
-          started: Promise.resolve(),
           result,
-          cancel: () => {
-            cancelled()
-            resolveResult({ output: [], stopReason: 'aborted' })
-          },
           dispose: async () => {},
         }
       },
@@ -370,12 +360,7 @@ describe('dsh-tool-subagent', () => {
 
     const controller = new AbortController()
     const pending = callSubagent(ctx, { description: 'd', prompt: 'p' }, { signal: controller.signal })
-    // Abort AFTER the tool body has had a chance to register its abort listener
-    // (ctx.tools.execute now awaits the tools/pre-execute waterfall before the
-    // body runs, so the listener is not registered synchronously). A few
-    // microtask turns let execute() reach `addEventListener('abort')`, so this
-    // exercises the LIVE onAbort bridge — distinct from the already-aborted
-    // sync path the next test covers.
+    // Let provider.start install its listener before aborting.
     await Promise.resolve()
     await Promise.resolve()
     controller.abort()
@@ -384,13 +369,8 @@ describe('dsh-tool-subagent', () => {
     expect(result.isError).toBe(true)
   })
 
-  it('cancels the run when the tool signal is ALREADY aborted before execute (no missed abort)', async () => {
-    // `addEventListener('abort')` does not fire for a signal already aborted
-    // before the listener is added, so a step cancelled before the tool ran
-    // would never reach the child unless the bridge re-checks `signal.aborted`.
-    // A provider that leans only on the abort EVENT (this spy never inspects
-    // request.signal) proves the bridge itself must cancel.
-    const cancelled = vi.fn()
+  it('passes an already-aborted signal so provider startup rejects', async () => {
+    const sawAborted = vi.fn()
     const ctx = new Context()
     await ctx.plugin(SystemPrompt)
     await ctx.plugin(ToolRegistry)
@@ -399,19 +379,9 @@ describe('dsh-tool-subagent', () => {
       name: 'spy',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
       inheritsParentContext: false,
-      start: () => {
-        let resolveResult: (r: { output: never[]; stopReason: 'aborted' }) => void
-        const result = new Promise<{ output: never[]; stopReason: 'aborted' }>((res) => { resolveResult = res })
-        return {
-          id: AgentId('spy-child'),
-          started: Promise.resolve(),
-          result,
-          cancel: () => {
-            cancelled()
-            resolveResult({ output: [], stopReason: 'aborted' })
-          },
-          dispose: async () => {},
-        }
+      start: async (request) => {
+        if (request.signal.aborted) sawAborted()
+        throw new Error('start aborted')
       },
     })
     await ctx.plugin(tool, { provider: 'spy' })
@@ -419,7 +389,7 @@ describe('dsh-tool-subagent', () => {
     const controller = new AbortController()
     controller.abort() // already aborted BEFORE the tool runs
     const result = await callSubagent(ctx, { description: 'd', prompt: 'p' }, { signal: controller.signal })
-    expect(cancelled).toHaveBeenCalledTimes(1)
+    expect(sawAborted).toHaveBeenCalledTimes(1)
     expect(result.isError).toBe(true)
   })
 
@@ -469,13 +439,11 @@ describe('dsh-tool-subagent', () => {
       name: 'capture2',
       capabilities: { outputSchema: false, depthLimit: true, toolFilter: true, persona: true },
       inheritsParentContext: false,
-      start: (request) => {
+      start: async (request) => {
         seen = request
         return {
           id: AgentId('capture2-child'),
-          started: Promise.resolve(),
           result: Promise.resolve({ output: [{ type: 'text', text: 'ok' }], stopReason: 'completed' as const }),
-          cancel() {},
           dispose: async () => {},
         }
       },
@@ -493,8 +461,33 @@ describe('dsh-tool-subagent', () => {
     expect(seen?.maxDepth).toBe(2)
   })
 
+  it.each([
+    { label: 'null', value: null as unknown as number },
+    { label: 'a string', value: '1' as unknown as number },
+    { label: 'NaN', value: Number.NaN },
+    { label: 'positive infinity', value: Number.POSITIVE_INFINITY },
+    { label: 'negative infinity', value: Number.NEGATIVE_INFINITY },
+    { label: 'a negative integer', value: -1 },
+    { label: 'a fractional number', value: 1.5 },
+    { label: 'negative zero', value: -0 },
+    { label: 'an unsafe integer', value: Number.MAX_SAFE_INTEGER + 1 },
+  ])('rejects maxDepth=$label when the plugin loads', async ({ value }) => {
+    await expect(setup({ provider: 'mock', maxDepth: value }))
+      .rejects.toThrow()
+  })
+
+  it('validates maxDepth when apply() is invoked directly without Schemastery', () => {
+    const ctx = new Context()
+    expect(() => {
+      tool.apply(ctx, {
+        provider: 'unused',
+        maxDepth: Number.NaN,
+      })
+    }).toThrow('subagent maxDepth must be a non-negative safe integer')
+  })
+
   it('a partial toolFilter (deny only) does not materialize an empty allow-list (deny-all trap)', async () => {
-    let seen: { toolFilter?: { allow?: string[]; deny?: string[] } } | undefined
+    let seen: { toolFilter?: { readonly allow?: readonly string[]; readonly deny?: readonly string[] } } | undefined
     const ctx = new Context()
     await ctx.plugin(SystemPrompt)
     await ctx.plugin(ToolRegistry)
@@ -503,13 +496,11 @@ describe('dsh-tool-subagent', () => {
       name: 'capture3',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: true, persona: false },
       inheritsParentContext: false,
-      start: (request) => {
+      start: async (request) => {
         seen = request
         return {
           id: AgentId('capture3-child'),
-          started: Promise.resolve(),
           result: Promise.resolve({ output: [{ type: 'text', text: 'ok' }], stopReason: 'completed' as const }),
-          cancel() {},
           dispose: async () => {},
         }
       },
@@ -534,13 +525,11 @@ describe('dsh-tool-subagent', () => {
       name: 'capture4',
       capabilities: { outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
       inheritsParentContext: false,
-      start: (request) => {
+      start: async (request) => {
         seen = request
         return {
           id: AgentId('capture4-child'),
-          started: Promise.resolve(),
           result: Promise.resolve({ output: [{ type: 'text', text: 'ok' }], stopReason: 'completed' as const }),
-          cancel() {},
           dispose: async () => {},
         }
       },
diff --git a/packages/support/README.md b/packages/support/README.md
index 2a08063bad..c8883a89ff 100644
--- a/packages/support/README.md
+++ b/packages/support/README.md
@@ -5,7 +5,7 @@ Packages that exist to serve development, testing, and the examples rather than
 | Package | Role | ctx key |
 |---|---|---|
 | `acp-snapshot/` | ACP snapshot suite kit: subprocess scenario harness + golden normalizers + the `defineAcpSnapshotSuite` factory | (library — imported by example `*.snapshot.ts` suites) |
-| `invariants/` | Dev-mode event-contract invariants + session-log freeze | (listens on `session/*`, `agent/*`) |
+| `invariants/` | Dev-mode event-contract assertions | (listens on `session/*`, `agent/*`) |
 | `llm-replay/` | Record/replay adapter: short-circuits `llm/stream` from a recorded session JSONL (keyless snapshot tests) | (listens on `llm/stream`) |
 | `subagent-mock/` | Scripted `SubagentProvider` for deterministic seam/tool tests | (registers on `ctx.subagents`) |
 
diff --git a/packages/support/invariants/README.md b/packages/support/invariants/README.md
index acc0fa2a79..2fc56fc2ae 100644
--- a/packages/support/invariants/README.md
+++ b/packages/support/invariants/README.md
@@ -1,9 +1,13 @@
 # dsh-invariants
 
-Dev-mode event-contract invariants and session-log freeze. A pure-listener plugin (everything is a plugin) that asserts the harness event contract at runtime and, optionally, freezes logged session-event data so any code that mutates history throws instead of corrupting silently.
+Dev-mode event-contract assertions. This pure-listener plugin checks relationships among session events, agent states, scoped dispatches, and model requests at runtime; it does not own or change product behavior.
 
 **Off in production.** Enable it in tests and the demos, where a contract violation should fail loudly. It costs nothing when not registered, and doubles as executable documentation of the event taxonomy — the assertions *are* the contract.
 
+Session itself owns immutable log storage in every composition: it takes one lossless JSON snapshot of each accepted event, deep-freezes that record, and exposes the log through immutable array snapshots. The invariants plugin checks the cross-record and cross-seam rules that storage immutability cannot express.
+
+Session-log assertions run during Cordis `internal/dispatch`, while `Session.append()` is resolving the `session/event` callback snapshot but before it pushes the candidate into the log. A valid transition is staged by exact event identity and applied to the live trace only when that same committed event reaches the plugin's contained post-commit listener. A later internal dispatch check can therefore veto without advancing either the log or the invariant trace, while ordinary `session/event` observer failures remain observe-only.
+
 ## Plugin
 
 A functional plugin — register the module namespace (this is what loading by name in `cordis.yml` does):
@@ -14,17 +18,10 @@ import * as Invariants from '@deepseek-ai/dsh-invariants'
 
 declare const ctx: Context
 
-await ctx.plugin(Invariants)                     // freeze on (default)
-await ctx.plugin(Invariants, { freeze: false })  // assert contract, don't freeze
+await ctx.plugin(Invariants)
 ```
 
-`inject`: `['sessions']` — it reads `ctx.sessions.list()` at apply time to rebuild trace state for sessions that already exist (so a hot reload mid-turn doesn't falsely reject the next event). It listens on `session/created`, `session/event`, and `agent/status`.
-
-### Config
-
-| Key | Default | Meaning |
-|---|---|---|
-| `freeze` | `true` | Deep-freeze each logged event's data so mutating a logged event throws. Set `false` to assert the contract without freezing. |
+`inject`: `['sessions']` — it reads `ctx.sessions.list()` at apply time to rebuild trace state for sessions that already exist, so a hot reload mid-turn does not falsely reject the next event. The oracle listeners are explicitly global so pre-commit staging and post-commit application keep the same audience even if the plugin is mounted under a scoped context; their cleanup still belongs to that mounting fiber. The plugin has no configuration.
 
 ## Invariants asserted
 
@@ -46,13 +43,13 @@ Model requests (on `llm/stream`):
 
 On any violation it throws `InvariantError` (`code: 'INVARIANT'`).
 
-## Why runtime, not deep-readonly types
+## Why runtime assertions remain useful
 
-A `DeepReadonly<SessionEvent>` is high type-noise across every log consumer, and a plugin can cast straight through it. A dev-mode freeze plus these assertions catch real corruption at zero production cost and zero type noise. The always-on half of that defense — cloning derived messages so request/adapter mutation can't reach back into the log — lives in `dsh-session`'s `deriveMessages`. This package is the dev-mode tripwire. See [dev-mode invariants](../../../docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md).
+Session enforces the per-record storage boundary at runtime, where a cast cannot bypass it. Pervasive `DeepReadonly<SessionEvent>` types would add noise across consumers without expressing relationships such as turn/step nesting, subject-correct scoped dispatch, or equality between a request and its log reconstruction. This plugin checks those relationships in development while `dsh-session` keeps history immutable in every composition. See [source-owned session immutability and dev-mode invariants](../../../docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md).
 
 ## Seeded sessions
 
-A seeded/forked session arrives with events already in its log (the `Session` constructor copies the seed without emitting `session/event`). On `session/created` the plugin replays the existing log through the checker and freezes those entries, so seeded history is held to the same contract.
+A seeded or forked session arrives with events already in its log because construction does not emit `session/event` for each seed record. `Session` validates, snapshots, and freezes every seed record before accepting it; on `session/created`, this plugin replays the accepted log only to rebuild and check its relational trace state.
 
 ## Known Limitations and Deferred Work
 
diff --git a/packages/support/invariants/package.json b/packages/support/invariants/package.json
index 4ea36f66de..588c658857 100644
--- a/packages/support/invariants/package.json
+++ b/packages/support/invariants/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@deepseek-ai/dsh-invariants",
-  "description": "Dev-mode event-contract invariants + session-log freeze for the DeepSeek Harness",
+  "description": "Dev-mode event-contract assertions for the DeepSeek Harness",
   "version": "0.0.1",
   "private": true,
   "type": "module",
@@ -26,8 +26,6 @@
     "@deepseek-ai/dsh-llm": "^0.0.1",
     "@deepseek-ai/dsh-scope": "^0.0.1",
     "@deepseek-ai/dsh-session": "^0.0.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.0.1",
-    "@deepseek-ai/dsh-tools": "^0.0.1",
     "cordis": "^4.0.0-rc.6"
   },
   "devDependencies": {
@@ -35,8 +33,6 @@
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@deepseek-ai/dsh-scope": "workspace:^",
     "@deepseek-ai/dsh-session": "workspace:^",
-    "@deepseek-ai/dsh-system-prompt": "workspace:^",
-    "@deepseek-ai/dsh-tools": "workspace:^",
     "cordis": "^4.0.0-rc.6"
   }
 }
diff --git a/packages/support/invariants/src/index.ts b/packages/support/invariants/src/index.ts
index ee431a7f39..f5ef6d2b4a 100644
--- a/packages/support/invariants/src/index.ts
+++ b/packages/support/invariants/src/index.ts
@@ -1,29 +1,25 @@
 /**
- * Dev-mode invariants: a pure-listener plugin that asserts the harness event
- * contract at runtime, and (optionally) freezes logged session-event data so
- * any code that mutates history throws instead of corrupting silently.
+ * Dev-mode invariants: a pure-listener plugin that asserts relationships in
+ * the harness event contract at runtime.
  *
  * Everything is a plugin — this is just listeners on `session/created`,
- * `session/event`, and `agent/status`. It is **off in production**: enable it
- * in tests and the demos, where a contract violation should be a loud failure,
- * not a subtle one. It doubles as executable documentation of the event
- * taxonomy: the assertions below ARE the contract.
+ * `session/event`, `agent/status`, and the scoped dispatch and request seams.
+ * It is **off in production**: enable it in tests and demos, where a contract
+ * violation should be a loud failure rather than a subtle one. It doubles as
+ * executable documentation of the event taxonomy: the assertions below are
+ * the contract.
  *
- * Why runtime assertions instead of compile-time deep-readonly types? See
- * the dev-invariants RFC. Briefly: a `DeepReadonly<SessionEvent>` is high type-noise across
- * every log consumer and a plugin casts straight through it; a dev-mode freeze
- * + assertions catch real corruption at zero production cost and zero type
- * noise. The always-on half of that defense (cloning derived messages) lives
- * in dsh-session; this package is the dev-mode tripwire.
+ * Session owns immutable log storage: it snapshots and deep-freezes every
+ * accepted event at the source. This plugin checks relationships that one
+ * event's types and immutability cannot express, including turn/step nesting,
+ * scoped dispatch, status transitions, and request reconstructability.
  *
  * @module @deepseek-ai/dsh-invariants
  */
 
 import type { Context } from 'cordis'
 import { carrierKeyOf, isScopeCarrier } from '@deepseek-ai/dsh-scope'
-import type { AssembleContext } from '@deepseek-ai/dsh-system-prompt'
-import type { ToolExecution } from '@deepseek-ai/dsh-tools'
-import { HarnessError } from '@deepseek-ai/dsh-llm'
+import { assertNever, HarnessError } from '@deepseek-ai/dsh-llm'
 import type { CallId, GenerateOptions } from '@deepseek-ai/dsh-llm'
 import type { Agent, AgentStatus } from '@deepseek-ai/dsh-agent'
 import { Session, SessionId, foldRequestHeader } from '@deepseek-ai/dsh-session'
@@ -44,16 +40,6 @@ export class InvariantError extends HarnessError {
   }
 }
 
-/** Plugin config. */
-export interface Config {
-  /**
-   * Deep-freeze logged session-event data so mutating a logged event throws.
-   * Default true — this plugin only runs in dev/test, where freezing is the
-   * point. Set false to assert the event contract without freezing.
-   */
-  freeze?: boolean
-}
-
 /** Per-session bookkeeping for the session-log invariants. */
 interface SessionTrace {
   /** Highest `seq` seen so far (must strictly increase). */
@@ -82,32 +68,32 @@ interface SessionTrace {
   surface: number[]
 }
 
+/** One accepted event's deferred mutation of a live session trace. */
+interface SessionTraceTransition {
+  /** Scalar state after the event commits. */
+  scalars: Pick<SessionTrace, 'lastSeq' | 'openTurn' | 'openStep' | 'nextTurn' | 'nextStep'>
+  /** The event's mutation of the open step's pending call set. */
+  pendingCalls:
+    | { kind: 'none' }
+    | { kind: 'add' | 'delete'; callId: CallId }
+    | { kind: 'clear' }
+  /** The event's mutation of the derived surface order. */
+  surface:
+    | { kind: 'none' | 'append' }
+    | { kind: 'replace'; start: number; count: number }
+  /** The committed event sequence to add to the known-sequence set. */
+  seq: number
+}
+
 /** Event payload prefix for scoped seams whose first argument names its agent. */
 interface AgentSubject {
   agent: Agent
 }
 
-/**
- * Deep-freeze a value and everything reachable from it.
- *
- * Walks every object's own properties even when the object itself is already
- * frozen: `Session.append()` accepts event data from arbitrary plugins/tools,
- * so a caller can hand us a SHALLOW-frozen object whose descendants are still
- * mutable. Skipping an already-frozen node (the obvious idempotence shortcut)
- * would leave exactly the kind of mutable history the dev-invariants RFC means to catch. A
- * `WeakSet` of visited objects keeps it terminating on cycles and avoids
- * re-walking shared subtrees / already-processed seed events.
- */
-function deepFreeze(value: unknown, seen: WeakSet<object> = new WeakSet()): void {
-  if (value === null || typeof value !== 'object') return
-  if (seen.has(value)) return
-  seen.add(value)
-  // Freeze the node (no-op if a caller pre-froze it), then ALWAYS descend —
-  // a frozen container can still hold mutable children.
-  Object.freeze(value)
-  for (const key of Object.keys(value)) {
-    deepFreeze((value as Record<string, unknown>)[key], seen)
-  }
+/** Structural subject fields used without coupling this dev plugin to owning services. */
+interface ScopedSubjectFields {
+  agent?: Agent
+  scope?: object
 }
 
 /** Assert that a step-scoped event names the currently open turn and step. */
@@ -119,14 +105,19 @@ function requireOpenStep(trace: SessionTrace, kind: string, turn: number, step:
   }
 }
 
-/** Assert one appended event against the per-session invariants. */
-function checkEvent(trace: SessionTrace, event: SessionEvent): void {
+/** Validate one candidate event without mutating the committed session trace. */
+function validateEvent(trace: SessionTrace, event: SessionEvent): SessionTraceTransition {
   // seq is strictly monotonic — the spine of replay equivalence. lastSeq
   // starts at -1, so the first event (seq 0) passes.
   if (event.seq <= trace.lastSeq) {
     throw new InvariantError(`seq must strictly increase: saw ${event.seq} after ${trace.lastSeq}`)
   }
-  trace.lastSeq = event.seq
+  let openTurn = trace.openTurn
+  let openStep = trace.openStep
+  let nextTurn = trace.nextTurn
+  let nextStep = trace.nextStep
+  let pendingCalls: SessionTraceTransition['pendingCalls'] = { kind: 'none' }
+  let surface: SessionTraceTransition['surface'] = { kind: 'none' }
 
   // --- Surface invariants ---
   // Surface metadata (sourceEventSeqs, surfaceOp) is only valid on
@@ -168,7 +159,7 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void {
   // positional range — every shadowed node must appear in sourceEventSeqs.
   if (se.surfaceOp !== undefined) {
     if (se.surfaceOp === 'append') {
-      trace.surface.push(event.seq)
+      surface = { kind: 'append' }
     } else {
       const { start, end } = se.surfaceOp
       const startIdx = trace.surface.indexOf(start)
@@ -190,9 +181,7 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void {
       if (missing.length > 0) {
         throw new InvariantError(`surface replace: sourceEventSeqs must include every shadowed surface node; missing ${missing.join(', ')}`)
       }
-      // Apply the replace to the tracked surface: the new node takes the
-      // range's position so order stays in sync for later replaces.
-      trace.surface.splice(startIdx, shadowed.length, event.seq)
+      surface = { kind: 'replace', start: startIdx, count: shadowed.length }
     }
   }
 
@@ -211,8 +200,8 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void {
       if (event.data.turn !== trace.nextTurn) {
         throw new InvariantError(`turn/start expected turn ${trace.nextTurn}, got ${event.data.turn}`)
       }
-      trace.openTurn = event.data.turn
-      trace.nextStep = 1
+      openTurn = event.data.turn
+      nextStep = 1
       break
     }
     case 'turn/end': {
@@ -222,8 +211,8 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void {
       if (trace.openStep !== null) {
         throw new InvariantError(`turn/end ${event.data.turn} while step ${trace.openStep} is still open`)
       }
-      trace.openTurn = null
-      trace.nextTurn += 1
+      openTurn = null
+      nextTurn += 1
       break
     }
     case 'step/start': {
@@ -237,16 +226,16 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void {
       if (event.data.step !== trace.nextStep) {
         throw new InvariantError(`step/start expected step ${trace.nextStep} in turn ${event.data.turn}, got ${event.data.step}`)
       }
-      trace.openStep = event.data.step
+      openStep = event.data.step
       break
     }
     case 'step/end': {
       requireOpenStep(trace, 'step/end', event.data.turn, event.data.step)
       // A result must arrive in the step that issued the call; orphan calls
       // (a step that errored before its result) do not carry to the next step.
-      trace.pendingCalls.clear()
-      trace.openStep = null
-      trace.nextStep += 1
+      pendingCalls = { kind: 'clear' }
+      openStep = null
+      nextStep += 1
       break
     }
     case 'assistant/chunk': {
@@ -259,7 +248,7 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void {
     }
     case 'tool/call': {
       requireOpenStep(trace, 'tool/call', event.data.turn, event.data.step)
-      trace.pendingCalls.add(event.data.callId)
+      pendingCalls = { kind: 'add', callId: event.data.callId }
       break
     }
     case 'tool/result': {
@@ -268,9 +257,10 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void {
       // does NOT hold: a call may have no result — a throwing tool-execution
       // pipeline step ends the turn with no tool/result, which is legal.)
       const syntheticInterrupted = event.data.isError && event.data.error?.code === 'interrupted'
-      if (!trace.pendingCalls.delete(event.data.callId) && !syntheticInterrupted) {
+      if (!trace.pendingCalls.has(event.data.callId) && !syntheticInterrupted) {
         throw new InvariantError(`tool/result for ${event.data.callId} with no prior tool/call in this step`)
       }
+      pendingCalls = { kind: 'delete', callId: event.data.callId }
       break
     }
     // Turn-enclosure (the turn-enclosure RFC): EVERY session event not handled by a boundary
@@ -290,8 +280,52 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void {
       break
     }
   }
-  // Track every seq seen — used above to validate sourceEventSeqs references.
-  trace.knownSeqs.add(event.seq)
+  return {
+    scalars: { lastSeq: event.seq, openTurn, openStep, nextTurn, nextStep },
+    pendingCalls,
+    surface,
+    seq: event.seq,
+  }
+}
+
+/** Apply one already-validated transition after its event commits. */
+function applyTransition(trace: SessionTrace, transition: SessionTraceTransition): void {
+  Object.assign(trace, transition.scalars)
+  switch (transition.pendingCalls.kind) {
+    case 'none':
+      break
+    case 'add':
+      trace.pendingCalls.add(transition.pendingCalls.callId)
+      break
+    case 'delete':
+      trace.pendingCalls.delete(transition.pendingCalls.callId)
+      break
+    case 'clear':
+      trace.pendingCalls.clear()
+      break
+    /* v8 ignore next -- validateEvent produces this closed transition union */
+    default:
+      assertNever(transition.pendingCalls, 'session trace pending-call transition')
+  }
+  switch (transition.surface.kind) {
+    case 'none':
+      break
+    case 'append':
+      trace.surface.push(transition.seq)
+      break
+    case 'replace':
+      trace.surface.splice(transition.surface.start, transition.surface.count, transition.seq)
+      break
+    /* v8 ignore next -- validateEvent produces this closed transition union */
+    default:
+      assertNever(transition.surface, 'session trace surface transition')
+  }
+  trace.knownSeqs.add(transition.seq)
+}
+
+/** Validate and apply one event while rebuilding an already-committed log. */
+function replayEvent(trace: SessionTrace, event: SessionEvent): void {
+  applyTransition(trace, validateEvent(trace, event))
 }
 
 /** Legal agent status transitions (the only state machine the loop guarantees). */
@@ -311,14 +345,19 @@ function checkTransition(from: AgentStatus | undefined, to: AgentStatus): void {
 
 /**
  * Register the dev-mode invariants. Contributions are effect-scoped, so
- * disposing the plugin fiber removes all listeners and stops freezing
- * (HMR-safe). On (re-)apply the trace state is rebuilt by replaying each
- * existing session's log, so a hot reload mid-turn does not falsely reject the
- * next event.
+ * disposing the plugin fiber removes all listeners (HMR-safe). On (re-)apply
+ * the trace state is rebuilt by replaying each existing session's log, so a
+ * hot reload mid-turn does not falsely reject the next event.
+ *
+ * @param ctx - Cordis context that receives the invariant listeners.
  */
-export function apply(ctx: Context, config: Config = {}): void {
-  const freeze = config.freeze ?? true
+export function apply(ctx: Context): void {
   const traces = new WeakMap<Session, SessionTrace>()
+  const stagedTransitions = new WeakMap<SessionEvent, {
+    session: Session
+    trace: SessionTrace
+    transition: SessionTraceTransition
+  }>()
   // Agent status has no stored history to replay; the first observation after
   // (re-)apply seeds the baseline, so a reload never produces a false positive.
   const lastStatus = new WeakMap<Agent, AgentStatus>()
@@ -334,20 +373,19 @@ export function apply(ctx: Context, config: Config = {}): void {
     surface: [],
   })
 
-  /** Build (or rebuild) a session's trace by replaying its whole log; freeze it. */
+  /** Build (or rebuild) a session's trace by replaying its whole log. */
   const seedSession = (session: Session): SessionTrace => {
     const trace = freshTrace()
     traces.set(session, trace)
     for (const event of session.events) {
-      checkEvent(trace, event)
-      if (freeze) deepFreeze(event)
+      replayEvent(trace, event)
     }
     return trace
   }
 
   // Every store-created session (the only kind that emits session/event) is
-  // seeded first — via ctx.sessions.list() at apply or session/created — so
-  // the fallback is a defensive guard, never hit in practice.
+  // seeded first — via ctx.sessions.list() at apply or session/created — so the
+  // fallback is a defensive guard, never hit in practice.
   /* v8 ignore next -- traceFor's fallback: session/event always follows a seed */
   const traceFor = (session: Session): SessionTrace => traces.get(session) ?? seedSession(session)
 
@@ -358,17 +396,25 @@ export function apply(ctx: Context, config: Config = {}): void {
 
   // A newly created session may arrive seeded/forked (the constructor copies
   // the seed WITHOUT emitting session/event), so replay its log here too.
-  ctx.on('session/created', (session) => { seedSession(session) })
+  ctx.on('session/created', (session) => { seedSession(session) }, { global: true })
 
   ctx.on('session/event', (session, event) => {
-    checkEvent(traceFor(session), event)
-    if (freeze) deepFreeze(event)
-  })
+    // Session resolves dispatch before committing, so internal/dispatch has
+    // already staged this exact event. A later dispatch veto skips every
+    // session/event callback and therefore leaves the live trace unchanged.
+    const staged = stagedTransitions.get(event)
+    /* v8 ignore next 2 -- internal/dispatch stages the exact callback arguments */
+    if (staged === undefined || staged.session !== session) {
+      throw new InvariantError('session/event reached publication without matching pre-commit validation')
+    }
+    stagedTransitions.delete(event)
+    applyTransition(staged.trace, staged.transition)
+  }, { global: true })
 
   ctx.on('agent/status', (agent, status) => {
     checkTransition(lastStatus.get(agent), status)
     lastStatus.set(agent, status)
-  })
+  }, { global: true })
 
   // --- Scoped-dispatch invariants (the agent-scoping seam) ---------------
   //
@@ -398,12 +444,13 @@ export function apply(ctx: Context, config: Config = {}): void {
     'agent/turn-stop': args => args[0],
     'agent/error': args => args[0],
     'approval/request': args => (args[0] as AgentSubject).agent,
-    'tools/pre-execute': args => (args[0] as ToolExecution).agent,
-    'tools/execute': args => (args[0] as ToolExecution).agent,
-    'tools/post-execute': args => (args[0] as ToolExecution).agent,
-    'tools/result': args => (args[0] as ToolExecution).agent,
-    'system-prompt/assemble': args => (args[1] as AssembleContext).scope,
+    'tools/pre-execute': args => (args[0] as ScopedSubjectFields).agent,
+    'tools/execute': args => (args[0] as ScopedSubjectFields).agent,
+    'tools/post-execute': args => (args[0] as ScopedSubjectFields).agent,
+    'tools/result': args => (args[0] as ScopedSubjectFields).agent,
+    'system-prompt/assemble': args => (args[1] as ScopedSubjectFields).scope,
     'session/created': null,
+    'session/disposed': null,
     'session/event': null,
     'session/flush': null,
     'subagent/start': null,
@@ -422,46 +469,18 @@ export function apply(ctx: Context, config: Config = {}): void {
         `"${name}" was dispatched with a scope carrier keyed to a DIFFERENT subject than its arguments name — `
         + 'the carrier key and the event\'s subject must be the same object (use agentEvents(ctx, agent))')
     }
-    // The assembly context must never carry the agent DX field without the
-    // scope layer selector: the assembly would silently miss the agent's
-    // scoped sections/tools (use assembleContextFor(agent)).
-    if (name === 'system-prompt/assemble') {
-      const context = args[1] as AssembleContext
-      if (context.agent !== undefined && context.scope !== context.agent) {
-        throw new InvariantError(
-          'an assembly context carries `agent` without `scope` (or with a mismatched scope) — '
-          + 'use assembleContextFor(agent) so the assembly resolves the agent\'s scoped layer')
-      }
+    if (name === 'session/event') {
+      const [session, event] = args as [Session, SessionEvent]
+      const trace = traceFor(session)
+      const transition = validateEvent(trace, event)
+      // The exact event identity reaches the contained post-commit listener.
+      // A later internal/dispatch listener may still veto; because validation
+      // is pure, abandoning this weakly keyed transition does not advance the
+      // committed trace or retain the session.
+      stagedTransitions.set(event, { session, trace, transition })
     }
   }, { global: true })
 
-  // --- Setup-drives invariant ---------------------------------------------
-  //
-  // CreateAgentOptions.setup COMPOSES the agent's scoped world; it must not
-  // DRIVE the agent. ReactLoopAgent rejects every driving verb structurally
-  // until rollback-covered publication reaches the session-start boundary; this event-level invariant remains the
-  // cross-implementation backstop for alternate Agent implementations and raw
-  // session writes. A turn/start appended before agent/session-start is a
-  // creation-time misuse, reported at the appending call site. Sessions of
-  // agents that exist BEFORE this plugin applies are marked started (their
-  // ordering is unknowable after the fact — never a false positive on HMR).
-  // `agents` is read via ctx.get (a strict, optional store lookup) rather
-  // than injected: the invariants plugin must load in harnesses that carry
-  // no agent registry at all (bare session tests), where this check simply
-  // never trips.
-  const sessionStarted = new WeakSet<Session>()
-  for (const agent of ctx.get('agents')?.list() ?? []) sessionStarted.add(agent.session)
-  ctx.on('agent/session-start', (agent) => { sessionStarted.add(agent.session) })
-  ctx.on('session/event', (session, event) => {
-    if (event.type !== 'turn/start' || sessionStarted.has(session)) return
-    const owner = ctx.get('agents')?.list().find(agent => agent.session === session)
-    if (owner === undefined) return
-    throw new InvariantError(
-      `agent "${owner.id}": a turn opened before agent/session-start fired — `
-      + 'CreateAgentOptions.setup composes the scoped world, it must not drive the agent '
-      + '(send/steer/inject belong after creation returns)')
-  })
-
   // Request-reconstruction cross-check (the reconstructability RFC): a
   // loop-built request — frozen envelope + live sessionId is the marker; a
   // hand-built one-shot (compaction summarize) is unfrozen and skipped — must
@@ -537,5 +556,5 @@ export function apply(ctx: Context, config: Config = {}): void {
       throw new InvariantError(`llm request for session "${String(session.id)}" diverges from the folded request header`)
     }
     return next()
-  }, { prepend: true })
+  }, { global: true, prepend: true })
 }
diff --git a/packages/support/invariants/tests/invariants.spec.ts b/packages/support/invariants/tests/invariants.spec.ts
index ad3792b302..5c26b1f4d7 100644
--- a/packages/support/invariants/tests/invariants.spec.ts
+++ b/packages/support/invariants/tests/invariants.spec.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
-import { scopeTarget } from '@deepseek-ai/dsh-scope'
+import { createScope, scopeTarget } from '@deepseek-ai/dsh-scope'
 import { CallId } from '@deepseek-ai/dsh-llm'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import SessionStore, { Session, SessionId } from '@deepseek-ai/dsh-session'
@@ -8,10 +8,10 @@ import * as Invariants from '@deepseek-ai/dsh-invariants'
 import { InvariantError } from '@deepseek-ai/dsh-invariants'
 
 /** A Context with the session store and the invariants plugin registered. */
-async function setup(config?: { freeze?: boolean }) {
+async function setup() {
   const ctx = new Context()
   await ctx.plugin(SessionStore)
-  const fiber = await ctx.plugin(Invariants, config ?? {})
+  const fiber = await ctx.plugin(Invariants)
   return { ctx, fiber }
 }
 
@@ -21,8 +21,27 @@ function mockAgent(id: string): Agent {
 }
 
 describe('session-log invariants', () => {
+  it('keeps pre-commit staging and post-commit application global when mounted under a scope', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    let scopedCtx!: Context
+    await ctx.plugin(Object.assign((inner: Context) => {
+      scopedCtx = createScope(inner, {}).ctx
+    }, { inject: ['sessions'] }))
+    await scopedCtx.plugin(Invariants)
+    const globalSession = ctx.sessions.create(SessionId('global-under-scoped-invariants'))
+
+    expect(() => {
+      globalSession.append('turn/start', {
+        turn: 1,
+        trigger: { kind: 'message', source: { kind: 'user' } },
+      })
+      globalSession.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    }).not.toThrow()
+  })
+
   it('accepts a well-formed turn/step/tool sequence', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     expect(() => {
       session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
@@ -37,8 +56,49 @@ describe('session-log invariants', () => {
     }).not.toThrow()
   })
 
+  it('does not advance the trace when a later internal-dispatch listener vetoes', async () => {
+    const { ctx } = await setup()
+    const session = ctx.sessions.create(SessionId('dispatch-veto-rollback'))
+    let veto = true
+    ctx.on('internal/dispatch', (_mode, name) => {
+      if (name !== 'session/event' || !veto) return
+      veto = false
+      throw new Error('later dispatch veto')
+    })
+
+    expect(() => session.append('turn/start', {
+      turn: 1,
+      trigger: { kind: 'message', source: { kind: 'user' } },
+    })).toThrow('later dispatch veto')
+    expect(session.events).toEqual([])
+
+    expect(() => {
+      session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+      session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    }).not.toThrow()
+    expect(session.events.map(event => event.type)).toEqual(['turn/start', 'turn/end'])
+  })
+
+  it('applies the committed transition after a prepended observer throws', async () => {
+    const { ctx } = await setup()
+    const warnings: string[] = []
+    ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn
+    const session = ctx.sessions.create(SessionId('postcommit-peer'))
+    ctx.on('session/event', () => { throw new Error('hostile observer') }, { prepend: true })
+
+    expect(() => {
+      session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+      session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
+    }).not.toThrow()
+    expect(session.events.map(event => event.type)).toEqual(['turn/start', 'turn/end'])
+    expect(warnings).toEqual([
+      'session "postcommit-peer": session/event listener threw: Error: hostile observer',
+      'session "postcommit-peer": session/event listener threw: Error: hostile observer',
+    ])
+  })
+
   it('rejects a non-monotonic seq (replay spine)', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     // Session.append enforces seq-contiguity at the source, so drive the
     // invariants seq check directly via session/event with a regressing seq.
@@ -48,7 +108,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a turn/start while another turn is open', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     expect(() => session.append('turn/start', { turn: 2, trigger: { kind: 'message', source: { kind: 'user' } } }))
@@ -56,7 +116,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a turn/end that does not match the open turn', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     expect(() => session.append('turn/end', { turn: 2, reason: { kind: 'completed' } }))
@@ -64,14 +124,14 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a step/start outside its declared turn', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     expect(() => session.append('step/start', { turn: 2, step: 1 })).toThrow(/open turn is 1/)
   })
 
   it('rejects a step/end that does not match the open step', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('step/start', { turn: 1, step: 1 })
@@ -79,7 +139,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects an assistant/chunk outside an open step', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     expect(() => session.append('assistant/chunk', { turn: 1, step: 1, chunk: { type: 'text-delta', index: 0, text: 'x' } }))
@@ -87,7 +147,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a message event appended outside any open turn (turn-enclosure)', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     // No turn open: every message-bearing event must be turn-enclosed (the turn-enclosure RFC).
     expect(() => session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' }))
@@ -97,7 +157,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects steering and plugin-added events appended outside any open turn', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     // steering/message is turn-scoped: outside a turn it would land past the
     // commit boundary and be dropped on resume (the turn-enclosure RFC).
@@ -113,7 +173,7 @@ describe('session-log invariants', () => {
   })
 
   it('accepts message events once a turn is open', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     expect(() => session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' }))
@@ -121,7 +181,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a tool/result with no prior tool/call', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('step/start', { turn: 1, step: 1 })
@@ -130,7 +190,7 @@ describe('session-log invariants', () => {
   })
 
   it('allows a synthetic interrupted tool/result from crash repair without a prior tool/call event', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     expect(() => {
       session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
@@ -152,7 +212,7 @@ describe('session-log invariants', () => {
   })
 
   it('allows a tool/call with no matching tool/result (thrown waterfall ends the step)', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     expect(() => {
       session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
@@ -164,7 +224,7 @@ describe('session-log invariants', () => {
   })
 
   it('holds seeded sessions to the contract on session/created', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     // A seq-contiguous, serializable seed (so it passes Session's constructor
     // validation) that nonetheless violates turn nesting — a second turn/start
     // while the first turn is still open — must be rejected by the invariants
@@ -177,7 +237,7 @@ describe('session-log invariants', () => {
   })
 
   it('tracks turns per session independently', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const a = ctx.sessions.create(SessionId('a'))
     const b = ctx.sessions.create(SessionId('b'))
     a.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
@@ -186,7 +246,7 @@ describe('session-log invariants', () => {
   })
 
   it('accepts multiple steps in a turn and consecutive turns', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     expect(() => {
       session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
@@ -203,7 +263,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a skipped turn number', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
@@ -212,7 +272,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a skipped step number within a turn', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('step/start', { turn: 1, step: 1 })
@@ -222,7 +282,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a turn/end while a step is still open', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('step/start', { turn: 1, step: 1 })
@@ -231,7 +291,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a step/start while a step is still open', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('step/start', { turn: 1, step: 1 })
@@ -239,7 +299,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects a tool/result satisfying a call from a previous step', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('step/start', { turn: 1, step: 1 })
@@ -252,7 +312,7 @@ describe('session-log invariants', () => {
   })
 
   it('rejects an assistant/message naming the wrong step', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('step/start', { turn: 1, step: 1 })
@@ -266,7 +326,7 @@ describe('HMR state rebuild', () => {
     const ctx = new Context()
     await ctx.plugin(SessionStore)
     // First registration, mid-turn: a turn is open when the plugin reloads.
-    const first = await ctx.plugin(Invariants, { freeze: false })
+    const first = await ctx.plugin(Invariants)
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('step/start', { turn: 1, step: 1 })
@@ -274,7 +334,7 @@ describe('HMR state rebuild', () => {
 
     // Re-apply (HMR): the fresh fiber must replay the existing log so the open
     // step is known — the next chunk must NOT be a false positive.
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
     expect(() => session.append('assistant/chunk', { turn: 1, step: 1, chunk: { type: 'text-delta', index: 0, text: 'h' } }))
       .not.toThrow()
     // And a genuine violation is still caught after the rebuild.
@@ -283,76 +343,49 @@ describe('HMR state rebuild', () => {
   })
 })
 
-describe('dev-freeze', () => {
-  it('freezes appended event data so mutating a logged event throws', async () => {
-    const { ctx } = await setup() // freeze defaults true
-    const session = ctx.sessions.create()
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
+describe('session immutability', () => {
+  it('always freezes appended event data without the invariants plugin', () => {
+    const session = new Session(SessionId('appended'))
     const event = session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
     expect(Object.isFrozen(event)).toBe(true)
     expect(Object.isFrozen(event.data)).toBe(true)
     expect(Object.isFrozen(event.data.content)).toBe(true)
+    expect(Object.isFrozen(event.data.content[0])).toBe(true)
+    expect(Object.isFrozen(session.events)).toBe(true)
     expect(() => { (event.data.content[0] as { text: string }).text = 'HACKED' }).toThrow()
   })
 
-  it('does not freeze when freeze:false', async () => {
-    const { ctx } = await setup({ freeze: false })
-    const session = ctx.sessions.create()
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
-    const event = session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
-    expect(Object.isFrozen(event)).toBe(false)
-  })
-
-  it('freezes seeded events on session/created', async () => {
-    const { ctx } = await setup()
+  it('always freezes seeded events without the invariants plugin', () => {
     const seed = [
       { type: 'turn/start' as const, seq: 0, time: 0, data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } } },
       { type: 'user/message' as const, seq: 1, time: 0, data: { content: [{ type: 'text' as const, text: 'seeded' }], source: { kind: 'user' as const } }, surfaceOp: 'append' as const },
     ]
-    const session = ctx.sessions.create(undefined, { seed })
+    const session = new Session(SessionId('seeded'), seed)
+    expect(Object.isFrozen(seed[0])).toBe(false)
+    expect(Object.isFrozen(session.events)).toBe(true)
     expect(Object.isFrozen(session.events[0])).toBe(true)
+    expect(Object.isFrozen(session.events[0]?.data)).toBe(true)
+    expect(Object.isFrozen(session.events[1]?.data)).toBe(true)
   })
 
-  it('freezes mutable descendants of a shallow-frozen event datum', async () => {
-    const { ctx } = await setup()
-    const session = ctx.sessions.create()
-    session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
-    // A caller hands in a SHALLOW-frozen block whose nested array is still
-    // mutable. deepFreeze must descend into the already-frozen object and
-    // freeze the descendant, not short-circuit on the frozen container —
-    // otherwise dev-mode misses exactly the history mutation the dev-invariants RFC catches.
-    // `append` snapshots `data`, so the freeze applies to the LOGGED clone, not
-    // the caller's input — read the event back and assert on its data.
+  it('snapshots and freezes descendants of a shallow-frozen caller value', () => {
+    const session = new Session(SessionId('shallow-frozen'))
     const innerContent: { type: 'text'; text: string }[] = [{ type: 'text', text: 'inner' }]
     const block = Object.freeze({ type: 'tool-result' as const, toolCallId: CallId('c1'), content: innerContent, isError: false })
     const event = session.append('user/message', { content: [block], source: { kind: 'user' } }, { surfaceOp: 'append' })
     const logged = event.data.content[0] as { content: { type: 'text'; text: string }[] }
+    expect(Object.isFrozen(innerContent)).toBe(false)
     expect(Object.isFrozen(logged.content)).toBe(true)
     expect(Object.isFrozen(logged.content[0])).toBe(true)
+    innerContent[0]!.text = 'caller mutation'
+    expect(logged.content[0]!.text).toBe('inner')
     expect(() => { logged.content.push({ type: 'text', text: 'mutation' }) }).toThrow()
   })
-
-  it('terminates on a cyclic event datum (WeakSet guard)', async () => {
-    const { ctx } = await setup()
-    const session = ctx.sessions.create()
-    // The deep-freeze WeakSet guard must terminate on a self-referential
-    // structure rather than recursing forever. Session.append now rejects
-    // non-serializable (incl. cyclic) data at the source, so drive the freeze
-    // handler directly via hand-built session/events — exactly the shape the
-    // invariants listener receives. Open a turn first (seq 0) so the cyclic
-    // user/message (seq 1) satisfies the turn-enclosure invariant.
-    ctx.emit(scopeTarget(session, undefined), 'session/event', session, { type: 'turn/start', seq: 0, time: 1, data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } } } as never)
-    const cyclic: Record<string, unknown> = { type: 'text', text: 'x' }
-    cyclic['self'] = cyclic
-    const event = { type: 'user/message', seq: 1, time: 1, data: { content: [cyclic], source: { kind: 'user' } } }
-    expect(() => { ctx.emit(scopeTarget(session, undefined), 'session/event', session, event as never) }).not.toThrow()
-    expect(Object.isFrozen(cyclic)).toBe(true)
-  })
 })
 
 describe('agent status invariants', () => {
   it('accepts legal transitions: idle→running→idle and →disposed', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const agent = mockAgent('a1')
     expect(() => {
       ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'idle')
@@ -363,28 +396,28 @@ describe('agent status invariants', () => {
   })
 
   it('accepts running→disposed', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const agent = mockAgent('a2')
     ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'running')
     expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'disposed') }).not.toThrow()
   })
 
   it('rejects a no-op transition', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const agent = mockAgent('a3')
     ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'running')
     expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'running') }).toThrow(/no-op transition/)
   })
 
   it('rejects leaving the terminal disposed state', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const agent = mockAgent('a4')
     ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'disposed')
     expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'idle') }).toThrow(/left terminal state disposed/)
   })
 
   it('tracks status per agent independently', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const a = mockAgent('a5')
     const b = mockAgent('b5')
     ctx.emit(scopeTarget(a, a), 'agent/status', a, 'running')
@@ -401,10 +434,10 @@ describe('HMR safety', () => {
 
     await fiber.dispose()
 
-    // After disposal: no freezing, no assertions. An event that WOULD have
-    // violated the open-turn rule now passes silently, and is not frozen.
+    // After disposal the plugin's assertions are gone, so an event that would
+    // violate the open-turn rule passes. Session still owns immutability.
     const event = session.append('turn/start', { turn: 2, trigger: { kind: 'message', source: { kind: 'user' } } })
-    expect(Object.isFrozen(event)).toBe(false)
+    expect(Object.isFrozen(event)).toBe(true)
     // A no-op status transition no longer throws either.
     const agent = mockAgent('hmr')
     ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'idle')
@@ -419,16 +452,17 @@ describe('HMR safety', () => {
     expect(err.message).toBe('invariant violated: seq must strictly increase')
   })
 
-  it('does not leak listeners across dispose (no stale freezing)', async () => {
+  it('does not leak listeners across dispose', async () => {
     const { ctx, fiber } = await setup()
     await fiber.dispose()
     const spy = vi.fn()
     ctx.on('session/event', spy)
     const session = ctx.sessions.create()
     session.append('user/message', { content: [{ type: 'text', text: 'x' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
-    // our own spy fires, proving events still flow — but the plugin's frozen.
+    // The spy proves events still flow after plugin disposal. Session, not the
+    // disposed listener, freezes the accepted record.
     expect(spy).toHaveBeenCalledOnce()
-    expect(Object.isFrozen(session.events[0])).toBe(false)
+    expect(Object.isFrozen(session.events[0])).toBe(true)
   })
 })
 
@@ -640,7 +674,7 @@ describe('surface invariants', () => {
   })
 
   it('catches an incomplete-provenance replace on the load/seed path', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const badSeed = [
       { type: 'turn/start' as const, seq: 0, time: 0, data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } } },
       { type: 'step/start' as const, seq: 1, time: 0, data: { turn: 1, step: 1 } },
@@ -655,10 +689,10 @@ describe('surface invariants', () => {
     const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
-    // Type system prevents surface metadata on non-surface events; this test
-    // exercises the runtime guard against casts or persisted-data bypass.
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return
-    expect(() => (session.append as any)('turn/end', { turn: 1, reason: { kind: 'completed' } }, { sourceEventSeqs: [0] }))
+    // Session rejects this at its own acceptance boundary. Emit a hand-built
+    // record to cover the listener's defensive check for alternate producers.
+    const event = { type: 'turn/end', seq: 1, time: 1, data: { turn: 1, reason: { kind: 'completed' } }, sourceEventSeqs: [0] }
+    expect(() => { ctx.emit(scopeTarget(session, undefined), 'session/event', session, event as never) })
       .toThrow(/cannot carry sourceEventSeqs/)
   })
 
@@ -666,8 +700,8 @@ describe('surface invariants', () => {
     const { ctx } = await setup()
     const session = ctx.sessions.create()
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return
-    expect(() => (session.append as any)('turn/end', { turn: 1, reason: { kind: 'completed' } }, { surfaceOp: 'append' }))
+    const event = { type: 'turn/end', seq: 1, time: 1, data: { turn: 1, reason: { kind: 'completed' } }, surfaceOp: 'append' }
+    expect(() => { ctx.emit(scopeTarget(session, undefined), 'session/event', session, event as never) })
       .toThrow(/cannot carry surfaceOp/)
   })
 })
@@ -675,7 +709,7 @@ describe('surface invariants', () => {
 describe('request-reconstruction cross-check (llm/stream)', () => {
   /** Session with a boundary: one derivable user message, an open step, and the header event the loop would have logged. */
   async function requestSetup() {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create(SessionId('req-check'))
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' })
@@ -737,7 +771,7 @@ describe('request-reconstruction cross-check (llm/stream)', () => {
   })
 
   it('rejects a loop-built request with no header event or no step/start in its log', async () => {
-    const { ctx } = await setup({ freeze: false })
+    const { ctx } = await setup()
     const session = ctx.sessions.create(SessionId('req-bare'))
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
     const bare = Object.freeze({ model: 'm', messages: Object.freeze([]), sessionId: session.id })
@@ -778,7 +812,7 @@ describe('request cross-check ordering (prepend)', () => {
     const ctx = new Context()
     await ctx.plugin(SessionStore)
     ctx.on('llm/stream', () => (async function* () {})() as never) // short-circuits, no next()
-    await ctx.plugin(Invariants, { freeze: false })
+    await ctx.plugin(Invariants)
 
     const session = ctx.sessions.create(SessionId('prepend-check'))
     session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
@@ -859,53 +893,4 @@ describe('scoped-dispatch invariants', () => {
       .not.toThrow()
   })
 
-  it('rejects an assembly context carrying agent without scope', async () => {
-    const ctx = await scopedCtx()
-    const agent = { id: 'a1' } as unknown as Agent
-    const base = { name: 'systemPrompt' }
-    const assembly = { sections: [], tools: [], variables: {} }
-    const bad = { agent }
-    expect(() => {
-      // The carrier base stands in for the SystemPrompt service (the declared `this`); the invariant only reads the carrier marks.
-      void ctx.waterfall(scopeTarget(base, undefined) as never, 'system-prompt/assemble', assembly as never, bad as never, () => Promise.resolve(assembly as never))
-    }).toThrow(/agent.*without.*scope|assembleContextFor/)
-    const good = { agent, scope: agent }
-    expect(() => {
-      void ctx.waterfall(scopeTarget(base, agent) as never, 'system-prompt/assemble', assembly as never, good as never, () => Promise.resolve(assembly as never))
-    }).not.toThrow()
-  })
-
-  it('backstops alternate agents that open a turn before agent/session-start', async () => {
-    const ctx = await scopedCtx()
-    // A live agent whose session is in the store but whose session-start has
-    // not fired: appending turn/start must throw the teaching error.
-    const session = ctx.sessions.create(SessionId('drive-s'))
-    const agent = { id: 'driver', session } as unknown as Agent
-    // Provide a minimal agents lookup: the invariant reads ctx.get('agents').
-    const registryStub = { list: () => [agent] }
-    ctx.root.provide('agents', registryStub as never)
-    expect(() => {
-      session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
-    }).toThrow(/turn opened before agent\/session-start/)
-    // After session-start fires, turns open freely.
-    ctx.emit(scopeTarget(agent, agent), 'agent/session-start', agent, 'startup')
-    expect(() => {
-      session.append('turn/end', { turn: 1, reason: { kind: 'completed' } })
-      session.append('turn/start', { turn: 2, trigger: { kind: 'message', source: { kind: 'user' } } })
-    }).not.toThrow()
-  })
-
-  it('marks sessions of agents that predate the plugin as started (HMR re-apply safety)', async () => {
-    const ctx = new Context()
-    await ctx.plugin(SessionStore)
-    const session = ctx.sessions.create(SessionId('pre-s'))
-    const agent = { id: 'pre', session } as unknown as Agent
-    ctx.root.provide('agents', { list: () => [agent] } as never)
-    // Invariants apply AFTER the agent exists: its ordering is unknowable, so
-    // a turn opening without an observed session-start must NOT false-positive.
-    await ctx.plugin(Invariants)
-    expect(() => {
-      session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } })
-    }).not.toThrow()
-  })
 })
diff --git a/packages/support/invariants/tsconfig.json b/packages/support/invariants/tsconfig.json
index 88944f779e..cd17f67d7c 100644
--- a/packages/support/invariants/tsconfig.json
+++ b/packages/support/invariants/tsconfig.json
@@ -25,12 +25,6 @@
     },
     {
       "path": "../../core/scope"
-    },
-    {
-      "path": "../../core/system-prompt"
-    },
-    {
-      "path": "../../core/tools"
     }
   ]
 }
diff --git a/packages/support/subagent-mock/README.md b/packages/support/subagent-mock/README.md
index 89b69c9ccb..50fd64cc00 100644
--- a/packages/support/subagent-mock/README.md
+++ b/packages/support/subagent-mock/README.md
@@ -2,7 +2,7 @@
 
 A scripted `SubagentProvider` for testing the [subagent seam](../../subagent/subagent/README.md) without a model or a real child agent — the subagent analog of [`dsh-llm-replay`](../llm-replay/README.md).
 
-It lets a test drive `ctx.subagents` and the model-facing `dsh-tool-subagent` through the **real cordis Loader / export path**, exercising provider registration, start-time capability validation, the run lifecycle (`result` / `cancel` / `dispose`), and the structured-output branch — all deterministically and keylessly.
+It lets a test drive `ctx.subagents` and the model-facing `dsh-tool-subagent` through the real Cordis loader/export path, exercising provider registration, async start, start-time capability validation, required-signal cancellation, `result`, `dispose`, and structured output deterministically and keylessly.
 
 ## Usage
 
@@ -13,14 +13,13 @@ Load it as a plugin (functional shape: `name`/`inject`/`Config`/`apply`, no defa
 | `name` | `mock` | Registry name to register the provider under. |
 | `reply` | `mock subagent reply` | The scripted child's final answer text. |
 | `stopReason` | `completed` | The stop reason `result` settles with. |
-| `capabilities` | all `true` | Which start-time capabilities (`outputSchema`/`depthLimit`/`toolFilter`/`persona`) the provider advertises. |
-| `inheritsParentContext` | `false` | The context contract to declare; `true` exercises the fork-shaped tool wording in consumer tests. |
+| `capabilities` | all `true` | Which start-time capabilities (`outputSchema`, `depthLimit`, `toolFilter`, and `persona`) the provider advertises. |
+| `inheritsParentContext` | `false` | Conversation-history descriptor: `false` means fresh, while `true` exercises seeded/fork wording. It says nothing about tool, service, scope, or authority inheritance. |
 | `structured` | `{ reply }` | Structured value surfaced when a request carries an `outputSchema` and the capability is on. |
 
-A `cancel()` issued before `result` settles flips the stop reason to `aborted`, so the cancellation path is observable.
+Aborting the required request signal or disposing before `result` settles flips the stop reason to `aborted`, so both holder-facing cancellation paths are observable.
 
 ## Known Limitations and Deferred Work
 
 - **Scripted provider only** — it does not run a model, create a child agent, or exercise real prompt/tool-loop behavior.
-- **One immediate synthetic outcome per run** — it models no multi-turn, streaming, readiness delay, or subprocess transport behavior.
-- **`dispose()` is a no-op** — lifecycle tests using it prove consumer control flow, not resource teardown or quiescence of a real backend.
+- **One synthetic outcome per run** — it models no multi-turn, streaming, steering, resume, or subprocess transport behavior.
diff --git a/packages/support/subagent-mock/src/index.ts b/packages/support/subagent-mock/src/index.ts
index 715c7451d7..abc1a6c5e9 100644
--- a/packages/support/subagent-mock/src/index.ts
+++ b/packages/support/subagent-mock/src/index.ts
@@ -29,11 +29,10 @@ const STOP_REASONS = ['completed', 'aborted', 'error', 'max-tokens', 'refusal']
 const DEFAULT_CAPS: SubagentCapabilities = { outputSchema: true, depthLimit: true, toolFilter: true, persona: true }
 
 /**
- * A scripted provider: every {@link start} returns a run whose `result`
- * resolves on a microtask with the configured reply (and a structured value
- * when the request asked for one and the capability is on). `dispose` is a
- * no-op; a `cancel()` before the result settles flips the stop reason to
- * `aborted`, so the cancellation path is observable in a test.
+ * A scripted provider: every {@link start} returns a ready run whose `result`
+ * resolves on the next task with the configured reply (and a structured value
+ * when the request asked for one and the capability is on). The required
+ * signal and `dispose()` both flip an unsettled result to `aborted`.
  */
 class MockSubagentProvider implements SubagentProvider {
   readonly capabilities: SubagentCapabilities
@@ -47,12 +46,22 @@ class MockSubagentProvider implements SubagentProvider {
     this.inheritsParentContext = config.inheritsParentContext ?? false
   }
 
-  start(request: SubagentStartRequest): SubagentRun {
+  async start(request: SubagentStartRequest): Promise<SubagentRun> {
+    if (request.signal.aborted) throw new Error('mock subagent start aborted before publication')
     const reply = this.config.reply ?? 'mock subagent reply'
     const output: ContentBlock[] = [{ type: 'text', text: reply }]
     const wantsStructured = request.outputSchema !== undefined && this.capabilities.outputSchema
     const baseStop: SubagentStopReason = this.config.stopReason ?? 'completed'
-    let cancelled = false
+    const flags = { cancelled: false }
+    const onAbort = (): void => { flags.cancelled = true }
+    request.signal.addEventListener('abort', onAbort, { once: true })
+    // Make publication genuinely asynchronous so a same-turn abort is still
+    // a provider-owned startup failure rather than a returned live run.
+    await Promise.resolve()
+    if (flags.cancelled) {
+      request.signal.removeEventListener('abort', onAbort)
+      throw new Error('mock subagent start aborted before publication')
+    }
 
     // A deterministic child id derived from the parent — no clock/random (both
     // banned in deterministic paths here, and unnecessary for a scripted run).
@@ -60,21 +69,22 @@ class MockSubagentProvider implements SubagentProvider {
 
     const resultFor = (): SubagentResult => ({
       output,
-      structured: wantsStructured ? (this.config.structured ?? { reply }) : undefined,
-      stopReason: cancelled ? 'aborted' : baseStop,
+      ...wantsStructured ? { structured: this.config.structured ?? { reply } } : {},
+      stopReason: flags.cancelled ? 'aborted' : baseStop,
     })
 
+    const result = new Promise<SubagentResult>((resolve) => {
+      setTimeout(() => { resolve(resultFor()) }, 0)
+    }).finally(() => {
+      request.signal.removeEventListener('abort', onAbort)
+    })
     return {
       id,
-      // A scripted run has no asynchronous publication phase; it is ready as
-      // soon as the provider returns the handle.
-      started: Promise.resolve(),
-      result: Promise.resolve().then(resultFor),
-      cancel() {
-        cancelled = true
-      },
-      async dispose() {
-        // Scripted run holds no resources — nothing to await.
+      result,
+      dispose(): Promise<void> {
+        flags.cancelled = true
+        request.signal.removeEventListener('abort', onAbort)
+        return Promise.resolve()
       },
     }
   }
@@ -94,9 +104,11 @@ export interface Config {
   /** Which start-time capabilities to advertise (default: all `true`). */
   capabilities?: Partial<SubagentCapabilities>
   /**
-   * The context contract to declare ({@link SubagentProvider.inheritsParentContext});
-   * default `false` (spawn-like). Set `true` to exercise the fork-shaped tool
-   * wording in consumer tests.
+   * The conversation-history descriptor to declare
+   * ({@link SubagentProvider.inheritsParentContext}); default `false` (fresh
+   * conversation). Set `true` to exercise seeded/fork wording in consumer
+   * tests. This flag says nothing about tool, service, scope, or authority
+   * inheritance.
    */
   inheritsParentContext?: boolean
   /**
diff --git a/packages/support/subagent-mock/tests/subagent-mock.spec.ts b/packages/support/subagent-mock/tests/subagent-mock.spec.ts
index ddd725da4b..7fd93c62bc 100644
--- a/packages/support/subagent-mock/tests/subagent-mock.spec.ts
+++ b/packages/support/subagent-mock/tests/subagent-mock.spec.ts
@@ -11,7 +11,7 @@ function fakeParent(id = 'parent-1'): Agent {
 }
 
 function baseRequest(over: Partial<SubagentStartRequest> = {}): SubagentStartRequest {
-  return { prompt: [{ type: 'text', text: 'task' }], parent: fakeParent(), ...over }
+  return { prompt: [{ type: 'text', text: 'task' }], parent: fakeParent(), signal: new AbortController().signal, ...over }
 }
 
 async function mount(config: Partial<mock.Config> = {}): Promise<Context> {
@@ -26,12 +26,13 @@ describe('dsh-subagent-mock', () => {
     const ctx = await mount({ reply: 'hello from mock' })
     expect(ctx.subagents.list()).toEqual(['mock'])
 
-    const run = ctx.subagents.start('mock', baseRequest())
+    const run = await ctx.subagents.start('mock', baseRequest())
     await expect(run.result).resolves.toEqual({
       output: [{ type: 'text', text: 'hello from mock' }],
       structured: undefined,
       stopReason: 'completed',
     })
+    await run.dispose()
   })
 
   it('registers under a configurable name', async () => {
@@ -41,13 +42,13 @@ describe('dsh-subagent-mock', () => {
 
   it('surfaces a structured result when the request carries an outputSchema', async () => {
     const ctx = await mount({ reply: 'r', structured: { answer: 42 } })
-    const run = ctx.subagents.start('mock', baseRequest({ outputSchema: { type: 'object', properties: { answer: { type: 'number' } } } }))
+    const run = await ctx.subagents.start('mock', baseRequest({ outputSchema: { type: 'object', properties: { answer: { type: 'number' } } } }))
     await expect(run.result).resolves.toMatchObject({ structured: { answer: 42 } })
   })
 
   it('defaults structured output to { reply } when outputSchema is requested but no structured value is configured', async () => {
     const ctx = await mount({ reply: 'fallback reply' })
-    const run = ctx.subagents.start('mock', baseRequest({ outputSchema: { type: 'object', properties: { answer: { type: 'number' } } } }))
+    const run = await ctx.subagents.start('mock', baseRequest({ outputSchema: { type: 'object', properties: { answer: { type: 'number' } } } }))
     await expect(run.result).resolves.toMatchObject({ structured: { reply: 'fallback reply' } })
   })
 
@@ -56,23 +57,44 @@ describe('dsh-subagent-mock', () => {
     // The service rejects an outputSchema request against a no-cap provider, so
     // the structured path is only reachable when the cap is on; with it off and
     // no schema requested, the result has no structured field.
-    const run = ctx.subagents.start('mock', baseRequest())
-    await expect(run.result).resolves.toMatchObject({ structured: undefined })
+    const run = await ctx.subagents.start('mock', baseRequest())
+    const result = await run.result
+    expect(result).not.toHaveProperty('structured')
   })
 
   it('honors a configured stop reason', async () => {
     const ctx = await mount({ stopReason: 'refusal' })
-    const run = ctx.subagents.start('mock', baseRequest())
+    const run = await ctx.subagents.start('mock', baseRequest())
     await expect(run.result).resolves.toMatchObject({ stopReason: 'refusal' })
   })
 
-  it('flips the stop reason to aborted when cancelled before the result settles', async () => {
+  it('flips the stop reason to aborted when the signal fires before the result settles', async () => {
     const ctx = await mount()
-    const run = ctx.subagents.start('mock', baseRequest())
-    run.cancel()
+    const controller = new AbortController()
+    const run = await ctx.subagents.start('mock', baseRequest({ signal: controller.signal }))
+    controller.abort()
     await expect(run.result).resolves.toMatchObject({ stopReason: 'aborted' })
   })
 
+  it('rejects an already-aborted request before starting publication', async () => {
+    const ctx = await mount()
+    const controller = new AbortController()
+    controller.abort()
+
+    await expect(ctx.subagents.start('mock', baseRequest({ signal: controller.signal })))
+      .rejects.toThrow('mock subagent start aborted before publication')
+  })
+
+  it('rejects when cancellation wins the asynchronous publication handoff', async () => {
+    const ctx = await mount()
+    const controller = new AbortController()
+    const pending = ctx.subagents.start('mock', baseRequest({ signal: controller.signal }))
+
+    controller.abort()
+
+    await expect(pending).rejects.toThrow('mock subagent start aborted before publication')
+  })
+
   it('unregisters the provider when the owning fiber is disposed (HMR safety)', async () => {
     const ctx = new Context()
     await ctx.plugin(SubagentService)
diff --git a/packages/ui/acp/README.md b/packages/ui/acp/README.md
index c657d6c11f..b6b5928eb8 100644
--- a/packages/ui/acp/README.md
+++ b/packages/ui/acp/README.md
@@ -36,7 +36,7 @@ The `initialize` handshake reports a fixed server identity (`agentInfo: { name:
 
 ## Multi-session
 
-The bridge multiplexes N sessions over one connection. Live sessions are held in a `Map<sessionId, SessionRecord>` (forward) with a `WeakMap<Agent, sessionId>` reverse map so `agent/*` events — which carry only the `Agent` — demux in O(1). Every `session/event` and `agent/status` is routed strictly to its owning record, so concurrent sessions never cross-settle or interleave their `session/update` notifications. State is per session: one in-flight prompt each, `session/cancel` aborts and settles only its own agent/prompt, and disposal drains every live session in parallel to quiescence. Permission prompts follow the same ownership: the `approval/request` answerer resolves the owning session through the reverse map and prompts only there.
+The bridge multiplexes N sessions over one connection. Live sessions are held in a `Map<sessionId, SessionRecord>` (forward) with a `WeakMap<Agent, sessionId>` reverse map so agent-scoped approval events demultiplex in O(1). Every `session/event` is routed strictly to its owning record, so concurrent sessions never cross-settle or interleave their `session/update` notifications. State is per session: one in-flight prompt each, `session/cancel` aborts and settles only its own agent/prompt, and disposal drains every live session in parallel to quiescence. Permission prompts follow the same ownership: the `approval/request` answerer resolves the owning session through the reverse map and prompts only there.
 
 ## Session config options
 
@@ -71,7 +71,7 @@ When the client does NOT advertise the capability, none of the `_meta`/terminal
 
 ## Settle-exactly-once
 
-A `session/prompt` resolves (or rejects) exactly once, keyed off the canonical session log (the `session/event` stream). One listener captures the prompt's owning turn from the log's `turn/start` and settles on the matching `turn/end` — the durable boundary event (`closeTurn` appends it unconditionally; there is no `agent/*` turn mirror). A prompt settles only on ITS OWN turn (`inflight.turn === turn/end.turn`), so a stale `turn/end` for a previously-cancelled turn whose end arrives late can never settle the wrong prompt. A turn that ends `error` REJECTS the RPC with an internal error carrying the failure message (ACP has no error stop reason); every other reason resolves via the codec. As a fallback, when the agent settles to `idle`/`disposed` with a prompt still pending — e.g. a peer `session/event` listener registered before the bridge threw and starved the bridge's listener — an `agent/status` handler reconciles the prompt from the log (the owning turn's `turn/end`, or `cancelled` if the turn was torn down without one). An empty/whitespace prompt is rejected up front — it would queue no work, so no turn would start and the RPC would hang.
+A `session/prompt` resolves or rejects exactly once from the canonical `session/event` stream. The listener captures the prompt's owning turn from `turn/start` and settles in a `finally` block when the matching `turn/end` is appended, so a presentation/streaming failure cannot strand the RPC after the durable terminal event exists. Correlation by turn id prevents a late end from a cancelled prompt from settling its successor. A turn ending in `error` rejects the RPC with an internal error carrying the failure message because ACP has no error stop reason; every other reason resolves through the codec. An empty or whitespace-only prompt is rejected before enqueue because it would start no turn and otherwise leave the RPC pending.
 
 ## Permission prompts
 
diff --git a/packages/ui/acp/src/index.ts b/packages/ui/acp/src/index.ts
index a3ce9b5117..5a5ce9e51f 100644
--- a/packages/ui/acp/src/index.ts
+++ b/packages/ui/acp/src/index.ts
@@ -71,7 +71,7 @@ import {
 } from '@agentclientprotocol/sdk'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm'
 import { assertNever, CallId } from '@deepseek-ai/dsh-llm'
-import type { Agent, AgentStatus } from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
 import { AgentId } from '@deepseek-ai/dsh-agent'
 import { SessionId } from '@deepseek-ai/dsh-session'
 import { SANDBOX_MODES, effectiveSandboxMode, setSandboxMode } from '@deepseek-ai/dsh-bash'
@@ -297,7 +297,8 @@ interface SessionRecord {
   /**
    * The in-flight `session/prompt`, or `undefined` when none is pending. A
    * prompt resolves with a {@link StopReason} or rejects with an Error (a
-   * turn that ended in failure). Settled exactly once via {@link settlePrompt}.
+   * turn that ended in failure). Settled exactly once by its matching
+   * `turn/end`, direct cancellation, or teardown.
    *
    * `turn` is the loop turn number this prompt owns, captured from the log's
    * `turn/start` after `send()`. Until then it is `undefined` (the turn has not
@@ -307,18 +308,11 @@ interface SessionRecord {
    * wrong prompt. A direct cancel/dispose settle clears the whole in-flight slot,
    * so a later stale `turn/end` finds no pending prompt.
    *
-   * `logWatermark` is the session log length at the moment the prompt was
-   * installed (before `send()`). The settle-from-log fallback uses it to infer
-   * the owning `turn/start` from the canonical log even when the live
-   * `session/event` capture was starved (a peer listener that throws on
-   * `turn/start` — see `settleFromLog`): the prompt owns the FIRST `turn/start`
-   * appended at or after this watermark.
    */
   inflight: {
     resolve: (reason: StopReason) => void
     reject: (error: Error) => void
     turn: number | undefined
-    logWatermark: number
   } | undefined
   /**
    * Config switches accepted while the session was IDLE, not yet anchored in
@@ -337,13 +331,9 @@ interface SessionRecord {
 
 /**
  * Drive the in-flight prompt's settle from the harness event stream. The bridge
- * settles off the durable log: the `turn/end` session event on the
- * `session/event` feed for the prompt's own turn, with the agent
- * erroring/settling to idle as a fallback (docs/defensive-patterns.md "honor
- * cross-seam contracts on BOTH sides") for the case where a throwing peer `session/event` listener
- * starved the bridge's listener before it saw the boundary. The first of these
- * to fire settles the prompt; `settle` is then cleared so the others are no-ops
- * (settle-exactly-once).
+ * settles off the durable `turn/end` event for the prompt's own turn. Session
+ * contains post-commit observers independently, and this listener performs
+ * correlation in a `finally` so presentation failure cannot starve settlement.
  */
 export function apply(ctx: Context, config: AcpConfig): void {
   // Capture the injected services NOW, during apply(), while we are inside this
@@ -501,83 +491,24 @@ export function apply(ctx: Context, config: AcpConfig): void {
   ctx.on('session/event', (session, event: SessionEvent) => {
     const rec = sessions.get(session.header.id)
     if (rec === undefined) return
-    streamSessionEventUpdate(rec.sessionId, event, notify, rec.presenter, {
-      enabled: rec.terminalEnabled,
-      cwd: session.header.cwd,
-    }, { includeUserMessages: false })
-    const inflight = rec.inflight
-    if (inflight === undefined) return
-    if (event.type === 'turn/start') {
-      // Tag the in-flight prompt with its owning turn — but ONLY a
-      // `message`-triggered turn (the kind a `send()` prompt produces). A turn
-      // a plugin opens between prompt-install and the prompt's own turn (an idle
-      // `agent.inject()` writes a one-shot `injection`-triggered turn) must NOT
-      // be mistaken for the prompt's turn, or its turn/end would settle the RPC
-      // early. The first message turn at/after install owns the prompt
-      // (`turn === undefined` guard); the loop batches queued messages into one
-      // turn, so there is exactly one.
-      if (inflight.turn === undefined && event.data.trigger.kind === 'message') {
-        inflight.turn = event.data.turn
+    try {
+      streamSessionEventUpdate(rec.sessionId, event, notify, rec.presenter, {
+        enabled: rec.terminalEnabled,
+        cwd: session.header.cwd,
+      }, { includeUserMessages: false })
+    } finally {
+      const inflight = rec.inflight
+      if (inflight !== undefined && event.type === 'turn/start') {
+        // The first message-triggered turn after prompt installation owns the
+        // prompt; injection-triggered turns must not settle it early.
+        if (inflight.turn === undefined && event.data.trigger.kind === 'message') {
+          inflight.turn = event.data.turn
+        }
+      } else if (inflight !== undefined && event.type === 'turn/end' && inflight.turn === event.data.turn) {
+        rec.inflight = undefined
+        settleFromTurnEnd(inflight, event.data.reason)
       }
-      return
     }
-    // Settle only on the OWNING turn's end.
-    if (event.type !== 'turn/end' || inflight.turn !== event.data.turn) return
-    rec.inflight = undefined
-    settleFromTurnEnd(inflight, event.data.reason)
-  })
-
-  // Settle fallback: a `session/event` listener registered BEFORE ACP that
-  // throws (on `turn/start` OR `turn/end`) would, via cordis `emit`'s
-  // stop-on-throw, starve ACP's listener above — the prompt would hang or, if
-  // only the turn number was missed, settle as the wrong outcome. So when the
-  // agent settles to `idle` (or is disposed), reconcile against the canonical
-  // log: determine the prompt's owning turn (the captured `turn`, or — if the
-  // live capture was starved — the FIRST `turn/start` appended at/after the
-  // install-time `logWatermark`), then settle from that turn's `turn/end`
-  // (reject on error, resolve via codec), or `cancelled` if no owning turn ever
-  // started. Never double-settles — clears `inflight` first.
-  const settleFromLog = (rec: SessionRecord): void => {
-    const inflight = rec.inflight
-    if (inflight === undefined) return
-    const events = rec.agent.session.events
-    // The owning turn number: the captured one, or — if the live capture was
-    // starved — inferred from the log as the first MESSAGE-triggered turn opened
-    // at/after the watermark. The message-trigger filter matches the live
-    // capture: a one-shot `injection` turn a plugin may open between
-    // prompt-install and the prompt's turn is NOT the prompt's turn. Undefined
-    // only if no message turn ever started for this prompt.
-    const owningTurn = inflight.turn ?? events.slice(inflight.logWatermark).find(
-      (e): e is Extract<SessionEvent, { type: 'turn/start' }> =>
-        e.type === 'turn/start' && e.data.trigger.kind === 'message',
-    )?.data.turn
-    // The owning turn's end in the log. If `owningTurn` is undefined (no turn
-    // ever started for this prompt — a torn-down-before-turn case that quiesce's
-    // direct settle normally pre-empts), no `turn/end` matches (turn numbers are
-    // >= 1) and `findLast` returns undefined, falling through to cancelled.
-    const end = events.findLast(
-      (e): e is Extract<SessionEvent, { type: 'turn/end' }> =>
-        e.type === 'turn/end' && e.data.turn === owningTurn,
-    )
-    rec.inflight = undefined
-    if (end === undefined) {
-      // No owning turn / no clean turn/end (torn down mid-turn) → cancelled.
-      inflight.resolve('cancelled')
-      return
-    }
-    settleFromTurnEnd(inflight, end.data.reason)
-  }
-
-  // On a settle to idle/disposed, reconcile any still-pending prompt from the
-  // log (covers a starved `session/event` listener — see settleFromLog). A mid-
-  // step disposal that never appended a clean turn/end resolves `cancelled`.
-  // Demux via the agent→sessionId reverse map.
-  ctx.on('agent/status', (agent, status: AgentStatus) => {
-    const sessionId = bySession.get(agent)
-    if (sessionId === undefined) return
-    const rec = sessions.get(sessionId)
-    if (rec === undefined) return
-    if (status === 'idle' || status === 'disposed') settleFromLog(rec)
   })
 
   // --- Approval answerer -----------------------------------------------------
@@ -902,12 +833,10 @@ export function apply(ctx: Context, config: AcpConfig): void {
         // Install the in-flight slot BEFORE send() (send does not synchronously
         // flip status to running; the session/event listener records the turn
         // number and settle/rejects it). Capture the log length now as the
-        // watermark: the settle-from-log fallback infers the owning turn/start
-        // as the first one appended at/after it, surviving a starved live
-        // capture. A turn that ends in error rejects this promise (the codec
-        // never produces an error stop reason).
+        // A turn that ends in error rejects this promise (the codec never
+        // produces an error stop reason).
         const stopReason = await new Promise<StopReason>((resolve, reject) => {
-          rec.inflight = { resolve, reject, turn: undefined, logWatermark: rec.agent.session.events.length }
+          rec.inflight = { resolve, reject, turn: undefined }
           rec.agent.send([{ type: 'text', text }])
         })
         return { stopReason }
@@ -926,8 +855,7 @@ export function apply(ctx: Context, config: AcpConfig): void {
         // as cancelled directly here: do NOT rely on the resulting turn/end to
         // settle it, because cancel() may drop the turn before any turn/end is
         // emitted, and removing this direct settle would move the RPC's
-        // resolution onto the settleFromLog/agent-status path, changing its
-        // timing.
+        // resolution onto a later observer path, changing its timing.
         rec.agent.cancel('session/cancel')
         settlePrompt(rec, 'cancelled')
         return Promise.resolve()
@@ -1010,15 +938,15 @@ export function apply(ctx: Context, config: AcpConfig): void {
    * quiescence"): for each session settle any pending prompt `cancelled`, then
    * run that session's {@link AgentHandle} `dispose()` — which stops the loop
    * (sets `disposed`, aborts the in-flight step), AWAITS the loop's exit (the
-   * final `turn/end` + `session/flush` are captured while `onAppend` is still
+   * final `turn/end` + `session/flush` are captured while the store-owned publication hooks are still
    * attached), unregisters the agent, and removes its session from the store.
    * The per-session disposes run in parallel. Idempotent — clears the `sessions`
    * map first and memoizes, so a second call (close racing dispose) is a no-op.
    * Shared by Cordis disposal AND client disconnect (`conn.closed`).
    *
-   * Per-agent disposal closes the former pre-step best-effort window — but via
-   * the DISPOSED path, not `cancel()`: the start-disposer resolves `handle.disposed`,
-   * which wakes the parked loop, and `isDisposed()` breaks the loop before a
+   * Per-agent disposal closes the queued-before-run window through the DISPOSED
+   * path, not `cancel()`: the start-disposer resolves `handle.disposed`, which
+   * wakes the parked loop, and `isDisposed()` breaks the loop before a
    * queued-but-not-yet-running turn can start (a turn cut off mid-flight ends
    * with reason `disposed`, not `aborted`). A bare client disconnect (resolves
    * `conn.closed` WITHOUT disposing the fiber) thus leaves NO registered agent
diff --git a/packages/ui/acp/tests/dispose.spec.ts b/packages/ui/acp/tests/dispose.spec.ts
index 037d00f17e..f02a7b0649 100644
--- a/packages/ui/acp/tests/dispose.spec.ts
+++ b/packages/ui/acp/tests/dispose.spec.ts
@@ -159,8 +159,8 @@ describe('acp bridge — disposal & HMR safety', () => {
   it('the final turn closing events are persisted across an AgentHandle dispose (durability)', async () => {
     // The teardown-ORDER guarantee: a per-agent dispose must stop the loop,
     // AWAIT its exit (so the loop's final `turn/end` + `session/flush` fire
-    // through the still-attached `session.onAppend` → `session/event`), and only
-    // THEN detach onAppend + remove the session. If the order were inverted
+    // through the still-attached store observer → `session/event`), and only
+    // THEN remove its publication hooks and session entry. If the order were inverted
     // (detach first), the closing events would never reach persistence. Drive a
     // CLEAN turn to completion, dispose JUST the bridge, then re-load the
     // persisted log from disk and assert the closing turn/end is on disk — the
@@ -190,7 +190,7 @@ describe('acp bridge — disposal & HMR safety', () => {
     // produced BY the dispose itself. Here the model stream HANGS, so the turn is
     // still open when teardown runs: the composite agent effect stops the loop,
     // the loop unwinds and appends `turn/end {disposed}` + runs its final
-    // `session/flush` — all while `onAppend` is still attached (the session
+    // `session/flush` — all while the store-owned publication hooks are still attached (the session
     // detach is the LAST disposer in the same effect's LIFO chain) — and only
     // THEN is the session detached. If the order were inverted (or the session
     // were a racing SIBLING effect), the abort-produced `turn/end` would never
@@ -255,7 +255,7 @@ describe('acp bridge — disposal & HMR safety', () => {
     // into ONE composite effect whose disposers run as a `.then()` chain. The
     // register disposer emits `agent/disposed`; if a listener throws and the
     // emit is UNCONTAINED, the rejected chain skips the LATER session-detach
-    // disposer — stranding the session in the store with `onAppend` attached (a
+    // disposer — stranding the session in the store with its publication hooks attached (a
     // leak AND a durability hole, since the new design relies on detach
     // running). The emit must be contained. Register a throwing listener, drive
     // a clean turn, dispose, and assert the session was STILL removed.
diff --git a/packages/ui/acp/tests/edges.spec.ts b/packages/ui/acp/tests/edges.spec.ts
index 143bd7193c..e86fb9fc94 100644
--- a/packages/ui/acp/tests/edges.spec.ts
+++ b/packages/ui/acp/tests/edges.spec.ts
@@ -20,7 +20,7 @@ describe('acp bridge — demux & config edges', () => {
 
   it('ignores events from an agent the bridge does not own (strict id demux)', async () => {
     // A second agent created directly on the registry (NOT via the bridge) runs
-    // a turn. Its session/event + agent/status must NOT produce ACP updates and
+    // a turn. Its session events must NOT produce ACP updates and
     // must not settle anything — the bridge demuxes strictly by its own id.
     harness = await makeBridgeHarness({ storageDir, script: [textResponse('foreign')] })
     await harness.client.initialize({ protocolVersion: PROTOCOL_VERSION, clientCapabilities: {} })
diff --git a/packages/ui/acp/tests/turns.spec.ts b/packages/ui/acp/tests/turns.spec.ts
index e182d5f2bf..f559ca36d9 100644
--- a/packages/ui/acp/tests/turns.spec.ts
+++ b/packages/ui/acp/tests/turns.spec.ts
@@ -235,12 +235,9 @@ describe('acp bridge — turn outcomes', () => {
     expect(failed).toHaveLength(1)
   })
 
-  it('settles via the log fallback when a prior session/event listener throws (starvation)', async () => {
-    // A peer session/event listener that runs BEFORE the bridge's listener
-    // throws on turn/end (prepend: true puts it first). cordis emit stops at the
-    // throw, so the bridge's session/event listener never sees turn/end and
-    // cannot settle there. The agent/status idle-fallback must reconcile the
-    // prompt from the log so the RPC settles instead of hanging.
+  it('settles successfully when an earlier turn/end observer throws', async () => {
+    // Session contains each post-commit observer failure, so a prepended peer
+    // cannot starve the bridge's live turn/end delivery.
     harness = await makeBridgeHarness({ storageDir, script: [textResponse('answer')] })
     harness.ctx.on('session/event', (_s, event) => {
       if (event.type === 'turn/end') throw new Error('peer listener boom')
@@ -250,9 +247,7 @@ describe('acp bridge — turn outcomes', () => {
     expect(res.stopReason).toBe('end_turn')
   })
 
-  it('log fallback REJECTS when the starved turn ended in error', async () => {
-    // Same starvation as above, but the turn fails: the idle-fallback must
-    // reject the RPC from the logged turn/end{error}, not resolve.
+  it('still rejects a failed turn when an earlier turn/end observer throws', async () => {
     harness = await makeBridgeHarness({ storageDir, script: [errorResponse('starved boom')] })
     harness.ctx.on('session/event', (_s, event) => {
       if (event.type === 'turn/end') throw new Error('peer listener boom')
@@ -262,21 +257,18 @@ describe('acp bridge — turn outcomes', () => {
       .rejects.toThrow(/turn failed: starved boom/)
   })
 
-  it('log fallback infers the owning turn when turn/START capture is starved', async () => {
-    // A peer listener throws on turn/START (not turn/end): the bridge never
+  it('captures and settles the owning turn when an earlier turn-start observer throws', async () => {
+    // Turn correlation still reaches the bridge after the throwing peer and
     // captures inflight.turn via the live stream. A throwing turn/start listener
-    // also FAILS the turn (the throw is recorded as the turn's error). Without
-    // the watermark inference the fallback would resolve `cancelled` (the bug);
-    // with it, it infers the owning turn from the log and REJECTS from that
-    // turn's error turn/end. (The model's own error is never reached — the turn
-    // failed at start — so the rejection carries the listener's failure.)
-    harness = await makeBridgeHarness({ storageDir, script: [textResponse('never runs')] })
+    // Session contains post-commit callbacks independently.
+    // The model request and normal turn outcome therefore still occur.
+    harness = await makeBridgeHarness({ storageDir, script: [textResponse('answer')] })
     harness.ctx.on('session/event', (_s, event) => {
       if (event.type === 'turn/start') throw new Error('peer listener boom on start')
     }, { prepend: true })
     const sessionId = await newSession(harness)
-    await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }))
-      .rejects.toThrow(/turn failed:/)
+    const result = await harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] })
+    expect(result.stopReason).toBe('end_turn')
   })
 
   it('a between-turn injection does not settle the prompt early (message-trigger correlation)', async () => {
diff --git a/packages/ui/user-approval/README.md b/packages/ui/user-approval/README.md
index 2027d9c1f9..59e323602f 100644
--- a/packages/ui/user-approval/README.md
+++ b/packages/ui/user-approval/README.md
@@ -2,11 +2,11 @@
 
 User-approval seam. Owns the `ctx.approval` service ([`ApprovalService`](src/index.ts)) and the one-shot permission vocabulary the harness shares: `ApprovalRequest` (agent + tool identity + reason + abort signal), the closed `ApprovalOutcome` union (`allowed-once` / `rejected` / `cancelled` / `unavailable`), the `ApprovalRequestId` brand pairing the two log-only audit events (`approval/asked` / `approval/decided`), and the `approval/request` waterfall the answerers listen on. It lives in the UI group because its purpose is human permission, while remaining channel-neutral: it depends only on Cordis and core vocabulary packages, never on a concrete UI.
 
-The contract in one line: `ctx.approval.request(req)` puts exactly one question — "may this specific action proceed?" — to whatever answerers the deployment composed, and always resolves to an outcome, never rejects: an aborted signal yields `cancelled`, a throwing or missing answerer yields `unavailable`, and `allowed-once` is a grant for the single asked-about action, never a class of future ones. Acceptance is synchronous: the service shallow-freezes a detached request record before dispatch, preserving the exact `agent` and `AbortSignal` identities while making later caller mutation unable to redirect scope, payload, cancellation, or either audit event. Session observers run after an event enters the append-only log; if one throws, the service recognizes that the audit is already authoritative, contains the observer failure, and completes the pair. The one precondition: ask from inside an open turn — the audit pair is turn-enclosed by contract (the turn is the durable log's commit/replay boundary; a bare event between turns is crash-tail garbage on reload), so an idle ask throws before appending anything.
+The contract in one line: `ctx.approval.request(req)` puts exactly one question — "may this specific action proceed?" — to whatever answerers the deployment composed, and its answerer phase always produces an outcome: an aborted signal yields `cancelled`, a throwing or missing answerer yields `unavailable`, and `allowed-once` is a grant for the single asked-about action, never a class of future ones. `ApprovalRequest` is a readonly same-process contract: the service borrows the exact request, agent, session, and abort signal rather than cloning or freezing them. The request requires an open turn because the audit pair is turn-enclosed by contract (the turn is the durable log's commit/replay boundary; a bare event between turns is crash-tail garbage on reload), so an idle ask rejects before appending. Either audit append may reject before commit because returning an unlogged decision would violate the pair. Session contains post-commit observer failures, so an authoritative audit append cannot reject the request or suppress its matching event.
 
 The service is the mechanism, answerers are the policy. Answerers are `approval/request` waterfall listeners occupying a single decision slot: answer for an agent you own by returning an outcome without calling `next()`, or delegate an agent you don't recognize by calling `next()` — the chain's built-in default is `unavailable`, so a deployment with no answerer (headless, CI) fails closed with zero configuration. Dispatch is keyed by `req.agent`: a listener registered through `agent.ctx` receives only that agent's questions, while a plain-context listener receives every agent's. Registration order across sibling plugins is not load-order deterministic; compose one terminal answerer per deployment and use `prepend` listeners only for decide-or-delegate gates.
 
-The seam also owns the per-session POLICY tier ([the sandbox RFC § Per-session mode switching](../../../docs/rfc/implemented/feature/2026-07-06-sandbox.md)): `ApprovalPolicy` is `'ask'` (delegate to the answerers) or `'never'` (deterministically reject without prompting anyone; the strict CI/unattended stance), with `effective = fold(the session's 'approval/policy' events, last one wins) ?? Config.policy` — the session log is the store, written only through `setApprovalPolicy(session, policy)`. The service decides `'never'` inside `request()` itself, before dispatching the waterfall (`'never'` → `'rejected'` with the audit pair still landing; no listener registration, including a later `prepend`, can precede it), states `'never'` — and only `'never'` in prose — in a per-agent prompt section, records either value with a source-owned header marker, and narrates a policy switch to the model in at most one coalesced `agent/pre-step` notice. The restart fallback reads the marker rather than deployment-controlled persona prose; attribution is positional (an override event after the last `request/header*` reads `changed by the user`, otherwise `changed by the operator/config`).
+The seam also owns the per-session POLICY tier ([the sandbox RFC § Per-session mode switching](../../../docs/rfc/implemented/feature/2026-07-06-sandbox.md)): `ApprovalPolicy` is `'ask'` (delegate to the answerers) or `'never'` (deterministically reject without prompting anyone; the strict CI/unattended stance), with `effective = fold(the session's 'approval/policy' events, last one wins) ?? Config.policy` — the session log is the store, written only through `setApprovalPolicy(session, policy)`, which rejects any value outside that closed vocabulary before appending. The service decides `'never'` inside `request()` itself, before dispatching the waterfall (`'never'` → `'rejected'` with the audit pair still landing; no listener registration, including a later `prepend`, can precede it), states `'never'` — and only `'never'` in prose — in a per-agent prompt section, records either value with a source-owned header marker, and narrates a policy switch to the model in at most one coalesced `agent/pre-step` notice. The restart fallback reads the marker rather than deployment-controlled persona prose; attribution is positional (an override event after the last `request/header*` reads `changed by the user`, otherwise `changed by the operator/config`).
 
 One seam serves both ask paths of [the sandbox RFC](../../../docs/rfc/implemented/feature/2026-07-06-sandbox.md): the `tools/pre-execute` `ask` decision (routed by [`@deepseek-ai/dsh-tools`](../../core/tools/) when this service is mounted; degrading to deny when it is not), and the sandbox post-denial escalated retry (the bash tool's `sandbox_permissions` gate in [`@deepseek-ai/dsh-tool-bash`](../../bash/tool-bash/) — [the sandbox RFC § Escalation](../../../docs/rfc/implemented/feature/2026-07-06-sandbox.md)). The full design: [the approval-seam RFC](../../../docs/rfc/implemented/feature/2026-07-06-approval-seam.md).
 
diff --git a/packages/ui/user-approval/src/index.ts b/packages/ui/user-approval/src/index.ts
index 4fb50ba23b..6b3ef962bb 100644
--- a/packages/ui/user-approval/src/index.ts
+++ b/packages/ui/user-approval/src/index.ts
@@ -63,10 +63,8 @@ declare module 'cordis' {
      * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`) keys the carrier by `req.agent`: a
      * listener registered through `agent.ctx` receives only that agent's
      * questions, while a plain-context listener receives every agent's.
-     * `req` is the service's shallow-frozen acceptance snapshot: later caller
-     * mutation cannot redirect the question, while the `agent` and `signal`
-     * identity capabilities remain exact.
-     * @param req - the accepted decision (agent, tool identity, reason, signal).
+     * `req` is a readonly same-process value borrowed from the caller.
+     * @param req - the pending decision (agent, tool identity, reason, signal).
      * @mode waterfall
      */
     'approval/request'(this: Scoped<ApprovalService>, req: ApprovalRequest, next: () => Promise<ApprovalOutcome>): Promise<ApprovalOutcome>
@@ -223,12 +221,16 @@ function hasOpenTurn(events: readonly SessionEvent[]): boolean {
  * THE write path for a session's approval-policy override: appends exactly
  * one `approval/policy` event — the switch IS its event; nothing mutates
  * policy state out of band. Takes effect on the session's next ask and next
- * prompt assembly (the consumers fold on every read).
+ * prompt assembly (the consumers fold on every read). Rejects a value outside
+ * {@link APPROVAL_POLICIES} before appending anything.
  * @param session - the session the override belongs to.
  * @param policy - the policy every subsequent ask for this session resolves
  *   under (until the next switch).
  */
 export function setApprovalPolicy(session: Session, policy: ApprovalPolicy): void {
+  if (!APPROVAL_POLICIES.includes(policy)) {
+    throw new TypeError('approval policy must be one of "ask" or "never"')
+  }
   session.append('approval/policy', { policy })
 }
 
@@ -237,9 +239,9 @@ export function setApprovalPolicy(session: Session, policy: ApprovalPolicy): voi
  * for an answerer to present it and for the audit events to reconstruct what
  * was asked — it deliberately does NOT carry tool arguments: a UI answerer
  * attaches the prompt to the already-streamed tool call via `callId` instead
- * of re-rendering the call. `request()` synchronously copies and shallow-freezes
- * this record before crossing an asynchronous boundary. Scalar fields are
- * detached; the `agent` and `signal` identity capabilities are preserved.
+ * of re-rendering the call. This is a readonly same-process contract:
+ * `request()` borrows the request and its `agent` and `signal` capabilities
+ * directly rather than treating them as serialized input.
  */
 export interface ApprovalRequest {
   /**
@@ -247,21 +249,21 @@ export interface ApprovalRequest {
    * UI answerer only answers for agents it owns) and receives the audit
    * events on its session log.
    */
-  agent: Agent
+  readonly agent: Agent
   /** The tool the question is about (presentation and audit). */
-  toolName: string
+  readonly toolName: string
   /**
    * The exact tool call being decided, when the asker has one — lets a UI
    * attach the prompt to the tool call it already streamed.
    */
-  callId?: CallId
+  readonly callId?: CallId
   /** The asker's human-readable explanation of WHY it is asking. */
-  reason?: string
+  readonly reason?: string
   /**
    * Aborting withdraws the question: the request settles `'cancelled'`
    * immediately and a late answer from a still-pending answerer is discarded.
    */
-  signal?: AbortSignal
+  readonly signal?: AbortSignal
 }
 
 /** Plugin config. All optional — `static Config` supplies the defaults. */
@@ -272,7 +274,7 @@ export interface Config {
    * (fail-closed with none); `'never'` auto-rejects every ask without
    * prompting (the deterministic CI/unattended stance).
    */
-  policy?: ApprovalPolicy
+  readonly policy?: ApprovalPolicy
 }
 
 /**
@@ -297,7 +299,7 @@ export class ApprovalService extends Service {
   constructor(ctx: Context, public config: Config) {
     super(ctx, 'approval')
 
-    const effective = (agent: Agent): ApprovalPolicy => this.effectivePolicy(agent)
+    const effective = (agent: Agent): ApprovalPolicy => this.effectivePolicy(agent.session)
 
     // Visibility layer 1, scoped on the prompt registry so headless
     // compositions mount the seam without it: state the one deterministic
@@ -345,7 +347,7 @@ export class ApprovalService extends Service {
       }
       // Same fold effectivePolicy performs — override is scanned here anyway
       // for POSITIONAL attribution; the default lives once, in the method.
-      const current = this.effectivePolicy(agent)
+      const current = this.effectivePolicy(session)
       const header = session.requestHeader()
       const told = narrated.get(session) ?? toldApprovalPolicy(header?.system)
       narrated.set(session, current)
@@ -361,43 +363,25 @@ export class ApprovalService extends Service {
   }
 
   /**
-   * Ask the composed answerers to decide one request. Requires an open turn
-   * on the requesting agent's session — the audit pair below is turn-enclosed
-   * by contract (the turn is the log's commit/replay boundary; an idle append
-   * would be dropped as crash tail on reload) — and throws before appending
-   * anything when called idle; asking outside a turn is a deferred design.
-   * Within that precondition it always resolves to an outcome, never rejects:
-   * an aborted signal yields `'cancelled'`, a missing or throwing answerer
-   * yields `'unavailable'` (fail closed), and a rogue non-vocabulary return
-   * value is normalized to `'unavailable'`. The caller-owned request is
-   * synchronously snapshotted, so later mutation cannot split routing,
-   * dispatch payload, cancellation, or the audit pair across agents/sessions.
-   * Appends the
-   * `approval/asked`/`approval/decided` audit pair (log-only) around the
-   * decision regardless of outcome. A synchronous session observer failure
-   * after an audit event entered the append-only log is contained; the event
-   * is already authoritative, so the pair still completes and the request
-   * still resolves.
+   * Ask the composed answerers to decide one readonly same-process request.
+   * The service borrows the request, agent, session, and live signal directly.
+   * The request requires an open turn because the audit pair must be enclosed
+   * by the durable log's commit/replay boundary; an idle ask rejects before
+   * appending anything. The answerer phase always produces an outcome: an
+   * aborted signal yields `'cancelled'`, a missing or throwing answerer yields
+   * `'unavailable'` (fail closed), and a rogue non-vocabulary return value is
+   * normalized to `'unavailable'`. A failure that prevents either audit append
+   * from committing still rejects because returning an unlogged decision would
+   * violate the pair. Session contains post-commit observer failures, so an
+   * authoritative append cannot reject the request or suppress its matching
+   * audit event.
    * @param req - the pending decision (agent, tool identity, reason, signal).
    * @returns the closed outcome; `'allowed-once'` is the only grant.
+   * @throws when no turn is open or either audit event fails before the session
+   *   append commit point.
    */
   async request(req: ApprovalRequest): Promise<ApprovalOutcome> {
-    // Accept one immutable request shape before the first async boundary. The
-    // caller retains its record and may mutate it as soon as this async method
-    // returns; identity capabilities stay live, but the record is never reread.
-    const agent = req.agent
-    const toolName = req.toolName
-    const callId = req.callId
-    const reason = req.reason
-    const signal = req.signal
-    const accepted: Readonly<ApprovalRequest> = Object.freeze({
-      agent,
-      toolName,
-      ...callId !== undefined ? { callId } : {},
-      ...reason !== undefined ? { reason } : {},
-      ...signal !== undefined ? { signal } : {},
-    })
-    const session = accepted.agent.session
+    const session = req.agent.session
     if (!hasOpenTurn(session.events)) {
       throw new Error(
         'approval.request() outside an open turn: the approval/asked + approval/decided audit pair '
@@ -406,67 +390,43 @@ export class ApprovalService extends Service {
       )
     }
     const id = ApprovalRequestId(randomUUID())
-    this.appendAudit(session, 'approval/asked', id, () => {
-      session.append('approval/asked', {
-        id,
-        toolName: accepted.toolName,
-        ...accepted.callId !== undefined ? { callId: accepted.callId } : {},
-        ...accepted.reason !== undefined ? { reason: accepted.reason } : {},
-      })
-    })
-    const outcome = await this.decide(accepted)
-    this.appendAudit(session, 'approval/decided', id, () => {
-      session.append('approval/decided', { id, outcome })
+    session.append('approval/asked', {
+      id,
+      toolName: req.toolName,
+      ...req.callId !== undefined ? { callId: req.callId } : {},
+      ...req.reason !== undefined ? { reason: req.reason } : {},
     })
+    const outcome = await this.decide(req, session)
+    session.append('approval/decided', { id, outcome })
     return outcome
   }
 
-  /**
-   * Append one audit event while distinguishing a post-append observer throw
-   * from a failure that prevented the event entering the log. `Session.append`
-   * pushes first and then notifies synchronously, so log growth proves the
-   * event is already authoritative; that observer failure is reported and
-   * contained so it cannot reject the approval or suppress its matching event.
-   * @param session - the captured session receiving both audit events.
-   * @param type - the audit event currently being appended.
-   * @param id - the request id, used to identify the contained failure.
-   * @param append - the single concrete `Session.append` call.
-   */
-  private appendAudit(
-    session: Session,
-    type: 'approval/asked' | 'approval/decided',
-    id: ApprovalRequestId,
-    append: () => void,
-  ): void {
-    const length = session.events.length
-    try {
-      append()
-    } catch (error) {
-      if (session.events.length === length) throw error
-      this.ctx.logger.warn(`approval request "${id}": ${type} observer threw after the event was appended`)
-    }
-  }
-
   /**
    * The session's effective policy: its own `approval/policy` fold, else the
    * configured default (the schema already defaulted an omitted policy to
    * `'ask'`; the `??` only narrows the optional-input TYPE).
-   * @param agent - the agent whose session's policy applies.
-   * @returns the policy every ask for this agent resolves under right now.
+   * @param session - the exact accepted session whose policy applies.
+   * @returns the policy every ask for this session resolves under right now.
    */
-  private effectivePolicy(agent: Agent): ApprovalPolicy {
-    return effectiveApprovalPolicy(agent.session.events) ?? this.config.policy ?? 'ask'
+  private effectivePolicy(session: Session): ApprovalPolicy {
+    return effectiveApprovalPolicy(session.events) ?? this.config.policy ?? 'ask'
   }
 
-  /** Dispatch the waterfall, contained and raced against the accepted signal. */
-  private async decide(req: Readonly<ApprovalRequest>): Promise<ApprovalOutcome> {
-    if (req.signal?.aborted) return 'cancelled'
+  /**
+   * Dispatch the waterfall, contained and raced against the request signal.
+   * @param req - the borrowed public request.
+   * @param session - the request agent's session used for policy lookup.
+   * @returns the normalized closed outcome.
+   */
+  private async decide(req: ApprovalRequest, session: Session): Promise<ApprovalOutcome> {
+    const signal = req.signal
+    if (signal?.aborted) return 'cancelled'
     // The 'never' policy is decided HERE, before any dispatch: a listener
     // registered with `prepend: true` after this service mounts would sit
     // ahead of any gate LISTENER, so a listener-shaped gate cannot keep the
     // documented promise that 'never' rejects deterministically regardless
     // of registration order — only the service's own request path can.
-    if (this.effectivePolicy(req.agent) === 'never') return 'rejected'
+    if (this.effectivePolicy(session) === 'never') return 'rejected'
     // Enter the promise chain BEFORE dispatching: a listener that throws
     // SYNCHRONOUSLY (before its first await) must land in the same rejection
     // path as an async one — `Promise.resolve(call())` would let it escape
@@ -484,10 +444,12 @@ export class ApprovalService extends Service {
       // tool call open — the seam contains its callbacks.
       () => 'unavailable',
     )
-    const signal = req.signal
     if (signal === undefined) return answer
     return await new Promise<ApprovalOutcome>((resolve) => {
-      const onAbort = () => { resolve('cancelled') }
+      const onAbort = () => {
+        signal.removeEventListener('abort', onAbort)
+        resolve('cancelled')
+      }
       signal.addEventListener('abort', onAbort, { once: true })
       void answer.then((outcome) => {
         signal.removeEventListener('abort', onAbort)
diff --git a/packages/ui/user-approval/tests/approval.spec.ts b/packages/ui/user-approval/tests/approval.spec.ts
index 0e69b8dfd7..ff0cd5c7d8 100644
--- a/packages/ui/user-approval/tests/approval.spec.ts
+++ b/packages/ui/user-approval/tests/approval.spec.ts
@@ -2,7 +2,8 @@ import { describe, expect, it, vi } from 'vitest'
 import { Context } from 'cordis'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import { CallId } from '@deepseek-ai/dsh-llm'
-import { carrierKeyOf, scopeHost } from '@deepseek-ai/dsh-scope'
+import { carrierKeyOf, createScope } from '@deepseek-ai/dsh-scope'
+import type { Scope } from '@deepseek-ai/dsh-scope'
 import SessionStore, { Session, SessionId } from '@deepseek-ai/dsh-session'
 import type { SessionEvent } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
@@ -78,77 +79,38 @@ describe('ApprovalService.request', () => {
     expect(Object.keys(appended[0]?.data ?? {}).sort()).toEqual(['id', 'toolName'])
   })
 
-  it('snapshots request identity, scope, payload, and audit before deferred dispatch', async () => {
+  it('borrows the exact readonly request for scoped dispatch and audit', async () => {
     const ctx = await mounted()
-    const { agent: acceptedAgent, appended: acceptedAudit } = fakeAgent()
-    const { agent: replacementAgent, appended: replacementAudit } = fakeAgent()
-    const host = await scopeHost(ctx, ['approval'])
-    const acceptedScope = host.mint(acceptedAgent)
-    const replacementScope = host.mint(replacementAgent)
-    const dispatchStarted = Promise.withResolvers<'started'>()
-    const answer = Promise.withResolvers<ApprovalOutcome>()
-    const originalSignal = new AbortController().signal
-    const replacementSignal = new AbortController().signal
-    let heardBy: 'accepted' | 'replacement' | undefined
+    const { agent, appended } = fakeAgent()
+    let scope!: Scope
+    const scopeFiber = await ctx.plugin(Object.assign((inner: Context) => {
+      scope = createScope(inner, agent)
+    }, { inject: ['approval'] }))
     let received: ApprovalRequest | undefined
     let carrier: unknown
-    acceptedScope.ctx.on('approval/request', function (req) {
-      heardBy = 'accepted'
+    scope.ctx.on('approval/request', function (req) {
       received = req
       carrier = carrierKeyOf(this)
-      dispatchStarted.resolve('started')
-      return answer.promise
+      return Promise.resolve<ApprovalOutcome>('allowed-once')
     })
-    replacementScope.ctx.on('approval/request', function (req) {
-      heardBy = 'replacement'
-      received = req
-      carrier = carrierKeyOf(this)
-      dispatchStarted.resolve('started')
-      return answer.promise
-    })
-    const request = requestOf(acceptedAgent, {
-      toolName: 'original-tool',
-      callId: CallId('original-call'),
-      reason: 'original reason',
-      signal: originalSignal,
+    const request = requestOf(agent, {
+      toolName: 'scoped-tool',
+      callId: CallId('scoped-call'),
+      reason: 'scoped reason',
     })
 
-    const pending = ctx.approval.request(request)
-    // request() has returned, but the answerer dispatch is deliberately queued
-    // in a microtask. Mutating the caller-owned record must not redirect it.
-    request.agent = replacementAgent
-    request.toolName = 'mutated-before-dispatch'
-    request.callId = CallId('mutated-call')
-    request.reason = 'mutated reason'
-    request.signal = replacementSignal
-    await dispatchStarted.promise
-    // Mutation while the answer is pending must not redirect the final audit.
-    request.toolName = 'mutated-after-dispatch'
-    request.reason = 'mutated again'
-    answer.resolve('allowed-once')
-
-    await expect(pending).resolves.toBe('allowed-once')
-    expect(heardBy).toBe('accepted')
-    expect(carrier).toBe(acceptedAgent)
-    expect(received).not.toBe(request)
-    expect(Object.isFrozen(received)).toBe(true)
-    expect(received).toMatchObject({
-      agent: acceptedAgent,
-      toolName: 'original-tool',
-      callId: 'original-call',
-      reason: 'original reason',
-      signal: originalSignal,
+    await expect(ctx.approval.request(request)).resolves.toBe('allowed-once')
+    expect(carrier).toBe(agent)
+    expect(received).toBe(request)
+    expect(appended).toHaveLength(2)
+    expect(appended[0]?.data).toMatchObject({
+      toolName: 'scoped-tool',
+      callId: 'scoped-call',
+      reason: 'scoped reason',
     })
-    expect(acceptedAudit).toHaveLength(2)
-    expect(acceptedAudit[0]?.data).toMatchObject({
-      toolName: 'original-tool',
-      callId: 'original-call',
-      reason: 'original reason',
-    })
-    expect(acceptedAudit[1]?.data).toMatchObject({ outcome: 'allowed-once' })
-    expect(acceptedAudit[1]?.data['id']).toBe(acceptedAudit[0]?.data['id'])
-    expect(replacementAudit).toEqual([])
-    await host.dispose()
+    expect(appended[1]?.data).toMatchObject({ outcome: 'allowed-once' })
+    expect(appended[1]?.data['id']).toBe(appended[0]?.data['id'])
+    await scopeFiber.dispose()
   })
 
   it('contains an approval/asked observer throw after append and still completes the pair', async () => {
@@ -171,7 +133,7 @@ describe('ApprovalService.request', () => {
     const decided = session.events.find((event): event is SessionEvent<'approval/decided'> => event.type === 'approval/decided')
     expect(audit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided'])
     expect(decided?.data.id).toBe(asked?.data.id)
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('approval/asked observer threw'))
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('session/event listener threw: Error: observer failed after asked append'))
   })
 
   it('contains an approval/decided observer throw after append and still resolves', async () => {
@@ -194,10 +156,10 @@ describe('ApprovalService.request', () => {
     const decided = session.events.find((event): event is SessionEvent<'approval/decided'> => event.type === 'approval/decided')
     expect(audit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided'])
     expect(decided?.data).toMatchObject({ id: asked?.data.id, outcome: 'rejected' })
-    expect(warn).toHaveBeenCalledWith(expect.stringContaining('approval/decided observer threw'))
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('session/event listener threw: Error: observer failed after decided append'))
   })
 
-  it('does not misclassify a pre-append failure as an observer failure', async () => {
+  it('propagates an append failure that prevented audit log growth', async () => {
     const ctx = await mounted()
     const failure = new Error('append failed before log growth')
     const agent = {
@@ -236,9 +198,12 @@ describe('ApprovalService.request', () => {
     const ctx = await mounted()
     const { agent: agentA } = fakeAgent()
     const { agent: agentB } = fakeAgent()
-    const host = await scopeHost(ctx, ['approval'])
-    const scopeA = host.mint(agentA)
-    const scopeB = host.mint(agentB)
+    let scopeA!: Scope
+    let scopeB!: Scope
+    const scopesFiber = await ctx.plugin(Object.assign((inner: Context) => {
+      scopeA = createScope(inner, agentA)
+      scopeB = createScope(inner, agentB)
+    }, { inject: ['approval'] }))
     const heard: string[] = []
     ctx.on('approval/request', (req, next) => {
       heard.push(req.agent === agentA ? 'global:A' : 'global:B')
@@ -257,14 +222,16 @@ describe('ApprovalService.request', () => {
     await expect(ctx.approval.request(requestOf(agentB))).resolves.toBe('unavailable')
 
     expect(heard).toEqual(['global:A', 'scoped:A', 'global:B', 'scoped:B'])
-    await host.dispose()
+    await scopesFiber.dispose()
   })
 
   it('keys the scoped dispatch carrier to the exact request agent', async () => {
     const ctx = await mounted()
     const { agent } = fakeAgent()
-    const host = await scopeHost(ctx, ['approval'])
-    const scope = host.mint(agent)
+    let scope!: Scope
+    const scopeFiber = await ctx.plugin(Object.assign((inner: Context) => {
+      scope = createScope(inner, agent)
+    }, { inject: ['approval'] }))
     let seenKey: object | undefined
     scope.ctx.on('approval/request', function (req, next) {
       seenKey = carrierKeyOf(this)
@@ -275,7 +242,7 @@ describe('ApprovalService.request', () => {
     await expect(ctx.approval.request(requestOf(agent))).resolves.toBe('unavailable')
 
     expect(seenKey).toBe(agent)
-    await host.dispose()
+    await scopeFiber.dispose()
   })
 
   it('contains a throwing answerer as unavailable', async () => {
@@ -420,6 +387,15 @@ describe('approval policy (the approval/policy fold)', () => {
     expect(session.events.at(-1)).toMatchObject({ type: 'approval/policy', data: { policy: 'ask' } })
   })
 
+  it('rejects a policy outside the closed vocabulary before appending', () => {
+    const append = vi.fn()
+    const session = { append } as unknown as Session
+
+    expect(() => { setApprovalPolicy(session, 'sometimes' as Parameters<typeof setApprovalPolicy>[1]) })
+      .toThrow('approval policy must be one of "ask" or "never"')
+    expect(append).not.toHaveBeenCalled()
+  })
+
   it('defaults a schema-less construction to ask (the ?? narrows the optional TYPE)', async () => {
     // Direct construction bypasses the plugin schema (the SystemPrompt-test
     // precedent for covering a defaulted Config field's type-narrowing ??).
diff --git a/packages/workflow/workflow-workerthread/README.md b/packages/workflow/workflow-workerthread/README.md
index 076db8423d..a0b4d2fdfe 100644
--- a/packages/workflow/workflow-workerthread/README.md
+++ b/packages/workflow/workflow-workerthread/README.md
@@ -1,56 +1,83 @@
 # @deepseek-ai/dsh-workflow-workerthread
 
-The [`WorkflowService`](../workflow/README.md) implementation, on **`node:worker_threads`**: each run gets its OWN worker thread (one run = one worker, no pooling — a run is heavyweight, so the ~tens-of-ms thread spin-up is noise), the script executes in a vm context INSIDE that worker with the workflow hooks injected, and every `agent()` call bridges back over the message port to [`ctx.subagents`](../../subagent/README.md) on the host. Child agents are I/O-bound LLM loops and stay on the host event loop; the thread isolates the SCRIPT, the only part that can spin synchronously.
+This package implements `WorkflowService` with one Node worker thread per run. The worker executes the orchestration script; child agents remain on the host and are reached through `ctx.subagents` over a typed host/worker protocol.
 
-## Trust premise: what the thread buys (and what it does not)
+The split has one primary purpose: a synchronous script loop cannot block the harness event loop, and a script that ignores cancellation can be terminated with its worker. It is not a security sandbox.
 
-Workflow scripts are **model-written** — the same trust level as the model's existing bash access — so this engine defends against **buggy** scripts, never hostile ones. A worker thread is NOT a security boundary: the vm context inside it is escapable by construction (`node:vm` shares object machinery with its surrounding realm, so a script can reach the `Function` constructor via `globalThis.constructor.constructor` and from it `process` and every Node builtin), and an escapee holds the same process privileges as the host — Node's permission model is process-wide. The absent globals are API surface that keeps honest scripts portable, not walls. What the thread concretely buys:
+## Trust and isolation boundary
 
-- **The host never blocks**: `start()` returns without running any script code on the host; a synchronous spin anywhere in the script occupies the worker's loop, not the harness's.
-- **Termination is real**: a script that outlives its post-cancel grace is `worker.terminate()`d — nothing of it survives `dispose()`, where an in-process engine could only abandon the spin on its own loop.
-- **No ambient credentials**: the worker spawns with an EMPTY environment (`env: {}` plus hermetic `execArgv`, the same stance as `dsh-code-runtime-worker`; the unbuilt dev shape forwards exactly one loader variable, `TSX_TSCONFIG_PATH` — path plumbing, not a secret), so an escapee reading `process.env` finds no harness secrets — ambient-channel hardening only; the process-wide privileges above (fs and the rest) remain, so a genuine sandbox is still the engine swap.
-- **Serialization by construction**: everything crossing the thread is structured-clone data, and plain JSON before that — the `materializeFromRealm` walk rejects loud what JSON cannot carry, which is also what makes every postMessage hop total.
+Workflow scripts are model-written and have the same trust premise as the model's existing bash access. `node:vm` inside a worker is an API-shaping mechanism, not a security boundary: an escaped script can recover Node capabilities with the host process's privileges.
 
-What the seam guarantees regardless, because benign scripts hit these constantly: `result` never rejects, a dropped hook promise never becomes an unhandled rejection, values JSON cannot carry are rejected **loud** instead of silently mangled, and hook misuse is fatal instead of dissolving into a per-item `null`. Genuine sandboxing (containing what an escaped script may touch) remains an isolated-vm/separate-process engine swap behind the seam, still deferred.
+The worker still provides useful containment:
 
-## The script contract it executes
+- Script CPU work and synchronous spins stay off the host event loop.
+- `worker.terminate()` gives disposal a real final stop.
+- The worker starts with an empty environment, except unbuilt loader plumbing, so ambient credentials do not cross through `process.env`.
+- Host/worker messages use structured-clone data, with plain-JSON validation at the script boundary.
 
-- **Meta as DATA** (`validateMeta`, host-side): the workflow's identity arrives on the start request as plain JSON (the tool carries it as its schema-validated `meta` parameter — never as script text) and is shape-validated loud, every violation named (`name`/`description` required; unknown fields rejected). The engine deliberately evaluates NO script text to obtain meta: an evaluated meta literal could smuggle getters that run on the host outside any vm timeout — the exact spin the worker thread exists to isolate. A body that still opens with a Claude Code-style `export const meta` statement is rejected with a pointed `SCRIPT_PARSE` message.
-- **Hooks**: `agent(prompt, {label, phase, schema, model})` (schema = the [structured-output subset](../../core/tools/README.md), forwarded as `outputSchema`; result = validated object, or final text without a schema; a failed child resolves `null`), `parallel(thunks)`, `pipeline(items, ...stages)` with NO cross-stage barrier and `(prev, item, index)` stage callbacks, `phase(title)`, `log(message)`, and the `args` global. Anything else — `effort`/`isolation`/`agentType`, unknown options, malformed arguments, schemas outside the subset — throws a FATAL `WorkflowError` that `parallel`/`pipeline` re-throw rather than nulling (see the seam README's failure discipline).
-- **No ambient APIs**: no timers, filesystem, or Node APIs are injected into the context (absence is API surface, not containment — see the trust premise).
+A genuinely untrusted-script sandbox would require a different engine behind the same workflow seam.
 
-## How a run executes
+## Script contract
 
-`start()` shape-validates the meta DATA host-side and parse-checks the body with the identical wrapper the worker compiles (`new vm.Script`, discarded), preserving the seam's synchronous `META_INVALID`/`SCRIPT_PARSE` throws; one redundant parse per run is the deliberate price. It then spawns the worker (`src/worker.ts` unbuilt via an explicit tsx `execArgv`; the sibling `lib/worker.js` bundle when built) with the meta, body, `args`, and worker-side limits as `workerData`.
+The workflow's `meta` is host-provided data, not evaluated script text. The engine validates its required `name` and `description`, rejects unknown fields, and parse-checks the body before returning a run.
 
-Inside the worker, `runWorkerSession` builds the execution core (hooks, combinators, concurrency semaphore, caps, fatal-error discipline) over a **child port**. `agent()` sends `child-start`, and the host starts the child on `ctx.subagents` with parent attribution, the shared per-run abort signal, and `outputSchema`/`model` pass-through.
+Inside the worker, the script receives `args` and these hooks:
 
-The host observes `run.result` immediately but buffers its snapshotted wire projection until `run.started` fulfills. It then replies `child-started` with the child id before forwarding settlement, so `workflow/agent-start` always names a ready child and precedes its end. A readiness rejection replies `child-start-error`, emits no workflow agent pair, and makes the host dispose the attempt because the worker never received a handle; the worker classifies it as fatal `AGENT_START` unless cancellation already owns the run. If readiness fulfills, an infrastructure result rejection crosses as `child-failed`/`AGENT_RESULT` regardless of whether that rejection settled before or after readiness. Child disposal acknowledgements complete the RPC.
+- `agent(prompt, { label, phase, schema, model })` starts one host-side subagent. With a schema it returns the structured value; otherwise it returns final text. An ordinary failed child yields `null`.
+- `parallel(thunks)` runs thunks under the configured concurrency limit.
+- `pipeline(items, ...stages)` passes `(previous, item, index)` without a cross-stage barrier.
+- `phase(title)` and `log(message)` emit observer narration.
 
-Observer narration (`phase`/`log`/`agent-start`/`agent-end`) crosses as messages and re-emits as the seam's `workflow/*` events. A **ready→go handshake** gates the body: a cancellation racing worker boot arrives before `go`, so a run cancelled before start never executes the body at all.
+Unknown options, malformed arguments, unsupported schemas, tripped caps, provider-start failures, and infrastructure result failures are fatal workflow errors. No timers, filesystem API, or Node globals are intentionally injected, though the trust caveat above still applies.
 
-## The value boundary
+## Run sequence
 
-Values LEAVING the script (hook options/schemas, the script's return) are materialized by `materializeFromRealm`: a plain recursive walk that rejects loud everything JSON cannot carry (exotic prototypes, functions, symbols, cycles, sparse arrays, non-finite numbers, nested `undefined`), copying into plain containers via `defineProperty` so a `"__proto__"` key becomes a data property, never a prototype mutation. Getters are read ordinarily — the RESULT is what crosses; a read that throws fails loud; both run in the WORKER, never on the host. Values ENTERING the realm (`args`, `agent()` results, hook promises and their failures, combinator arrays) are handed over directly as worker-realm values — the script is trusted, so outer prototypes are not a leak; `args` is cloned once at start so a script scribbling on it cannot mutate the caller's object. One script-visible consequence: an error thrown by a hook is built OUTSIDE the script's vm context, so `e instanceof Error` inside the script is `false` — branch on `e.name`/`e.code` instead (the combinators recognize fatality by `instanceof` against their own realm's class, which a script-built object can never pass, so fatal-vs-null cannot be forged or dissolved).
+`start()` validates meta and parses the body, creates the worker, and returns a holder-owned `WorkflowRun`. A ready/go handshake prevents a start-signal cancellation racing worker boot from executing the script's initial synchronous slice.
 
-## Cancellation, death, disposal
+For each `agent()` call:
 
-Per-run limits: a concurrency semaphore (`maxConcurrentAgents`), a total-`agent()` cap (`maxTotalAgents`), and a per-call item cap (`maxItemsPerCall`), all config. `cancel()` posts the cancel to the worker (its hooks start throwing `CANCELLED`; the script dies at its next await) and cancels every host-side child NOW on **both seam channels** — the shared request signal aborts AND each registered child's explicit `cancel()` is called host-side, because the seam leaves a provider free to honor either channel and a worker wedged in a synchronous spin could not relay its own per-child cancel RPCs (those later land as idempotent no-ops). The grace then arms: a run still unsettled `disposeGraceMs` later force-settles `cancelled` and the worker is **terminated**. A cancellation that lands before the body runs (the ready→go handshake) reports `cancelled` without executing anything; a worker `result` racing an in-flight host cancellation reports `cancelled` too (first-wins settlement — the seam-visible result had not settled when cancellation was requested); post-cancel `phase`/`log` narration is suppressed host-side, while cancelled children still deliver their paired `agent-end`.
+1. The worker sends `child-start` with a plain-data prompt and options.
+2. The host calls the configured provider through async `SubagentService.start`, passing the workflow's parent and one canonical per-run abort signal.
+3. If start rejects, the host sends `child-start-error`; provider startup has already reached quiescence and no child lifecycle event is emitted.
+4. If start fulfills while the workflow still admits work, the host records the run, observes `result`, then sends `child-started`. Even an already-settled result is forwarded afterward, preserving start-before-result order.
+5. The worker emits paired `workflow/agent-start` and `workflow/agent-end` narration and requests child disposal after collection.
 
-A worker that dies unexpectedly (an OOM, a script reaching `process.exit` through the documented vm escape) settles the run `stopReason: 'error'` with the exit diagnostics — or `'cancelled'` when a cancel was in flight — and the host-side child registry is what winds every surviving child down. `dispose()` = cancel + immediate host-driven disposal of every registered child (a wedged worker can relay no dispose RPC, so child teardown overlaps the grace instead of starting after it; the worker's own dispose RPCs join the same per-child disposal) + bounded wait (result, then child-registry quiescence, capped by the grace) + unconditional `worker.terminate()`: the thread never outlives its run. Once a run settles, stray children a script fired without awaiting are cancelled too, and `dispose()` waits for their disposal (bounded by the grace) before returning. `agent-start`/`agent-end` pairing is host-guaranteed the same way: forwarded starts live in a ledger, worker-reported ends pair them on the graceful paths, and the termination paths (grace force-settle, worker death) synthesize the missing ends (outcome `cancelled`) before the run settles — a start still in flight across the force-settle can surface after `workflow/end`, immediately paired the same way.
+Provider starts are tracked separately from published children. If cancellation, worker death, or normal workflow settlement closes admission while a start is pending, the shared signal aborts it. A provider that nevertheless fulfills after closure is disposed by the host and never announced to the worker.
 
-A returned promise or thenable resolves per JavaScript semantics BEFORE materialization — that is what makes an un-awaited `return agent('x')` work — with the value-boundary guard applying to the resolution.
+## Value boundary
+
+Values leaving the script pass through `materializeFromRealm`, which accepts plain, lossless JSON data and rejects exotic prototypes, functions, symbols, cycles, sparse arrays, non-finite numbers, and nested `undefined`. The walk runs in the worker, and defines object keys as data properties so `__proto__` cannot mutate a prototype.
+
+Child results are projected and snapshotted before crossing from the host to the worker. This is a real process-like serialization boundary; it is deliberately different from trusted same-process workflow and subagent event payloads, which are borrowed immutable values.
+
+## Cancellation and disposal
+
+`WorkflowRun.cancel()` records the first reason, tells the worker to cancel, aborts the one signal shared by every pending and published child, and arms the `disposeGraceMs` timer. Worker hooks then throw `CANCELLED` at their next await. If the run remains unsettled at the deadline, the host resolves it as cancelled, pairs stranded child lifecycle events, and terminates the worker.
+
+The subagent seam has one cancellation channel: the request signal. There is no separate child-cancel RPC. Published child teardown uses `run.dispose()`; pending provider starts remain provider-owned until their promise rejects or fulfills.
+
+Normal settlement also aborts pending starts and begins disposing any published fire-and-forget children before the result becomes externally settled. The host's quiescence condition includes both pending starts and published child disposals, so cleanup does not forget an async startup transaction.
+
+`dispose()` is idempotent. It cancels the run, starts host-driven disposal immediately, waits for result plus child quiescence up to the same grace, terminates the worker unconditionally, and performs a final survivor sweep. Per-child disposal is memoized so worker RPC, host cancellation, death cleanup, and public disposal all join one operation.
+
+## Outcome and event guarantees
+
+Terminal outcome is first-wins at host claim points. An accepted external cancellation overrides a later non-cancelled worker result; a result or worker death that claims first cannot be rewritten by reentrant cleanup callbacks.
+
+Worker error, message failure, or premature exit closes message admission before cleanup, then resolves `error` unless cancellation already owns the run. Late queued messages cannot create children or narrate after that logical boundary.
+
+The host keeps a ledger of forwarded child starts. A graceful worker supplies their ends; death or force termination synthesizes any missing end as cancelled. Every forwarded `workflow/agent-start` is therefore paired exactly once, although cleanup after an already-arrived workflow result may complete afterward.
 
 ## Config
 
 | Key | Default | Meaning |
 |---|---|---|
-| `provider` | `spawn` | The `ctx.subagents` provider children run on (host-side). |
-| `maxConcurrentAgents` | `0` (auto) | Concurrent `agent()` ceiling; `0` resolves to `min(16, max(1, cores - 2))`. |
-| `maxTotalAgents` | `1000` | Total `agent()` calls one run may start (runaway-loop backstop). |
-| `maxItemsPerCall` | `4096` | Items accepted by one `parallel()`/`pipeline()` call. |
-| `syncTimeoutMs` | `5000` | vm timeout for the script's initial synchronous slice (in the worker). |
-| `disposeGraceMs` | `5000` | How long a cancelled run may stay unsettled before force-settle + terminate; also bounds `dispose()`. |
+| `provider` | `spawn` | Host-side subagent provider used by `agent()`. |
+| `maxConcurrentAgents` | `0` | Concurrent `agent()` ceiling; `0` resolves from available CPU parallelism. |
+| `maxTotalAgents` | `1000` | Total `agent()` calls in one run. |
+| `maxItemsPerCall` | `4096` | Items accepted by one `parallel()` or `pipeline()` call. |
+| `syncTimeoutMs` | `5000` | VM timeout for the script's initial synchronous slice. |
+| `disposeGraceMs` | `5000` | Bound before force-settlement/termination and for public disposal. |
 
 ## Known Limitations and Deferred Work
 
diff --git a/packages/workflow/workflow-workerthread/package.json b/packages/workflow/workflow-workerthread/package.json
index f86c74c2f7..ed934cd0cc 100644
--- a/packages/workflow/workflow-workerthread/package.json
+++ b/packages/workflow/workflow-workerthread/package.json
@@ -30,6 +30,7 @@
     "@deepseek-ai/dsh-agent": "^0.0.1",
     "@deepseek-ai/dsh-brand": "^0.0.1",
     "@deepseek-ai/dsh-llm": "^0.0.1",
+    "@deepseek-ai/dsh-session": "^0.0.1",
     "@deepseek-ai/dsh-subagent": "^0.0.1",
     "@deepseek-ai/dsh-tools": "^0.0.1",
     "@deepseek-ai/dsh-workflow": "^0.0.1",
diff --git a/packages/workflow/workflow-workerthread/src/host.ts b/packages/workflow/workflow-workerthread/src/host.ts
index fff9d8496f..95c07f0d2d 100644
--- a/packages/workflow/workflow-workerthread/src/host.ts
+++ b/packages/workflow/workflow-workerthread/src/host.ts
@@ -1,49 +1,53 @@
 /**
  * The host half of one worker-engine run: spawn the Worker, bridge its child
- * RPC onto `ctx.subagents`, fan its observer messages into the engine's
- * events, and own cancellation, the settle-within-grace guarantee, and child
- * cleanup. The worker's lifetime IS the run's lifetime: `dispose()` always
- * ends with `worker.terminate()`, so no thread outlives its run.
+ * RPC onto the holder-bound subagent service, fan its observer messages into
+ * the engine's events, and own cancellation, the settle-within-grace
+ * guarantee, and child cleanup. The worker's lifetime IS the run's lifetime:
+ * `dispose()` always ends with `worker.terminate()`, so no thread outlives its
+ * run.
  *
  * The run's `result` promise settles exactly once, from whichever of these
- * lands first: the worker's `result` message (a host-side cancellation in
- * flight overrides a non-cancelled report — the seam-visible result had not
- * settled when cancellation was requested), an unexpected worker death
- * (`error`/`messageerror`/premature `exit` → `stopReason: 'error'`, or
- * `'cancelled'` when a cancel was in flight), or the post-cancel grace timer
- * (a script that never settles is force-settled `cancelled` and its worker
- * terminated — the real kill an in-process engine could not perform).
+ * lands first: receipt of the worker's `result` message, an unexpected worker
+ * death (`error`/`messageerror`/premature `exit` → `stopReason: 'error'`, or
+ * `'cancelled'` when a cancel was in flight), or the post-cancel grace timer (a
+ * script that never settles is force-settled `cancelled` and its worker
+ * terminated — the real kill an in-process engine could not perform). At
+ * `result` receipt the host snapshots whether caller/signal/dispose
+ * cancellation is already in flight: an earlier cancellation overrides a
+ * non-cancelled report; otherwise the report wins before settlement-only child
+ * cleanup invokes arbitrary provider callbacks. Worker death uses the same
+ * boundary: it claims `error` (or a previously requested `cancelled`) before
+ * reaping children, so cleanup callbacks cannot rewrite the outcome. That
+ * first signal also closes inbound message admission: Node may emit `error`,
+ * then deliver queued messages, then emit `exit`, but those late messages may
+ * neither create work nor narrate after settlement. If Result or grace already
+ * owns the outcome, death preserves it while still cleaning resources; the
+ * eventual exit performs a final disposal-only sweep without repeating child
+ * cancellation.
  *
- * Children live in a host-side registry (callId → run) as soon as the provider
- * accepts them, so cancellation reaches even a pre-publication attempt. The
- * host observes `result` immediately but acknowledges the child to the worker
- * only after `started` fulfills; readiness failure is a start error and the
- * host disposes the attempt because the worker never received a handle. The
- * worker drives disposal by RPC on the graceful path, `dispose()` host-drives
- * every registered child's disposal immediately (a wedged worker can relay no
- * dispose RPC, and child teardown must overlap the grace, not start after it),
- * and the registry lets the host abort and dispose every survivor when the
- * worker dies or is terminated mid-flight. The three
- * paths share ONE disposal per child (memoized by callId; the seam's
- * dispose() is idempotent anyway, the memo keeps the bookkeeping and the
- * containment warn single). Lifecycle pairing is host-guaranteed the same
- * way: every forwarded `agent-start` lives in a ledger, and a start the
- * dead or terminated worker never paired is closed by a synthesized
- * `agent-end` (outcome `'cancelled'`) before the run settles. On a
- * termination path `agentsStarted` reports the
- * HOST-observed count (accepted `child-start` messages) — `agent()` calls
- * still queued worker-side for a concurrency slot are unknowable then; the
- * worker's own count rides the result message on every graceful path.
+ * Provider starts and published children are tracked separately. Every start
+ * receives one shared per-run abort signal; the provider owns partial setup
+ * until its promise fulfills. If admission closes while a start is pending,
+ * the signal aborts it; a late fulfillment is disposed without publication to
+ * the worker. Ready runs enter a callId registry whose memoized disposal is
+ * shared by graceful worker RPC, public disposal, normal-settlement reap, and
+ * worker-death cleanup. Quiescence requires both pending starts and published
+ * children to drain. Lifecycle pairing is host-guaranteed independently:
+ * every forwarded `agent-start` enters a ledger, and a dead or terminated
+ * worker's missing `agent-end` is synthesized exactly once as cancelled. On a
+ * termination path `agentsStarted` reports the host-observed child-start count;
+ * calls still queued worker-side for a concurrency slot are unknowable.
  *
  * @module @deepseek-ai/dsh-workflow-workerthread/host
  */
 
-import { fileURLToPath } from 'node:url'
 import { Worker } from 'node:worker_threads'
 import type { WorkerOptions } from 'node:worker_threads'
 import type { Context } from 'cordis'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import { assertNever } from '@deepseek-ai/dsh-llm'
+import { snapshotJsonValue } from '@deepseek-ai/dsh-session'
+import type SubagentService from '@deepseek-ai/dsh-subagent'
 import type { SubagentRun } from '@deepseek-ai/dsh-subagent'
 import type { WorkflowAgentEndInfo, WorkflowAgentInfo, WorkflowMeta, WorkflowResult, WorkflowRun, WorkflowRunId } from '@deepseek-ai/dsh-workflow'
 import { renderThrown } from './realm.ts'
@@ -52,16 +56,25 @@ import { HostToWorkerType, WorkerToHostType } from './protocol.ts'
 import type { HostToWorkerPayloads, WorkerToHostMessage } from './protocol.ts'
 import type { ChildResult, ChildStartRequest, WorkerInit } from './types.ts'
 
+/** One published child and its shared quiescent-disposal transaction. */
+interface ChildRecord {
+  readonly run: SubagentRun
+  disposal?: Promise<void>
+}
+
 /**
  * Resolve the worker entry and spawn options for the current runtime shape.
  * Unbuilt (tsx demos, vitest — `import.meta.url` points into `src/`), the
- * entry is the TypeScript sibling and the worker needs the tsx loader
- * registered explicitly: a worker thread inherits no transform pipeline from
- * vitest (vite transforms in-process, not via a node loader), and passing
- * execArgv explicitly also shields the worker from any loader flags the
- * parent was started with. Built (`lib/index.js`), the entry is the sibling
- * bundle the package tsdown config emits and no loader is needed (execArgv
- * pinned empty — hermetic, like the environment).
+ * entry is a JavaScript data-URL bootstrap. That bootstrap runs INSIDE the
+ * user worker, registers tsx's ESM AND CommonJS transforms there, and only
+ * then imports the TypeScript sibling. The whole mixed-module source graph
+ * therefore receives TypeScript transformation and the tsconfig paths map in
+ * the worker's own module-loader realm. A worker inherits no
+ * transform pipeline from vitest (vite transforms in-process), and a parent
+ * `--import tsx` registration is not a contract that user workers share on
+ * every supported Node line. Built (`lib/index.js`), the entry is the sibling
+ * bundle the package tsdown config emits and no loader is needed (`execArgv`
+ * pinned empty in both shapes — hermetic, like the environment).
  *
  * Both shapes spawn with an EMPTY environment (`env: {}`): the documented vm
  * escape reaches `process`, and the harness's ambient credentials
@@ -81,19 +94,31 @@ function resolveWorkerSpawn(init: WorkerInit): { entry: URL; options: WorkerOpti
   if (!import.meta.url.endsWith('.ts')) {
     return { entry: new URL('./worker.js', import.meta.url), options: { workerData: init, env: {}, execArgv: [] } }
   }
-  // Lazy tsx resolution: only the unbuilt shape needs it, so the built
-  // bundle never requires tsx to be installed. TSX_TSCONFIG_PATH is the one
-  // variable forwarded through the scrub: tsx finds a tsconfig by searching
-  // UP from the worker's cwd, and a parent running with its cwd outside the
-  // repo (the ACP snapshot harness pins the tsconfig through this exact
-  // variable) would otherwise lose the dsh-* paths map and resolve workspace
-  // imports to unbuilt lib/ bundles. Loader plumbing, not a secret.
+  // Resolve tsx lazily: only the unbuilt shape executes this arm, so a built
+  // consumer never needs the dev-only loader installed. A JavaScript entry is
+  // essential — it can install tsx's ESM and CommonJS hooks from INSIDE the
+  // user worker before any TypeScript enters Node's native strip-only parser.
+  // Both hooks are load-bearing because the source graph crosses both module
+  // shapes on supported Node lines. TSX_TSCONFIG_PATH is
+  // the one variable forwarded through the scrub: a parent running outside
+  // the repo cwd (the ACP snapshot harness is the real case) pins the paths
+  // map through it. Loader plumbing, not a secret.
+  const workerEntry = new URL('./worker.ts', import.meta.url)
+  const tsxEsmApiEntry = import.meta.resolve('tsx/esm/api')
+  const tsxCjsApiEntry = import.meta.resolve('tsx/cjs/api')
+  const bootstrap = [
+    `import { register as registerEsm } from ${JSON.stringify(tsxEsmApiEntry)}`,
+    `import { register as registerCjs } from ${JSON.stringify(tsxCjsApiEntry)}`,
+    'registerCjs()',
+    'registerEsm()',
+    `await import(${JSON.stringify(workerEntry.href)})`,
+  ].join('\n')
   return {
-    entry: new URL('./worker.ts', import.meta.url),
+    entry: new URL(`data:text/javascript,${encodeURIComponent(bootstrap)}`),
     options: {
       workerData: init,
       env: process.env.TSX_TSCONFIG_PATH === undefined ? {} : { TSX_TSCONFIG_PATH: process.env.TSX_TSCONFIG_PATH },
-      execArgv: ['--import', fileURLToPath(import.meta.resolve('tsx'))],
+      execArgv: [],
     },
   }
 }
@@ -101,15 +126,21 @@ function resolveWorkerSpawn(init: WorkerInit): { entry: URL; options: WorkerOpti
 /**
  * One live worker-engine run — the seam's {@link WorkflowRun}, returned by
  * `start()` directly. Owns the Worker, the child registry, and the result
- * settlement; `result` never rejects. `meta` is this handle's OWN clone
- * (event payloads carry separate clones), so a consumer mutating it corrupts
- * nothing.
+ * settlement; `result` never rejects. `meta` is trusted same-process data
+ * borrowed as immutable by the handle and lifecycle events. The holder-bound
+ * SubagentService handle is captured before the
+ * engine returns this run, so unloading the engine removes only the ability to
+ * start another workflow; this run can still start and clean up its children.
  */
 export class WorkerRun implements WorkflowRun {
   /** Settles exactly once with the run's outcome; never rejects. */
   readonly result: Promise<WorkflowResult>
   private settleResolve!: (result: WorkflowResult) => void
   private settled = false
+  /** A Result/death/grace outcome atomically won before teardown callbacks. */
+  private terminalClaimed = false
+  /** The first death signal closes worker-message admission and owns failure-time cleanup. */
+  private workerDeathObserved = false
   private cancelReason: string | undefined
   private graceTimer: NodeJS.Timeout | undefined
   private readonly worker: Worker
@@ -117,19 +148,23 @@ export class WorkerRun implements WorkflowRun {
   private workerGone = false
   /** Accepted `child-start` messages — the terminate-path `agentsStarted` (see module doc). */
   private hostStarted = 0
-  /** Live children by callId; an entry leaves ONLY after its dispose settles (quiescence = empty). */
-  private readonly children = new Map<number, SubagentRun>()
-  /** In-flight child disposals by callId — the memo that gives every path (worker RPC, dispose(), reap) ONE shared disposal per child. */
-  private readonly childDisposals = new Map<number, Promise<void>>()
+  /** Published children by callId; an entry leaves only after disposal settles. */
+  private readonly children = new Map<number, ChildRecord>()
+  /** Provider starts that have not yet fulfilled or rejected. */
+  private readonly pendingStarts = new Set<Promise<void>>()
   /** Started-but-not-ended agents by seq — the pairing ledger the HOST guarantees (see {@link endAgent}). */
   private readonly liveAgents = new Map<number, WorkflowAgentInfo>()
   private readonly quiescenceWaiters: (() => void)[] = []
   /** The per-run abort fanout every child start request carries. */
   private readonly controller = new AbortController()
+  /** External start signal and the exact callback installed on it, retained only until first settle/teardown. */
+  private inputSignal: AbortSignal | undefined
+  private inputSignalAbort: (() => void) | undefined
   private disposed: Promise<void> | undefined
 
   constructor(
     private readonly ctx: Context,
+    private readonly subagents: SubagentService,
     readonly id: WorkflowRunId,
     readonly meta: WorkflowMeta,
     private readonly parent: Agent,
@@ -146,46 +181,50 @@ export class WorkerRun implements WorkflowRun {
     const { entry, options } = resolveWorkerSpawn(init)
     this.worker = new Worker(entry, options)
     this.worker.on('message', (message: WorkerToHostMessage) => { this.onMessage(message) })
-    this.worker.on('error', (error) => { this.onWorkerDeath(`workflow worker failed: ${renderThrown(error)}`) })
+    this.worker.on('error', (error) => { this.onWorkerDeath(`workflow worker failed: ${renderThrown(error)}`, false) })
     /* v8 ignore next -- messageerror: not constructible from the engine's own protocol (every payload is JSON data) */
-    this.worker.on('messageerror', (error) => { this.onWorkerDeath(`workflow worker message failed to deserialize: ${renderThrown(error)}`) })
+    this.worker.on('messageerror', (error) => { this.onWorkerDeath(`workflow worker message failed to deserialize: ${renderThrown(error)}`, false) })
     this.worker.on('exit', (code) => {
       this.workerGone = true
-      this.onWorkerDeath(`workflow worker exited before the run settled (exit code ${code})`)
+      this.onWorkerDeath(`workflow worker exited before the run settled (exit code ${code})`, true)
     })
     if (signal?.aborted) {
       this.cancel('workflow start signal already aborted')
-    } else {
-      signal?.addEventListener('abort', () => { this.cancel('workflow signal aborted') }, { once: true })
+    } else if (signal !== undefined) {
+      const onAbort = (): void => {
+        this.detachInputSignal()
+        this.cancel('workflow signal aborted')
+      }
+      this.inputSignal = signal
+      this.inputSignalAbort = onAbort
+      signal.addEventListener('abort', onAbort, { once: true })
     }
   }
 
   /**
    * Cancel the run: the worker is told (its hooks start throwing and the
-   * script dies at its next await), every host-side child is cancelled NOW on
-   * BOTH seam channels — the shared request signal aborts and each registered
-   * child's explicit `cancel()` is called (the seam leaves a provider free to
-   * honor either, and a worker wedged in a synchronous spin could not relay
-   * its own per-child cancel RPCs until far too late) — and the grace timer
+   * script dies at its next await), the required signal shared by every child
+   * start is aborted, and the grace timer
    * arms: a run still unsettled `disposeGraceMs` later force-settles
    * `cancelled` and its worker is TERMINATED. Idempotent; the first reason
    * wins.
    * @param reason - human-readable cause (default `'workflow cancelled'`).
    */
   cancel(reason?: string): void {
-    // A settled run has nothing left to cancel: without this guard the
+    // A settled run has nothing left to cancel, and a terminal source claimed
+    // before its cleanup callbacks must exclude cancellation reentered by one
+    // of those callbacks. Without the settled guard the
     // ordinary consumer path (await result, then dispose -> cancel) would arm
     // a grace timer nothing ever clears, pinning the run and its Worker
     // closure until the grace expires - a bounded leak per completed run.
-    if (this.settled || this.cancelReason !== undefined) return
+    if (this.settled || this.terminalClaimed || this.cancelReason !== undefined) return
     this.cancelReason = reason ?? 'workflow cancelled'
     this.post(HostToWorkerType.Cancel, { reason: this.cancelReason })
-    this.controller.abort(this.cancelReason)
-    // The explicit channel is driven host-side, not left to the worker: a
-    // provider honoring only run.cancel() must not wait on a wedged worker's
-    // ChildCancel relay (those later RPCs land as idempotent no-ops).
-    for (const run of this.children.values()) run.cancel(this.cancelReason)
+    this.abortChildren(this.cancelReason)
     this.graceTimer = setTimeout(() => {
+      // Cancellation already owns the race through cancelReason; close the
+      // terminal boundary explicitly before observer teardown callbacks.
+      this.terminalClaimed = true
       // The worker may no longer speak (it is about to be terminated): pair
       // every stranded start before the run settles, so ends precede
       // workflow/end.
@@ -213,9 +252,21 @@ export class WorkerRun implements WorkflowRun {
    * @returns resolves when the run's resources are released or abandoned.
    */
   dispose(): Promise<void> {
-    this.disposed ??= (async () => {
+    if (this.disposed !== undefined) return this.disposed
+    // Claim the public transaction BEFORE its body invokes child/provider
+    // disposal. A raw provider callback can reenter handle.dispose(); it must
+    // join this promise rather than start a second traversal.
+    const claimed = Promise.withResolvers<undefined>()
+    this.disposed = claimed.promise
+    void (async () => {
+      this.detachInputSignal()
       this.cancel('workflow disposed')
-      for (const [callId, run] of [...this.children]) void this.disposeChild(callId, run)
+      // cancel() deliberately becomes a no-op after terminal settlement, but
+      // disposal still owns every registered child. Reap independently so an
+      // already-settled workflow cannot wait on child quiescence before it has
+      // started the surviving children's disposals. On an unsettled run this
+      // joins the cancel path through the per-call cancellation/disposal gates.
+      this.reapChildren('workflow disposed')
       await Promise.race([
         (async () => {
           await this.result
@@ -225,13 +276,17 @@ export class WorkerRun implements WorkflowRun {
       ])
       await this.worker.terminate()
       this.reapChildren('workflow disposed')
-    })()
+    })().then(
+      () => { claimed.resolve(undefined) },
+      /* v8 ignore next -- result/quiescence never reject and Worker.terminate is the only external promise */
+      (error: unknown) => { claimed.reject(error) },
+    )
     return this.disposed
   }
 
   /** Post one message to the worker (payload looked up from the tag's map entry), tolerating a thread that is already gone. */
   private post<T extends HostToWorkerType>(type: T, payload: HostToWorkerPayloads[T]): void {
-    if (this.workerGone) return
+    if (this.workerGone || this.workerDeathObserved) return
     try {
       this.worker.postMessage({ type, ...payload })
     } catch (error: unknown) {
@@ -244,6 +299,11 @@ export class WorkerRun implements WorkflowRun {
   }
 
   private onMessage(message: WorkerToHostMessage): void {
+    // Node may emit `error`, then deliver an already-queued `message`, then
+    // emit `exit`. The first death signal is the host's logical delivery
+    // barrier: nothing arriving afterward may create a child, narrate after
+    // workflow/end, or compete with the chosen outcome.
+    if (this.workerDeathObserved) return
     switch (message.type) {
       case WorkerToHostType.Ready:
         this.post(HostToWorkerType.Go, {})
@@ -273,9 +333,6 @@ export class WorkerRun implements WorkflowRun {
       case WorkerToHostType.ChildStart:
         this.onChildStart(message.callId, message.request)
         break
-      case WorkerToHostType.ChildCancel:
-        this.children.get(message.callId)?.cancel(message.reason)
-        break
       case WorkerToHostType.ChildDispose:
         this.onChildDispose(message.callId)
         break
@@ -288,18 +345,44 @@ export class WorkerRun implements WorkflowRun {
     }
   }
 
-  private onChildStart(callId: number, request: ChildStartRequest): void {
+  /** Why a ready provider result may no longer be admitted to the worker. */
+  private childAdmissionFailure(): { reason: string; rendered: string } | undefined {
     if (this.cancelReason !== undefined) {
-      // The worker's start raced our cancel: refuse — a child must never
-      // start on an already-aborted signal (a provider subscribing only to
-      // future abort events would never observe it).
-      this.post(HostToWorkerType.ChildStartError, { callId, rendered: `workflow run cancelled: ${this.cancelReason}` })
+      return { reason: this.cancelReason, rendered: `workflow run cancelled: ${this.cancelReason}` }
+    }
+    if (this.workerDeathObserved) {
+      return { reason: 'workflow worker gone', rendered: 'workflow worker is no longer available' }
+    }
+    if (this.terminalClaimed) {
+      return { reason: 'workflow settled', rendered: 'workflow run already settled' }
+    }
+    return undefined
+  }
+
+  private onChildStart(callId: number, request: ChildStartRequest): void {
+    const initialFailure = this.childAdmissionFailure()
+    if (initialFailure !== undefined) {
+      // Refuse after a terminal boundary: a child must never start on an
+      // already-aborted signal (a provider subscribing only to future abort
+      // events would never observe it).
+      this.post(HostToWorkerType.ChildStartError, { callId, rendered: initialFailure.rendered })
       return
     }
     this.hostStarted += 1
+    const task = this.startChild(callId, request)
+    this.pendingStarts.add(task)
+    void task.then(
+      () => { this.finishPendingStart(task) },
+      /* v8 ignore next -- startChild contains provider and cleanup failures */
+      () => { this.finishPendingStart(task) },
+    )
+  }
+
+  /** Await one provider-owned startup transaction and publish only while admitted. */
+  private async startChild(callId: number, request: ChildStartRequest): Promise<void> {
     let run: SubagentRun
     try {
-      run = this.ctx.subagents.start(this.provider, {
+      run = await this.subagents.start(this.provider, {
         prompt: [{ type: 'text', text: request.prompt }],
         parent: this.parent,
         signal: this.controller.signal,
@@ -307,26 +390,38 @@ export class WorkerRun implements WorkflowRun {
         ...request.model !== undefined ? { agentOptions: { model: request.model } } : {},
       })
     } catch (error: unknown) {
-      this.post(HostToWorkerType.ChildStartError, { callId, rendered: renderThrown(error) })
+      const failure = this.childAdmissionFailure()
+      this.post(HostToWorkerType.ChildStartError, {
+        callId,
+        rendered: failure?.rendered ?? renderThrown(error),
+      })
+      return
+    }
+    const failure = this.childAdmissionFailure()
+    if (failure !== undefined) {
+      this.post(HostToWorkerType.ChildStartError, { callId, rendered: failure.rendered })
+      try {
+        await run.dispose()
+      } catch (error: unknown) {
+        this.ctx.logger.warn(`workflow-workerthread: refused child dispose failed: ${renderThrown(error)}`)
+      }
       return
     }
-    this.children.set(callId, run)
-    const childId = run.id
 
-    // Observe settlement IMMEDIATELY, before readiness. A provider may reject
-    // result and started in the same turn; delaying this handler would make the
-    // result transiently unhandled. Buffer a forwarding closure so the worker
-    // still sees ChildStarted before ChildSettled/ChildFailed. Snapshot a
-    // resolved result now: a provider mutating its resolved object while
-    // publication is pending must not change what crosses the worker boundary.
+    const record: ChildRecord = { run }
+    this.children.set(callId, record)
+    // Attach result forwarding before publishing the child handle. Because the
+    // callback itself runs in a later microtask, ChildStarted is still posted
+    // first even for an already-settled scripted provider.
     const forwardResult = run.result.then<() => void, () => void>(
       (result) => {
         try {
-          const snapshot: ChildResult = structuredClone({
+          const snapshot = snapshotJsonValue<ChildResult>({
             output: result.output,
             ...result.structured !== undefined ? { structured: result.structured } : {},
             stopReason: result.stopReason,
           })
+          if (snapshot === undefined) throw new TypeError('child result is not losslessly JSON-serializable')
           return () => { this.post(HostToWorkerType.ChildSettled, { callId, result: snapshot }) }
         } catch (error: unknown) {
           const rendered = `workflow child result could not cross the worker boundary: ${renderThrown(error)}`
@@ -338,35 +433,20 @@ export class WorkerRun implements WorkflowRun {
         return () => { this.post(HostToWorkerType.ChildFailed, { callId, rendered }) }
       },
     )
-
-    // The provider owns the publication boundary. Only acknowledge the child
-    // after it is real, then flush any result that settled unusually early. A
-    // readiness rejection is a START failure, not AGENT_RESULT: the worker
-    // never receives a handle, so the host must also dispose the registered
-    // attempt. A concurrent host disposal may already have removed it; the
-    // identity guard preserves the one-disposal memo in that race.
-    void run.started.then(
-      () => {
-        this.post(HostToWorkerType.ChildStarted, { callId, childId })
-        void forwardResult.then((forward) => { forward() })
-      },
-      (error: unknown) => {
-        this.post(HostToWorkerType.ChildStartError, { callId, rendered: renderThrown(error) })
-        if (this.children.get(callId) === run) void this.disposeChild(callId, run)
-      },
-    )
+    this.post(HostToWorkerType.ChildStarted, { callId, childId: run.id })
+    void forwardResult.then((forward) => { forward() })
   }
 
   private onChildDispose(callId: number): void {
-    const run = this.children.get(callId)
-    if (run === undefined) {
+    const record = this.children.get(callId)
+    if (record === undefined) {
       // Already disposed host-side (a dispose() drive or a death reap beat
       // the RPC) — the ack is still owed (the worker-side wrapper awaits it).
       this.post(HostToWorkerType.ChildDisposed, { callId })
       return
     }
     // disposeChild never rejects (containment is inside), so the ack always follows.
-    void this.disposeChild(callId, run).then(() => { this.post(HostToWorkerType.ChildDisposed, { callId }) })
+    void this.disposeChild(callId, record).then(() => { this.post(HostToWorkerType.ChildDisposed, { callId }) })
   }
 
   /**
@@ -378,57 +458,79 @@ export class WorkerRun implements WorkflowRun {
    * not supposed to reject, but a backend that does anyway must not break
    * quiescence): logged, and the child still leaves the registry.
    * @param callId - the child's registry key.
-   * @param run - the registered child (the caller looked it up).
+   * @param record - the registered child (the caller looked it up).
    * @returns resolves when the disposal settled either way; never rejects.
    */
-  private disposeChild(callId: number, run: SubagentRun): Promise<void> {
-    let disposal = this.childDisposals.get(callId)
-    if (disposal === undefined) {
-      // The seam promises a Promise, but invoke inside an async boundary so a
-      // contract-violating synchronous throw is contained exactly like a
-      // rejected disposal and cannot break host quiescence.
-      disposal = (async () => { await run.dispose() })().then(
-        () => { this.finishChild(callId) },
-        (error: unknown) => {
-          this.ctx.logger.warn(`workflow-workerthread: child dispose failed: ${renderThrown(error)}`)
-          this.finishChild(callId)
-        },
-      )
-      this.childDisposals.set(callId, disposal)
-    }
-    return disposal
+  private disposeChild(callId: number, record: ChildRecord): Promise<void> {
+    if (record.disposal !== undefined) return record.disposal
+    record.disposal = Promise.resolve()
+      .then(() => record.run.dispose())
+      .catch((error: unknown) => {
+        this.ctx.logger.warn(`workflow-workerthread: child dispose failed: ${renderThrown(error)}`)
+      })
+      .then(() => { this.finishChild(callId) })
+    return record.disposal
   }
 
-  /** Drop a child from the registry (and its disposal memo), releasing quiescence waiters at zero. */
+  /** Drop a child record and release quiescence waiters when all work ends. */
   private finishChild(callId: number): void {
     this.children.delete(callId)
-    this.childDisposals.delete(callId)
-    if (this.children.size === 0) {
-      for (const waiter of this.quiescenceWaiters.splice(0)) waiter()
-    }
+    this.notifyChildQuiescence()
   }
 
-  /** Resolves once the child registry is empty (every disposal settled). */
+  /** Retire one provider startup transaction. */
+  private finishPendingStart(task: Promise<void>): void {
+    this.pendingStarts.delete(task)
+    this.notifyChildQuiescence()
+  }
+
+  /** Release waiters only after both pending starts and published children end. */
+  private notifyChildQuiescence(): void {
+    if (this.children.size !== 0 || this.pendingStarts.size !== 0) return
+    for (const waiter of this.quiescenceWaiters.splice(0)) waiter()
+  }
+
+  /** Resolves once every pending start and published child has reached quiescence. */
   private childQuiescence(): Promise<void> {
-    if (this.children.size === 0) return Promise.resolve()
+    if (this.children.size === 0 && this.pendingStarts.size === 0) return Promise.resolve()
     return new Promise((resolve) => { this.quiescenceWaiters.push(resolve) })
   }
 
   /** Abort + dispose every registered child (worker death / final teardown); disposal is contained, not awaited. */
   private reapChildren(reason: string): void {
-    this.controller.abort(this.cancelReason ?? reason)
-    for (const [callId, run] of [...this.children]) {
-      run.cancel(this.cancelReason ?? reason)
-      void this.disposeChild(callId, run)
+    this.abortChildren(this.cancelReason ?? reason)
+    for (const [callId, record] of [...this.children]) {
+      void this.disposeChild(callId, record)
     }
   }
 
+  /** Abort the one canonical signal shared by pending and published children. */
+  private abortChildren(reason: string): void {
+    if (!this.controller.signal.aborted) this.controller.abort(reason)
+  }
+
   private onResult(result: WorkflowResult): void {
-    // The worker's settle-reap already child-cancel()s every stray; this
-    // abort fires the seam signal too, for providers that only honor the
-    // request signal (both channels, on every path).
-    if (this.cancelReason === undefined) this.controller.abort('workflow settled')
-    if (this.cancelReason !== undefined && result.stopReason !== 'cancelled') {
+    // The owned worker session sends one Result. Keep a late duplicate or a
+    // Result queued behind another terminal source completely side-effect-free.
+    if (this.terminalClaimed) return
+    // First-wins is decided when the Result message reaches the host. If no
+    // external cancellation was already in flight, this result won. Reaping a
+    // stray child below may synchronously reenter cancel() through provider
+    // callbacks, but that internal post-result cleanup must not retroactively
+    // rewrite the worker result that arrived first.
+    const cancellationWasRequested = this.cancelReason !== undefined
+    // Claim before settlement cleanup invokes provider disposal. Once Result
+    // won, a later cancellation cannot rewrite it.
+    this.terminalClaimed = true
+    // Abort pending starts and begin disposing published children before the
+    // workflow becomes externally settled. Cleanup remains independently
+    // tracked by childQuiescence and the holder's dispose().
+    this.reapChildren('workflow settled')
+    if (!cancellationWasRequested) {
+      this.settleResult(result)
+      return
+    }
+    if (result.stopReason !== 'cancelled') {
       // The script settled while our cancel was crossing the thread boundary
       // — the seam-visible result had NOT settled when cancellation was
       // requested, so report cancelled (the vm drive()'s post-settle check,
@@ -439,21 +541,39 @@ export class WorkerRun implements WorkflowRun {
     this.settleResult(result)
   }
 
-  /** An unexpected worker death (or the expected exit after termination). */
-  private onWorkerDeath(message: string): void {
-    // Whatever the worker left behind must not leak — abort + dispose it all.
-    if (this.children.size > 0) this.reapChildren('workflow worker gone')
-    // The thread is gone: no more worker-authored agent-ends can arrive —
-    // pair every stranded start (a start that crossed between the grace
-    // force-settle and this exit included) before the run settles.
-    this.endStrandedAgents()
-    // settleResult no-ops on an already-settled run (the expected exit after
-    // a dispose's terminate lands here too).
-    if (this.cancelReason !== undefined) {
-      this.settleResult(this.cancelledResult(this.hostStarted))
-      return
+  /** Process an error/messageerror/exit signal; `exit` also performs the final disposal sweep. */
+  private onWorkerDeath(message: string, isExit: boolean): void {
+    if (!this.workerDeathObserved) {
+      // Close message admission BEFORE cleanup callbacks: Node can deliver a
+      // message queued before the crash after its `error` event. Treating the
+      // first death signal as a logical barrier prevents that late message
+      // from creating work or narrating after workflow/end.
+      this.workerDeathObserved = true
+      const outcomeWasClaimed = this.terminalClaimed
+      const cancellationWasRequested = this.cancelReason !== undefined
+      // When death is itself the terminal source, claim BEFORE child reap or
+      // synthesized observer callbacks. Either can reenter cancel(); a death
+      // that arrived first remains an error, while a cancellation already
+      // accepted before death remains cancelled. If Result/grace already won,
+      // preserve it while still performing prompt failure-time cleanup.
+      if (!outcomeWasClaimed) this.terminalClaimed = true
+      if (this.children.size > 0 || this.pendingStarts.size > 0) this.reapChildren('workflow worker gone')
+      this.endStrandedAgents()
+      if (!outcomeWasClaimed) {
+        if (cancellationWasRequested) {
+          this.settleResult(this.cancelledResult(this.hostStarted))
+        } else {
+          this.settleResult({ value: null, stopReason: 'error', error: message, agentsStarted: this.hostStarted })
+        }
+      }
     }
-    this.settleResult({ value: null, stopReason: 'error', error: message, agentsStarted: this.hostStarted })
+    if (!isExit) return
+    // `error` is not Node's physical delivery barrier: a queued message may
+    // precede `exit`. Admission is already closed, so this final sweep only
+    // joins/starts disposal for registry survivors; it deliberately does not
+    // repeat explicit provider cancellation.
+    for (const [callId, record] of [...this.children]) void this.disposeChild(callId, record)
+    this.endStrandedAgents()
   }
 
   /**
@@ -472,11 +592,14 @@ export class WorkerRun implements WorkflowRun {
   /**
    * Synthesize the missing `agent-end` for every started-but-unpaired agent,
    * outcome `'cancelled'`: the reap cancels every child, and a real
-   * settlement racing the force-settle loses to the cancellation — the same
-   * first-wins override {@link onResult} applies to the run's own result.
+   * settlement racing the force-settle loses to that already-started external
+   * cancellation. The atomic terminal boundaries in {@link onResult} and
+   * {@link onWorkerDeath} deliberately exclude teardown callbacks as contenders.
    * Called where the worker can no longer speak (the grace force-settle,
-   * worker death), BEFORE settleResult, so the paired ends reach observers
-   * before `workflow/end`.
+   * worker death, physical exit). When grace/death is the terminal source it
+   * runs before settleResult, so already-known pairs precede `workflow/end`;
+   * after an earlier Result, exit cleanup may close a survivor afterward.
+   * The ledger preserves exactly-once pairing in both orders.
    */
   private endStrandedAgents(): void {
     for (const info of [...this.liveAgents.values()]) {
@@ -492,10 +615,25 @@ export class WorkerRun implements WorkflowRun {
     return { value: null, stopReason: 'cancelled', error: `workflow run cancelled: ${reason}`, agentsStarted }
   }
 
-  /** First settle wins; disarms the grace timer. */
+  /** Remove the exact abort callback installed on the caller's start signal. */
+  private detachInputSignal(): void {
+    const signal = this.inputSignal
+    const onAbort = this.inputSignalAbort
+    if (signal === undefined || onAbort === undefined) return
+    this.inputSignal = undefined
+    this.inputSignalAbort = undefined
+    signal.removeEventListener('abort', onAbort)
+  }
+
+  /** First settle wins; disarms the grace timer and releases the caller signal. */
   private settleResult(result: WorkflowResult): void {
+    // Every current terminal source claims ownership before calling here; keep
+    // the fallback local so a future caller cannot resolve twice.
+    /* v8 ignore next -- defensive fallback outside the claimed state machine */
     if (this.settled) return
+    this.terminalClaimed = true
     this.settled = true
+    this.detachInputSignal()
     clearTimeout(this.graceTimer)
     this.settleResolve(result)
   }
diff --git a/packages/workflow/workflow-workerthread/src/index.ts b/packages/workflow/workflow-workerthread/src/index.ts
index e0b8caf3fb..a1f5b47ccc 100644
--- a/packages/workflow/workflow-workerthread/src/index.ts
+++ b/packages/workflow/workflow-workerthread/src/index.ts
@@ -151,9 +151,7 @@ export class WorkerWorkflowEngine extends WorkflowService {
     const meta = validateMeta(request.meta)
     assertBodyParses(request.script, meta.name)
     const id = WorkflowRunId(randomUUID())
-    // The event payloads and the run handle get SEPARATE meta clones: a
-    // listener mutating its snapshot must not corrupt the holder's view.
-    const info: WorkflowRunInfo = { id, meta: structuredClone(meta) }
+    const info: WorkflowRunInfo = { id, meta }
     const limits: WorkerLimits = {
       maxConcurrentAgents: this.config.maxConcurrentAgents === 0
         ? Math.min(16, Math.max(1, availableParallelism() - 2))
@@ -168,10 +166,19 @@ export class WorkerWorkflowEngine extends WorkflowService {
       ...request.args !== undefined ? { args: request.args } : {},
       limits,
     }
+    // Capture the dependency while this service call is still traced through
+    // the start() holder. Cordis strips the engine-provider shadow when it
+    // returns the SubagentService handle, so an already-returned run can keep
+    // starting children after an engine HMR unload removes ctx.workflows.
+    // Re-resolving `this.ctx.subagents` later from WorkerRun would instead walk
+    // the now-inactive engine fiber and break the seam's holder-owned lifetime.
+    const runCtx = this.ctx
+    const subagents = runCtx.subagents
     const workerRun = new WorkerRun(
-      this.ctx,
+      runCtx,
+      subagents,
       id,
-      structuredClone(meta),
+      meta,
       request.parent,
       init,
       this.config.provider,
diff --git a/packages/workflow/workflow-workerthread/src/protocol.ts b/packages/workflow/workflow-workerthread/src/protocol.ts
index d70ad11613..70edc9a713 100644
--- a/packages/workflow/workflow-workerthread/src/protocol.ts
+++ b/packages/workflow/workflow-workerthread/src/protocol.ts
@@ -33,8 +33,6 @@ export enum WorkerToHostType {
   AgentEnd = 'agent-end',
   /** Child RPC: start a child on the host (answered by ChildStarted or ChildStartError). */
   ChildStart = 'child-start',
-  /** Child RPC: cancel a started child (fire-and-forget). */
-  ChildCancel = 'child-cancel',
   /** Child RPC: dispose a started child (answered by ChildDisposed). */
   ChildDispose = 'child-dispose',
   /** The run's single terminal result. */
@@ -55,8 +53,6 @@ export interface WorkerToHostPayloads {
   [WorkerToHostType.AgentEnd]: { info: WorkflowAgentEndInfo }
   /** The RPC correlation id and the prompt plus validated options. */
   [WorkerToHostType.ChildStart]: { callId: number; request: ChildStartRequest }
-  /** The RPC correlation id and the cancel reason (undefined = unspecified). */
-  [WorkerToHostType.ChildCancel]: { callId: number; reason: string | undefined }
   /** The RPC correlation id of the child to dispose. */
   [WorkerToHostType.ChildDispose]: { callId: number }
   /** The run's terminal outcome. */
@@ -69,9 +65,9 @@ export enum HostToWorkerType {
   Go = 'go',
   /** Cancel the run: hooks start throwing and the script dies at its next await. */
   Cancel = 'cancel',
-  /** Child RPC reply: provider publication/readiness fulfilled (exactly one start reply per ChildStart). */
+  /** Child RPC reply: the provider fulfilled with a ready run (exactly one start reply per ChildStart). */
   ChildStarted = 'child-started',
-  /** Child RPC reply: synchronous start or asynchronous publication/readiness failed. */
+  /** Child RPC reply: the provider's asynchronous start failed. */
   ChildStartError = 'child-start-error',
   /** Child RPC: a started child's result RESOLVED (its JSON projection). */
   ChildSettled = 'child-settled',
diff --git a/packages/workflow/workflow-workerthread/src/runtime.ts b/packages/workflow/workflow-workerthread/src/runtime.ts
index 2add6d537c..94282cb173 100644
--- a/packages/workflow/workflow-workerthread/src/runtime.ts
+++ b/packages/workflow/workflow-workerthread/src/runtime.ts
@@ -20,7 +20,7 @@
  *
  * Failure discipline: fatal {@link WorkflowError}s (bad hook arguments,
  * unsupported options/schemas, tripped caps, synchronous start refusal,
- * pre-publication readiness failure, ready-child result rejection, and
+ * provider-start failure, ready-child result rejection, and
  * cancellation) ALWAYS propagate through
  * `parallel`/`pipeline` — recognized by `instanceof` against this realm's
  * class, which a script inside the vm context cannot forge — and the per-item
@@ -83,7 +83,8 @@ function defaultLabel(prompt: string): string {
 /**
  * One live script execution inside the worker. Constructed per run by the
  * session; `drive()` is called exactly once and NEVER rejects — every failure
- * becomes a {@link WorkflowResult} with a non-`completed` stop reason.
+ * becomes a {@link WorkflowResult} with a non-`completed` stop reason. The
+ * host owns cancellation and cleanup of any dropped child work.
  */
 export class WorkflowExecution {
   /** 1-based count of `agent()` calls started (the `agentsStarted` result field). */
@@ -92,7 +93,6 @@ export class WorkflowExecution {
   private readonly slotWaiters: { resolve(): void; reject(error: unknown): void }[] = []
   private cancelReason: string | undefined
   private cancelError: WorkflowError | undefined
-  private readonly controller = new AbortController()
   private currentPhase: string | undefined
   private readonly context: vm.Context
   private readonly compiled: vm.Script
@@ -128,11 +128,8 @@ export class WorkflowExecution {
       pipeline: (items: unknown, ...stages: unknown[]) => this.contain(this.pipeline(items, stages)),
       phase: (title: unknown) => { this.phase(title) },
       log: (message: unknown) => { this.log(message) },
-      // Cloned once: a script scribbling on args must not mutate the
-      // session's init object (a benign-bug guard; args is plain JSON by the
-      // seam contract and already crossed one structured clone as workerData,
-      // so this clone is total).
-      args: args === undefined ? undefined : structuredClone(args),
+      // workerData already performed the real cross-thread structured clone.
+      args,
     }
     for (const [key, value] of Object.entries(globals)) {
       // Data properties on the contextified global; frozen shape not required —
@@ -163,21 +160,18 @@ export class WorkflowExecution {
   }
 
   /**
-   * Cancel the run: in-flight children get a cancel RPC (the shared abort
-   * fanout), waiting `agent()` slots reject, and every future hook call
+   * Cancel the run: waiting `agent()` slots reject and every future hook call
    * throws `CANCELLED` — the script dies at its next await. A script that
    * never settles anyway (parked on a promise no hook owns) is the HOST's
    * problem: its grace timer force-settles the run and terminates the
    * worker. Idempotent; the first reason wins.
-   * @param reason - human-readable cause, carried on the CANCELLED error and
-   * into child cancel RPCs. Required: every caller (the session's cancel
-   * message, drive()'s settle-reap) has a concrete reason.
+   * @param reason - human-readable cause carried on the CANCELLED error. The
+   * host independently aborts the required signal shared by every child.
    */
   cancel(reason: string): void {
     if (this.cancelReason !== undefined) return
     this.cancelReason = reason
     this.cancelError = new WorkflowError(`workflow run cancelled: ${this.cancelReason}`, 'CANCELLED')
-    this.controller.abort(this.cancelReason)
     for (const waiter of this.slotWaiters.splice(0)) waiter.reject(this.cancelledError())
   }
 
@@ -185,8 +179,8 @@ export class WorkflowExecution {
    * Run the script to settlement. Resolves — never rejects — with the run's
    * {@link WorkflowResult}: the materialized return value on `completed`, the
    * failure message on `error`, and `cancelled` when the script died of
-   * cancellation. After settlement, any stray children a script fired without
-   * awaiting are cancelled (their `agent()` wrappers dispose them via RPC).
+   * cancellation. This method only chooses the result; the session publishes
+   * it and the host owns terminal child cancellation.
    * @returns the settled outcome — this promise NEVER rejects (the seam's
    * `result`-never-rejects contract); every failure maps to a variant.
    */
@@ -214,12 +208,6 @@ export class WorkflowExecution {
       // cannot throw — drive() resolving is the `result` never-rejects seam
       // contract.
       return { value: null, stopReason: 'error', error: renderThrown(error), agentsStarted: this.started }
-    } finally {
-      // Reap strays: a script that fired agent() calls without awaiting them
-      // leaves live children behind after settlement — cancel them all. (The
-      // per-call wrappers dispose each child; the contain() consumer keeps
-      // their rejections from going unhandled.)
-      if (this.cancelReason === undefined) this.cancel('workflow settled')
     }
   }
 
@@ -328,17 +316,11 @@ export class WorkflowExecution {
       // wind the fresh child down instead of leaving it live behind a dead
       // script.
       if (this.isCancelled()) {
-        run.cancel(this.cancelReason)
         await run.dispose()
         throw this.cancelledError()
       }
       const info: WorkflowAgentInfo = { seq, label, ...phase !== undefined ? { phase } : {}, childId: AgentId(run.id) }
       this.observer.agentStart(info)
-      // Cancellation reaches the child through an explicit cancel RPC per
-      // child (the host also aborts its own per-run signal, but the seam
-      // leaves a provider free to honor either channel, so both are driven).
-      const onAbort = (): void => { run.cancel(this.cancelReason) }
-      this.controller.signal.addEventListener('abort', onAbort, { once: true })
       try {
         let result
         try {
@@ -379,7 +361,6 @@ export class WorkflowExecution {
         this.observer.agentEnd({ ...info, outcome: 'failed' })
         return null
       } finally {
-        this.controller.signal.removeEventListener('abort', onAbort)
         await run.dispose()
       }
     } finally {
diff --git a/packages/workflow/workflow-workerthread/src/session.ts b/packages/workflow/workflow-workerthread/src/session.ts
index b159892021..671a9429ae 100644
--- a/packages/workflow/workflow-workerthread/src/session.ts
+++ b/packages/workflow/workflow-workerthread/src/session.ts
@@ -59,10 +59,6 @@ class RpcChildHandle implements ChildHandle {
     this.result = entry.settled.promise
   }
 
-  cancel(reason?: string): void {
-    this.post(WorkerToHostType.ChildCancel, { callId: this.callId, reason })
-  }
-
   dispose(): Promise<void> {
     this.post(WorkerToHostType.ChildDispose, { callId: this.callId })
     return this.entry.disposed.promise
@@ -71,7 +67,7 @@ class RpcChildHandle implements ChildHandle {
 
 /**
  * The worker-side child-RPC bridge ({@link ChildPort}): allocates callIds,
- * posts the start/cancel/dispose RPCs, and owns the per-call pending
+ * posts the start/dispose RPCs, and owns the per-call pending
  * book-keeping the session's message handler settles via the `onChild*`
  * entry points.
  */
@@ -89,10 +85,10 @@ class ChildRpcBridge implements ChildPort {
       settled: Promise.withResolvers<ChildResult>(),
       disposed: Promise.withResolvers<void>(),
     }
-    // Containment: when synchronous start or asynchronous readiness fails (or
+    // Containment: when asynchronous provider start fails (or
     // the run is torn down), the settled promise may never gain a consumer —
     // it must not surface as an unhandled rejection and kill the worker.
-    entry.settled.promise.catch(() => { /* consumed: unconsumed child settlement after failed start/readiness */ })
+    entry.settled.promise.catch(() => { /* consumed: unconsumed child settlement after failed start */ })
     this.pending.set(callId, entry)
     this.post(WorkerToHostType.ChildStart, { callId, request })
     const childId = await entry.started.promise
@@ -104,7 +100,7 @@ class ChildRpcBridge implements ChildPort {
     this.pending.get(callId)?.started.resolve(childId)
   }
 
-  /** Synchronous start or asynchronous readiness failed; reject and retire the pending RPC. */
+  /** Asynchronous provider start failed; reject and retire the pending RPC. */
   onChildStartError(callId: number, rendered: string): void {
     const entry = this.pending.get(callId)
     this.pending.delete(callId)
diff --git a/packages/workflow/workflow-workerthread/src/types.ts b/packages/workflow/workflow-workerthread/src/types.ts
index ee5faccdda..2f29dd8137 100644
--- a/packages/workflow/workflow-workerthread/src/types.ts
+++ b/packages/workflow/workflow-workerthread/src/types.ts
@@ -77,8 +77,6 @@ export interface ChildHandle {
    * failed for its own reasons resolves with a non-`completed` stop reason.
    */
   readonly result: Promise<ChildResult>
-  /** Ask the host to cancel the child (fire-and-forget). */
-  cancel(reason?: string): void
   /** Ask the host to dispose the child; resolves on the host's ack. */
   dispose(): Promise<void>
 }
@@ -92,7 +90,7 @@ export interface ChildPort {
    * Start one child agent on the host (the `agent()` hook's start half).
    * @param request - the prompt and validated options.
    * @returns the ready child handle; rejects when synchronous start or the
-   *   provider's asynchronous publication/readiness boundary fails.
+   *   provider's asynchronous start fails.
    */
   startAgent(request: ChildStartRequest): Promise<ChildHandle>
 }
diff --git a/packages/workflow/workflow-workerthread/tests/integration.spec.ts b/packages/workflow/workflow-workerthread/tests/integration.spec.ts
index 51ace9253b..0e1727f877 100644
--- a/packages/workflow/workflow-workerthread/tests/integration.spec.ts
+++ b/packages/workflow/workflow-workerthread/tests/integration.spec.ts
@@ -49,7 +49,7 @@ describe('dsh-workflow-workerthread over the real in-process stack', () => {
     ])
     const childIds: string[] = []
     ctx.on('workflow/agent-start', (_info, agent) => {
-      // The workflow bridge must honor SubagentRun.started: a start observer
+      // The workflow bridge must await asynchronous provider start: an observer
       // sees the real spawn child already published, never a reserved id.
       expect(ctx.agents.get(agent.childId)).toBeDefined()
       childIds.push(agent.childId)
diff --git a/packages/workflow/workflow-workerthread/tests/session.spec.ts b/packages/workflow/workflow-workerthread/tests/session.spec.ts
index 00051ad56a..5fc85ce647 100644
--- a/packages/workflow/workflow-workerthread/tests/session.spec.ts
+++ b/packages/workflow/workflow-workerthread/tests/session.spec.ts
@@ -212,7 +212,7 @@ describe('runWorkerSession over an in-process MessageChannel', () => {
     host.close()
   })
 
-  it('cancel mid-run: in-flight children get cancel RPCs, hooks throw at entry, the run reports cancelled', async () => {
+  it('cancel mid-run: hooks throw at entry and the run reports cancelled', async () => {
     const host = fakeHost()
     void runWorkerSession(host.port, init(`
       phase('before')
@@ -232,7 +232,6 @@ describe('runWorkerSession over an in-process MessageChannel', () => {
     const result = await host.result()
     expect(result.stopReason).toBe('cancelled')
     expect(result.error).toContain('stop everything')
-    expect(host.ofType(WorkerToHostType.ChildCancel).map(m => m.callId)).toContain(callId)
     expect(host.ofType(WorkerToHostType.AgentEnd)[0]!.info.outcome).toBe('cancelled')
     // No post-cancel narration left the runtime (the hooks threw at entry).
     expect(host.ofType(WorkerToHostType.Phase).map(m => m.title)).toEqual(['before'])
@@ -433,7 +432,7 @@ describe('runWorkerSession over an in-process MessageChannel', () => {
     host.close()
   })
 
-  it('a cancel landing DURING the start round-trip winds the fresh child down (cancel + dispose) and dies cancelled', async () => {
+  it('a cancel landing DURING the start round-trip disposes the fresh child and dies cancelled', async () => {
     const host = fakeHost({ manual: true })
     void runWorkerSession(host.port, init("return await agent('p')"))
     await vi.waitFor(() => { expect(host.ofType(WorkerToHostType.ChildStart).length).toBe(1) })
@@ -447,7 +446,6 @@ describe('runWorkerSession over an in-process MessageChannel', () => {
     const result = await host.result()
     expect(result.stopReason).toBe('cancelled')
     await vi.waitFor(() => {
-      expect(host.ofType(WorkerToHostType.ChildCancel).map(m => m.callId)).toContain(callId)
       expect(host.ofType(WorkerToHostType.ChildDispose).map(m => m.callId)).toContain(callId)
     })
     // The child never became an agent-start: it was wound down pre-lifecycle.
diff --git a/packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts b/packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts
new file mode 100644
index 0000000000..7f34396d52
--- /dev/null
+++ b/packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts
@@ -0,0 +1,38 @@
+/**
+ * Keyless runtime smoke for the source-mode workflow worker. The Node
+ * compatibility matrix runs this WHOLE file, so renaming or removing its test
+ * cannot turn the runtime proof into a successful zero-match filter.
+ */
+
+import { expect, it, vi } from 'vitest'
+import { Context } from 'cordis'
+import { AgentId } from '@deepseek-ai/dsh-agent'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import SubagentService from '@deepseek-ai/dsh-subagent'
+import WorkerWorkflowEngine from '../src/index.ts'
+
+// A fresh thread compiles the source runtime. Leave contention headroom on
+// shared CI runners without weakening any engine-level timeout assertion.
+vi.setConfig({ testTimeout: 30_000 })
+
+it('runs the default config through the source worker', async () => {
+  const ctx = new Context()
+  const subagents = await ctx.plugin(SubagentService)
+  const engine = await ctx.plugin(WorkerWorkflowEngine, {})
+  const parent = { id: AgentId('workflow-compat-parent'), options: {} } as unknown as Agent
+  try {
+    const run = ctx.workflows.start({
+      script: 'return 6 * 7',
+      meta: { name: 'source-worker-compat', description: 'exercise the unbuilt worker entry' },
+      parent,
+    })
+    try {
+      await expect(run.result).resolves.toMatchObject({ value: 42, stopReason: 'completed', agentsStarted: 0 })
+    } finally {
+      await run.dispose()
+    }
+  } finally {
+    await engine.dispose()
+    await subagents.dispose()
+  }
+})
diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts
index 23d4de0f07..4ad00ee02f 100644
--- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts
+++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { fileURLToPath } from 'node:url'
+import type { Worker } from 'node:worker_threads'
 import { Context } from 'cordis'
 import Loader from '@cordisjs/plugin-loader'
 import { AgentId } from '@deepseek-ai/dsh-agent'
@@ -8,7 +9,7 @@ import SubagentService from '@deepseek-ai/dsh-subagent'
 import type { SubagentCapabilities, SubagentProvider, SubagentResult, SubagentRun, SubagentStartRequest } from '@deepseek-ai/dsh-subagent'
 import type { WorkflowMeta, WorkflowResult, WorkflowResultInfo, WorkflowRunInfo } from '@deepseek-ai/dsh-workflow'
 import * as workerEngineModule from '../src/index.ts'
-import WorkerWorkflowEngine, { HostToWorkerType, type Config } from '../src/index.ts'
+import WorkerWorkflowEngine, { HostToWorkerType, WorkerToHostType, type Config } from '../src/index.ts'
 
 /** A minimal parent stand-in: the engine only threads it through to the provider. */
 function fakeParent(): Agent {
@@ -47,9 +48,9 @@ const ESCAPE = "globalThis.constructor.constructor('return process')()"
 /** One controllable child run: the test (or auto mode) settles it. */
 interface ControlledRun {
   request: SubagentStartRequest
-  /** Fulfill the provider publication/readiness boundary. */
+  /** Fulfill the provider's async start with a ready child. */
   publish(): void
-  /** Reject the provider publication/readiness boundary. */
+  /** Reject the provider's async start before ownership transfer. */
   rejectStart(error: unknown): void
   settle(result: SubagentResult): void
   rejectResult(error: unknown): void
@@ -74,15 +75,19 @@ class StubProvider implements SubagentProvider {
     private readonly reply?: (request: SubagentStartRequest, index: number) => SubagentResult,
     private readonly disposeDelayMs = 0,
     private readonly deferStart = false,
+    private readonly onAbortString?: (reason: string | undefined, index: number) => void,
+    private readonly onSignalAbort?: (reason: unknown, index: number) => void,
   ) {}
 
-  start(request: SubagentStartRequest): SubagentRun {
-    const readiness = Promise.withResolvers<undefined>()
+  async start(request: SubagentStartRequest): Promise<SubagentRun> {
+    const startGate = Promise.withResolvers<undefined>()
     const terminal = Promise.withResolvers<SubagentResult>()
+    terminal.promise.catch(() => { /* provider owns early settlement until publication */ })
+    let published = false
     const controlled: ControlledRun = {
       request,
-      publish: () => { readiness.resolve(undefined) },
-      rejectStart: (error) => { readiness.reject(error) },
+      publish: () => { published = true; startGate.resolve(undefined) },
+      rejectStart: (error) => { startGate.reject(error) },
       settle: (result) => { terminal.resolve(result) },
       rejectResult: (error) => { terminal.reject(error) },
       cancelled: undefined,
@@ -91,20 +96,29 @@ class StubProvider implements SubagentProvider {
     }
     this.runs.push(controlled)
     const index = this.runs.length - 1
-    request.signal?.addEventListener('abort', () => { terminal.resolve({ output: [], stopReason: 'aborted' }) }, { once: true })
-    if (!this.deferStart) readiness.resolve(undefined)
+    request.signal.addEventListener('abort', () => {
+      controlled.cancelled = String(request.signal.reason ?? 'cancelled')
+      this.onAbortString?.(String(request.signal.reason ?? 'cancelled'), index)
+      this.onSignalAbort?.(request.signal.reason, index)
+      if (published) terminal.resolve({ output: [], stopReason: 'aborted' })
+      else startGate.reject(new Error('child start aborted before publication'))
+    }, { once: true })
+    if (!this.deferStart) controlled.publish()
     if (this.reply) {
       const reply = this.reply
       queueMicrotask(() => { terminal.resolve(reply(request, index)) })
     }
+    try {
+      await startGate.promise
+    } catch (error: unknown) {
+      controlled.disposeCalls += 1
+      controlled.disposed = true
+      throw error
+    }
+    if (request.signal.aborted) throw new Error('child start aborted before publication')
     return {
       id: AgentId(`stub-child-${index}`),
-      started: readiness.promise,
       result: terminal.promise,
-      cancel: (reason?: string) => {
-        controlled.cancelled = reason ?? 'cancelled'
-        terminal.resolve({ output: [], stopReason: 'aborted' })
-      },
       dispose: () => {
         controlled.disposeCalls += 1
         if (this.disposeDelayMs === 0) {
@@ -133,6 +147,8 @@ interface SetupOptions {
   manual?: boolean
   disposeDelayMs?: number
   deferStart?: boolean
+  onChildAbortString?: (reason: string | undefined, index: number) => void
+  onChildSignalAbort?: (reason: unknown, index: number) => void
 }
 
 async function setup(options?: SetupOptions) {
@@ -143,13 +159,15 @@ async function setup(options?: SetupOptions) {
     options?.manual ? undefined : options?.reply ?? (() => text('stub reply')),
     options?.disposeDelayMs ?? 0,
     options?.deferStart ?? false,
+    options?.onChildAbortString,
+    options?.onChildSignalAbort,
   )
   ctx.subagents.registerProvider(provider)
   // A fixed concurrency ceiling: the auto-resolved default is machine-derived
   // (cores - 2, floored at 1), so tests that expect N children in flight
   // would wedge on small CI runners.
-  await ctx.plugin(WorkerWorkflowEngine, { provider: 'stub', maxConcurrentAgents: 8, ...options?.config })
-  return { ctx, provider, parent: fakeParent() }
+  const engineFiber = await ctx.plugin(WorkerWorkflowEngine, { provider: 'stub', maxConcurrentAgents: 8, ...options?.config })
+  return { ctx, provider, parent: fakeParent(), engineFiber }
 }
 
 /** The standard test meta plus a body, spread into a start request. */
@@ -232,7 +250,7 @@ describe('dsh-workflow-workerthread', () => {
       expect(result.error).toContain('agent() could not start a child')
     })
 
-    it('waits for child readiness before announcing it and snapshots a result that settled early', async () => {
+    it('waits for async provider start before announcing a result that settled early', async () => {
       const { ctx, parent, provider } = await setup({ manual: true, deferStart: true })
       const order: string[] = []
       ctx.on('workflow/agent-start', (_info, agent) => { order.push(`start:${agent.seq}`) })
@@ -243,10 +261,8 @@ describe('dsh-workflow-workerthread', () => {
       await waitFor(() => { expect(provider.runs.length).toBe(1) })
       const early = text('accepted value')
       provider.runs[0]!.settle(early)
-      // Let the host observe + snapshot result while readiness remains pending.
+      // The provider still owns this early result while start is pending.
       await new Promise(resolve => setTimeout(resolve, 0))
-      const earlyText = early.output[0] as { type: 'text'; text: string }
-      earlyText.text = 'mutated after settlement'
       expect(order).toEqual([])
 
       provider.runs[0]!.publish()
@@ -257,7 +273,7 @@ describe('dsh-workflow-workerthread', () => {
       expect(provider.runs[0]!.disposeCalls).toBe(1)
     })
 
-    it('observes an early result rejection but sends ChildStarted before ChildFailed after readiness', async () => {
+    it('observes an early result rejection but sends ChildStarted before ChildFailed after start fulfills', async () => {
       const { ctx, parent, provider } = await setup({ manual: true, deferStart: true })
       const lifecycle: string[] = []
       ctx.on('workflow/agent-start', () => { lifecycle.push('start') })
@@ -288,7 +304,7 @@ describe('dsh-workflow-workerthread', () => {
       await handle.dispose()
     })
 
-    it('classifies readiness rejection as AGENT_START, drops an early result, and emits no false lifecycle pair', async () => {
+    it('classifies provider start rejection as AGENT_START, drops an early result, and emits no false lifecycle pair', async () => {
       const { ctx, parent, provider } = await setup({ manual: true, deferStart: true })
       const lifecycle: string[] = []
       ctx.on('workflow/agent-start', () => { lifecycle.push('start') })
@@ -300,7 +316,7 @@ describe('dsh-workflow-workerthread', () => {
       })
       await waitFor(() => { expect(provider.runs.length).toBe(1) })
       // ACP-style failure can settle result(error) before its session/publication
-      // boundary rejects. Readiness must dominate that buffered child outcome.
+      // boundary rejects. Start rejection must dominate that buffered child outcome.
       provider.runs[0]!.settle({ output: [], stopReason: 'error' })
       await new Promise(resolve => setTimeout(resolve, 0))
       provider.runs[0]!.rejectStart(new Error('publication rolled back'))
@@ -317,7 +333,7 @@ describe('dsh-workflow-workerthread', () => {
       expect(provider.runs[0]!.disposeCalls).toBe(1)
     })
 
-    it('cancels and disposes a readiness-pending child once without publishing workflow lifecycle', async () => {
+    it('aborts a pending provider start once without publishing workflow lifecycle', async () => {
       const { ctx, parent, provider } = await setup({ manual: true, deferStart: true, config: { disposeGraceMs: 500 } })
       const lifecycle: string[] = []
       ctx.on('workflow/agent-start', () => { lifecycle.push('start') })
@@ -331,7 +347,7 @@ describe('dsh-workflow-workerthread', () => {
         expect(provider.runs[0]!.disposed).toBe(true)
       })
       // Ensure the host-driven disposal removed the registry entry before the
-      // late readiness rejection; its callback must not invoke dispose again.
+      // late start rejection; its callback must not invoke dispose again.
       await new Promise(resolve => setTimeout(resolve, 0))
       provider.runs[0]!.rejectStart(new Error('cancelled before publication'))
 
@@ -349,11 +365,9 @@ describe('dsh-workflow-workerthread', () => {
         name: 'rejecting',
         capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false },
         inheritsParentContext: false,
-        start: () => ({
+        start: async () => ({
           id: AgentId('reject-child'),
-          started: Promise.resolve(),
           result: Promise.reject(new Error('backend exploded')),
-          cancel: () => { /* nothing in flight */ },
           dispose: () => Promise.resolve(),
         }),
       }
@@ -366,15 +380,39 @@ describe('dsh-workflow-workerthread', () => {
       expect((result.value as { message: string }).message).toContain('backend exploded')
     })
 
-    it('maps an uncloneable ready-child result to fatal AGENT_RESULT instead of wedging the bridge', async () => {
+    it('maps a non-JSON ready-child result to fatal AGENT_RESULT instead of wedging the bridge', async () => {
       const { ctx, parent } = await setup({
-        reply: () => ({ output: [], structured: () => { /* deliberately not cloneable */ }, stopReason: 'completed' }),
+        reply: () => ({ output: [], structured: () => { /* deliberately outside lossless JSON */ }, stopReason: 'completed' }),
       })
       const result = await run(ctx, parent, scripted(`
         try { await agent('p'); return 'unreachable' } catch (e) { return { code: e.code, message: e.message } }
       `))
       expect(result.value).toMatchObject({ code: 'AGENT_RESULT' })
-      expect((result.value as { message: string }).message).toContain('could not cross the worker boundary')
+      expect((result.value as { message: string }).message).toContain('workflow child result could not cross the worker boundary')
+    })
+
+    it('contains a non-JSON result even if the injected subagent service violates its normalization contract', async () => {
+      // The real worker boundary must reject a non-JSON same-process result.
+      const { ctx, parent } = await setup()
+      const invalid = {
+        output: [],
+        structured: () => { /* deliberately outside lossless JSON */ },
+        stopReason: 'completed',
+      } as unknown as SubagentResult
+      const start = vi.spyOn(ctx.subagents, 'start').mockResolvedValue({
+        id: AgentId('raw-invalid-child'),
+        result: Promise.resolve(invalid),
+        dispose: () => Promise.resolve(),
+      })
+
+      const result = await run(ctx, parent, scripted(`
+        try { await agent('p'); return 'unreachable' } catch (e) { return { code: e.code, message: e.message } }
+      `))
+
+      expect(start).toHaveBeenCalledOnce()
+      expect(result.value).toMatchObject({ code: 'AGENT_RESULT' })
+      expect((result.value as { message: string }).message)
+        .toContain('workflow child result could not cross the worker boundary')
     })
 
     it('a child whose dispose() throws synchronously cannot wedge the script (the host acks anyway)', async () => {
@@ -384,9 +422,8 @@ describe('dsh-workflow-workerthread', () => {
         name: 'bad-dispose',
         capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false },
         inheritsParentContext: false,
-        start: () => ({
+        start: async () => ({
           id: AgentId('bad-dispose-child'),
-          started: Promise.resolve(),
           result: Promise.resolve({ output: [{ type: 'text', text: 'fine' }], stopReason: 'completed' }),
           cancel: () => { /* settled already */ },
           dispose: () => { throw new Error('dispose exploded') },
@@ -406,9 +443,8 @@ describe('dsh-workflow-workerthread', () => {
         name: 'coercion-trap-dispose',
         capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false },
         inheritsParentContext: false,
-        start: () => ({
+        start: async () => ({
           id: AgentId('trap-child'),
-          started: Promise.resolve(),
           result: Promise.resolve({ output: [{ type: 'text', text: 'fine' }], stopReason: 'completed' }),
           cancel: () => { /* settled already */ },
           // The rejection VALUE's own coercion throws: a warn built with bare
@@ -532,6 +568,41 @@ describe('dsh-workflow-workerthread', () => {
       await second.dispose()
     })
 
+    it('removes the exact external abort callback on first settlement or teardown', async () => {
+      const { ctx, parent } = await setup()
+      const settledController = new AbortController()
+      const settledAdd = vi.spyOn(settledController.signal, 'addEventListener')
+      const settledRemove = vi.spyOn(settledController.signal, 'removeEventListener')
+      const completed = ctx.workflows.start({ ...scripted('return 123'), parent, signal: settledController.signal })
+      const settledAbort = settledAdd.mock.calls.find(([type]) => type === 'abort')?.[1]
+      expect(typeof settledAbort).toBe('function')
+
+      await expect(completed.result).resolves.toMatchObject({ value: 123, stopReason: 'completed' })
+      expect(settledRemove).toHaveBeenCalledWith('abort', settledAbort)
+      const cancelAfterSettle = vi.spyOn(completed, 'cancel')
+      settledController.abort()
+      expect(cancelAfterSettle).not.toHaveBeenCalled()
+      cancelAfterSettle.mockRestore()
+      await completed.dispose()
+
+      const manual = await setup({ manual: true })
+      const teardownController = new AbortController()
+      const teardownAdd = vi.spyOn(teardownController.signal, 'addEventListener')
+      const teardownRemove = vi.spyOn(teardownController.signal, 'removeEventListener')
+      const tornDown = manual.ctx.workflows.start({
+        ...scripted("return await agent('job')"),
+        parent: manual.parent,
+        signal: teardownController.signal,
+      })
+      await waitFor(() => { expect(manual.provider.runs).toHaveLength(1) })
+      const teardownAbort = teardownAdd.mock.calls.find(([type]) => type === 'abort')?.[1]
+      expect(typeof teardownAbort).toBe('function')
+
+      const disposing = tornDown.dispose()
+      expect(teardownRemove).toHaveBeenCalledWith('abort', teardownAbort)
+      await disposing
+    })
+
     it('a child-start racing the host cancel is refused: no child starts after cancellation', async () => {
       const { ctx, parent, provider } = await setup({ manual: true })
       // Cancel from INSIDE the log listener: the worker has already posted
@@ -656,6 +727,34 @@ describe('dsh-workflow-workerthread', () => {
       expect(provider.runs[0]!.disposed).toBe(true)
     })
 
+    it('result settlement reaps a registered stray even when the worker cannot relay disposal', async () => {
+      const { ctx, parent, provider } = await setup({
+        manual: true,
+        config: { provider: 'stub', disposeGraceMs: 30_000 },
+      })
+      const handle = ctx.workflows.start({
+        ...scripted("agent('stray')\nawait new Promise(() => {})"),
+        parent,
+      })
+      await waitFor(() => { expect(provider.runs).toHaveLength(1) })
+
+      // Claim the host result while the real worker remains wedged, so it can
+      // send neither ChildDispose nor an exit. This leaves the accepted child
+      // in the host registry when public disposal begins.
+      const worker = (handle as unknown as { worker: Worker }).worker
+      worker.emit('message', {
+        type: WorkerToHostType.Result,
+        result: { value: 'synthetic completion', stopReason: 'completed', agentsStarted: 1 },
+      })
+      await expect(handle.result).resolves.toMatchObject({ stopReason: 'completed' })
+      await waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }, 1000)
+
+      const disposal = handle.dispose()
+      await disposal
+      expect(provider.runs[0]!.disposeCalls).toBe(1)
+      await ctx.fiber.dispose()
+    })
+
     it('the settle-reap fires the request signal too: a provider honoring ONLY the signal winds its stray down promptly', async () => {
       const ctx = new Context()
       await ctx.plugin(SubagentService)
@@ -664,21 +763,16 @@ describe('dsh-workflow-workerthread', () => {
         name: 'signal-only',
         capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false },
         inheritsParentContext: false,
-        start: (request) => {
+        start: async (request) => {
           let settle!: (result: SubagentResult) => void
           const result = new Promise<SubagentResult>((resolve) => { settle = resolve })
-          request.signal?.addEventListener('abort', () => {
-            aborted.push(String(request.signal?.reason))
+          request.signal.addEventListener('abort', () => {
+            aborted.push(String(request.signal.reason))
             settle({ output: [], stopReason: 'aborted' })
           }, { once: true })
           return {
             id: AgentId('signal-only-child'),
-            started: Promise.resolve(),
             result,
-            // The seam leaves a provider free to honor EITHER cancel channel;
-            // this one deliberately ignores run.cancel() — only the request
-            // signal can wind it down.
-            cancel: () => { /* signal-only by design */ },
             dispose: () => Promise.resolve(),
           }
         },
@@ -703,56 +797,95 @@ describe('dsh-workflow-workerthread', () => {
       await handle.dispose()
     })
 
-    it("cancel() drives each child's explicit cancel() host-side: a wedged worker cannot delay it", async () => {
-      const ctx = new Context()
-      await ctx.plugin(SubagentService)
-      let starts = 0
-      const cancelled: string[] = []
-      const provider: SubagentProvider = {
-        name: 'cancel-only',
-        capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false },
-        inheritsParentContext: false,
-        start: () => {
-          starts += 1
-          return {
-            id: AgentId('cancel-only-child'),
-            started: Promise.resolve(),
-            result: new Promise(() => { /* only cancel() ends this child */ }),
-            // Deliberately ignores the request signal — the seam leaves a
-            // provider free to honor ONLY the explicit cancel() channel.
-            cancel: (reason?: string) => { cancelled.push(reason ?? 'cancelled') },
-            dispose: () => Promise.resolve(),
-          }
-        },
-      }
-      ctx.subagents.registerProvider(provider)
-      // A deliberately huge grace: if only the grace/terminate reap could
-      // reach this child, the assertion below would time out first.
-      await ctx.plugin(WorkerWorkflowEngine, { provider: 'cancel-only', maxConcurrentAgents: 2, disposeGraceMs: 30_000 })
+    it('the settle-reap aborts a pending provider start before workflow/end', async () => {
+      const { ctx, parent, provider } = await setup({ manual: true, deferStart: true })
+      const childLifecycle: string[] = []
+      let cancellationAtWorkflowEnd: string | undefined
+      ctx.on('workflow/agent-start', () => { childLifecycle.push('start') })
+      ctx.on('workflow/agent-end', () => { childLifecycle.push('end') })
+      ctx.on('workflow/end', () => {
+        cancellationAtWorkflowEnd = provider.runs[0]?.cancelled
+      })
       const handle = ctx.workflows.start({
-        // The stray child's start RPC reaches the host, then the script wedges
-        // its own worker in a synchronous spin: the worker cannot process the
-        // Cancel message, so it can relay NO ChildCancel RPC — only the host's
-        // own children loop can deliver the explicit cancel in time. The
-        // microtask yields let the agent() continuation POST its child-start
-        // before the spin seizes the worker's loop (the posted message needs
-        // no further worker-loop turns to reach the host).
         ...scripted(`
-          agent('wedged child')
+          agent('start-pending stray')
+          return 'done'
+        `),
+        parent,
+      })
+
+      const result = await handle.result
+
+      expect(result.stopReason).toBe('completed')
+      expect(provider.runs).toHaveLength(1)
+      expect(provider.runs[0]!.request.signal?.aborted).toBe(true)
+      expect(provider.runs[0]!.request.signal?.reason).toBe('workflow settled')
+      expect(provider.runs[0]!.cancelled).toBe('workflow settled')
+      expect(cancellationAtWorkflowEnd).toBe('workflow settled')
+      expect(childLifecycle).toEqual([])
+      await handle.dispose()
+      expect(provider.runs[0]!.disposeCalls).toBe(1)
+    })
+
+    it('a duplicate Result after the terminal claim cannot repeat cleanup or rewrite the outcome', async () => {
+      let signalAborts = 0
+      const { ctx, parent, provider } = await setup({
+        manual: true,
+        onChildAbortString: (_reason, index) => { if (index === 0) signalAborts += 1 },
+      })
+      const handle = ctx.workflows.start({
+        ...scripted("agent('stray')\nawait new Promise(() => {})"),
+        parent,
+      })
+      await waitFor(() => { expect(provider.runs).toHaveLength(1) })
+      const worker = (handle as unknown as { worker: Worker }).worker
+
+      worker.emit('message', {
+        type: WorkerToHostType.Result,
+        result: { value: 'first', stopReason: 'completed', agentsStarted: 1 },
+      })
+      worker.emit('message', {
+        type: WorkerToHostType.Result,
+        result: { value: 'late', stopReason: 'completed', agentsStarted: 1 },
+      })
+
+      await expect(handle.result).resolves.toMatchObject({ value: 'first', stopReason: 'completed' })
+      expect(signalAborts).toBe(1)
+      await handle.dispose()
+      expect(signalAborts).toBe(1)
+      await ctx.fiber.dispose()
+    })
+
+    it('a grace-terminated worker reaps its child on exit without waiting for consumer dispose()', async () => {
+      const { ctx, parent, provider } = await setup({
+        manual: true,
+        config: { provider: 'stub', maxConcurrentAgents: 2, disposeGraceMs: 100 },
+      })
+      const handle = ctx.workflows.start({
+        // Let child-start cross, then make the worker unable to process its
+        // Cancel message. Grace settles the result and terminates the thread;
+        // that exit must independently own the host registry's disposal pass.
+        ...scripted(`
+          agent('survives until exit reap')
           for (let i = 0; i < 20; i++) await null
           const end = Date.now() + 1500
           while (Date.now() < end) {}
-          return 'raced'
+          return 'unreachable'
         `),
-        parent: fakeParent(),
+        parent,
       })
-      await waitFor(() => { expect(starts).toBe(1) })
-      handle.cancel('stop now')
-      await waitFor(() => { expect(cancelled).toEqual(['stop now']) }, 800)
-      // The wedged worker's own completion loses to the in-flight cancel.
+      await waitFor(() => { expect(provider.runs).toHaveLength(1) })
+
+      handle.cancel('force termination')
       const result = await handle.result
+
       expect(result.stopReason).toBe('cancelled')
+      // Deliberately assert before handle.dispose(): host-owned worker exit,
+      // not consumer courtesy, is responsible for this resource guarantee.
+      await waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }, 1000)
+      expect(provider.runs[0]!.disposeCalls).toBe(1)
       await handle.dispose()
+      await ctx.fiber.dispose()
     }, 15_000)
 
     it('dispose() on a wedged worker host-drives child disposal inside the grace: it returns with the children DISPOSED, not with their teardown still in flight', async () => {
@@ -882,23 +1015,124 @@ describe('dsh-workflow-workerthread', () => {
   })
 
   describe('worker death', () => {
+    it('the first death signal closes admission to messages Node delivers before exit', async () => {
+      const { ctx, parent, provider } = await setup({ manual: true })
+      const phases: string[] = []
+      ctx.on('workflow/phase', (_info, title) => { phases.push(title) })
+      const handle = ctx.workflows.start({
+        ...scripted('await new Promise(() => {})'),
+        parent,
+      })
+      const worker = (handle as unknown as { worker: Worker }).worker
+
+      // Node may physically emit error -> queued message -> exit. Reproduce
+      // that ordering deterministically at the Worker event boundary: the
+      // late protocol data must not create work, narrate, or rewrite error.
+      worker.emit('error', new Error('synthetic error-before-message'))
+      worker.emit('message', { type: WorkerToHostType.Phase, title: 'late phase' })
+      worker.emit('message', {
+        type: WorkerToHostType.ChildStart,
+        callId: 999,
+        request: { prompt: 'late child' },
+      })
+      worker.emit('message', {
+        type: WorkerToHostType.Result,
+        result: { value: 'late', stopReason: 'completed', agentsStarted: 1 },
+      })
+
+      const result = await handle.result
+      expect(result.stopReason).toBe('error')
+      expect(result.error).toContain('synthetic error-before-message')
+      expect(provider.runs).toHaveLength(0)
+      expect(phases).toEqual([])
+      await handle.dispose()
+      await ctx.fiber.dispose()
+    })
+
+    it('refuses and disposes a provider run that becomes ready after its real worker dies', async () => {
+      const ctx = new Context()
+      await ctx.plugin(SubagentService)
+      const requested = Promise.withResolvers<SubagentStartRequest>()
+      const ready = Promise.withResolvers<SubagentRun>()
+      let disposeCalls = 0
+      const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => ctx.logger)
+      const provider: SubagentProvider = {
+        name: 'late-ready',
+        capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false },
+        inheritsParentContext: false,
+        start: (request) => {
+          requested.resolve(request)
+          // Model a backend whose independent startup boundary cannot be
+          // interrupted promptly. The host must still reject ownership if the
+          // worker dies before this promise transfers the ready run.
+          return ready.promise
+        },
+      }
+      ctx.subagents.registerProvider(provider)
+      await ctx.plugin(WorkerWorkflowEngine, { provider: 'late-ready', maxConcurrentAgents: 1 })
+      const lifecycle: string[] = []
+      ctx.on('workflow/agent-start', () => { lifecycle.push('start') })
+      ctx.on('workflow/agent-end', () => { lifecycle.push('end') })
+
+      const handle = ctx.workflows.start({
+        ...scripted("return await agent('pending startup')"),
+        parent: fakeParent(),
+      })
+      const request = await requested.promise
+      const worker = (handle as unknown as { worker: Worker }).worker
+
+      // Kill the actual Worker while provider startup is independently
+      // pending. Death closes admission and aborts the shared signal, but this
+      // deliberately uncooperative provider still fulfills afterward.
+      await worker.terminate()
+      const result = await handle.result
+      expect(result.stopReason).toBe('error')
+      expect(result.error).toContain('exit code')
+      expect(request.signal.aborted).toBe(true)
+      expect(request.signal.reason).toBe('workflow worker gone')
+
+      ready.resolve({
+        id: AgentId('late-ready-child'),
+        result: Promise.resolve({ output: [], stopReason: 'aborted' }),
+        dispose: () => {
+          disposeCalls += 1
+          return Promise.reject(new Error('late ready dispose failed'))
+        },
+      })
+      await waitFor(() => {
+        expect(disposeCalls).toBe(1)
+        expect(warn).toHaveBeenCalledWith(expect.stringContaining('refused child dispose failed: Error: late ready dispose failed'))
+      }, 1000)
+      expect(lifecycle).toEqual([])
+
+      await handle.dispose()
+      expect(disposeCalls).toBe(1)
+      await ctx.fiber.dispose()
+    })
+
     it('a worker that exits before settling reports an error result and reaps its children', async () => {
       const ctx = new Context()
       await ctx.plugin(SubagentService)
       // The child's dispose() REJECTS on top of the worker death: the reap
       // must contain it (warn, not crash) while still emptying the registry.
-      const cancelled: string[] = []
+      const signalAborts: unknown[] = []
       const provider: SubagentProvider = {
         name: 'doomed',
         capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false },
         inheritsParentContext: false,
-        start: () => ({
-          id: AgentId('doomed-child'),
-          started: Promise.resolve(),
-          result: new Promise(() => { /* never settles; the reap is the teardown */ }),
-          cancel: (reason?: string) => { cancelled.push(reason ?? 'cancelled') },
-          dispose: () => Promise.reject(new Error('dispose exploded during reap')),
-        }),
+        start: async (request) => {
+          request.signal.addEventListener('abort', () => {
+            signalAborts.push(request.signal.reason)
+            // The death claim precedes the shared-signal fanout. This
+            // synchronous callback cannot turn death into cancellation.
+            handle.cancel('reentered from worker-death signal cleanup')
+          }, { once: true })
+          return {
+            id: AgentId('doomed-child'),
+            result: new Promise(() => { /* never settles; the reap is the teardown */ }),
+            dispose: () => Promise.reject(new Error('dispose exploded during reap')),
+          }
+        },
       }
       ctx.subagents.registerProvider(provider)
       await ctx.plugin(WorkerWorkflowEngine, { provider: 'doomed', maxConcurrentAgents: 2 })
@@ -926,7 +1160,11 @@ describe('dsh-workflow-workerthread', () => {
       expect(runEnds).toEqual([{ stopReason: 'error', error: result.error, agentsStarted: 1 }])
       // Result already settled — this is the reap's promptness, not a
       // cold-start race; tight explicit bound (see the helper's doc comment).
-      await waitFor(() => { expect(cancelled.length).toBe(1) }, 1000)
+      await waitFor(() => {
+        expect(signalAborts).toEqual(['workflow worker gone'])
+      }, 1000)
+      await Promise.resolve()
+      expect(result.stopReason).toBe('error')
       await handle.dispose()
     }, 15_000)
 
@@ -1049,33 +1287,57 @@ describe('dsh-workflow-workerthread', () => {
   })
 
   describe('service surface', () => {
-    it('run ids are unique per start; the run handle and event payloads hold SEPARATE meta clones', async () => {
+    it('run ids are unique and lifecycle meta is the run\'s borrowed immutable value', async () => {
       const { ctx, parent } = await setup()
       let eventMeta: WorkflowRunInfo | undefined
       ctx.on('workflow/start', (info) => { eventMeta = info })
       const first = ctx.workflows.start({ ...scripted('return 1'), parent })
       const second = ctx.workflows.start({ ...scripted('return 2'), parent })
       expect(first.id).not.toBe(second.id)
-      eventMeta!.meta.name = 'corrupted'
+      expect(eventMeta!.meta).toBe(second.meta)
       expect(second.meta.name).toBe('test-flow')
       await Promise.all([first.result, second.result])
       await first.dispose()
       await second.dispose()
     })
 
-    it('unregisters ctx.workflows when the engine fiber is disposed (HMR safety), and default config runs (auto concurrency)', async () => {
+    it('unregisters ctx.workflows when the engine fiber is disposed (HMR safety)', async () => {
       const ctx = new Context()
       await ctx.plugin(SubagentService)
       const fiber = await ctx.plugin(WorkerWorkflowEngine, {})
       expect(ctx.get('workflows')).toBeDefined()
-      // A zero-agent run through the DEFAULT config exercises the auto
-      // concurrency resolution (cores - 2, capped) in start().
-      const result = await run(ctx, fakeParent(), scripted('return 6 * 7'))
-      expect(result.value).toBe(42)
       await fiber.dispose()
       expect(ctx.get('workflows')).toBeUndefined()
     })
 
+    it('keeps a holder-owned run usable when the engine unloads before its child starts', async () => {
+      const { ctx, parent, provider, engineFiber } = await setup({ reply: () => text('survived reload') })
+      let handle!: ReturnType<typeof ctx.workflows.start>
+      const holder = await ctx.plugin(Object.assign((inner: Context) => {
+        handle = inner.workflows.start({ ...scripted("return await agent('after reload')"), parent })
+      }, { inject: ['workflows'] }))
+
+      try {
+        // A real worker cannot deliver child-start in the synchronous start()
+        // slice. Unload the provider before that message arrives: the returned
+        // run belongs to `holder`, not to the engine fiber being reloaded.
+        expect(provider.runs).toHaveLength(0)
+        await engineFiber.dispose()
+        expect(ctx.get('workflows')).toBeUndefined()
+
+        await expect(handle.result).resolves.toEqual({
+          value: 'survived reload',
+          stopReason: 'completed',
+          agentsStarted: 1,
+        })
+        expect(provider.runs).toHaveLength(1)
+      } finally {
+        await handle.dispose()
+        await holder.dispose()
+        await ctx.fiber.dispose()
+      }
+    })
+
     it('has the class-plugin export shape (default = the engine service class)', () => {
       expect(workerEngineModule.default).toBe(WorkerWorkflowEngine)
       const loader = Object.create(Loader.prototype) as Loader
diff --git a/packages/workflow/workflow-workerthread/tsconfig.json b/packages/workflow/workflow-workerthread/tsconfig.json
index 385651c192..730a3e61d9 100644
--- a/packages/workflow/workflow-workerthread/tsconfig.json
+++ b/packages/workflow/workflow-workerthread/tsconfig.json
@@ -26,6 +26,9 @@
     {
       "path": "../../llm/llm"
     },
+    {
+      "path": "../../core/session"
+    },
     {
       "path": "../../subagent/subagent"
     },
diff --git a/packages/workflow/workflow/README.md b/packages/workflow/workflow/README.md
index 4c90239792..943a4e3694 100644
--- a/packages/workflow/workflow/README.md
+++ b/packages/workflow/workflow/README.md
@@ -1,35 +1,49 @@
 # @deepseek-ai/dsh-workflow
 
-The **workflow seam** (`ctx.workflows`): an abstract service defining WHAT a workflow engine does — execute a model-written orchestration script that fans out subagents — without saying HOW. The bash-shaped third of the [workflow family](../README.md): implementations subclass `WorkflowService` and register as the `workflows` service (one per context); [`dsh-workflow-workerthread`](../workflow-workerthread/README.md) (one worker thread per run) is the implementation, and [`dsh-tool-workflow`](../tool-workflow/README.md) is the model-facing consumer.
+The workflow seam (`ctx.workflows`) executes a model-written orchestration script that can fan out subagents. The seam defines the script, run, result, error, and event contracts; an engine decides how to isolate and execute the script.
 
-## Service: `WorkflowService` (abstract)
+`@deepseek-ai/dsh-workflow-workerthread` is the current engine and `@deepseek-ai/dsh-tool-workflow` is the model-facing consumer. A future process or sandbox engine can replace the implementation without changing the tool.
 
-`start(request: WorkflowStartRequest): WorkflowRun` — parse and execute a script. Throws synchronously (`SCRIPT_PARSE`/`META_INVALID`) for a script that cannot begin; once a run is returned, its `result` NEVER rejects — every failure resolves with `stopReason: 'error'` (or `'cancelled'`) — and once the run is cancelled, `result` settles within the implementation's bounded grace even if the script itself never settles (a consumer awaiting `result` must never be wedged past a cancellation). `dispose()` must reach quiescence within a bounded grace (cancel → wait for the script to settle and its children to finish disposing → abandon), never hanging its caller. Runs are HOLDER-owned: the engine does not track its live runs, so disposing the engine's fiber mid-run leaves each run to its holder's teardown.
+## Service and run contract
 
-The protected `emitWorkflowEvent` helper dispatches the `workflow/*` events with PER-LISTENER containment and PER-LISTENER payload snapshots (a throwing subscriber is logged, never propagated, and cannot starve later listeners; each subscriber gets its own clone of the payload, so mutating it corrupts neither the engine nor other listeners) — the same containment guarantee as the subagent seam's lifecycle emits.
+`WorkflowService.start(request): WorkflowRun` validates enough synchronously to reject a malformed meta block or unparseable script before a run exists. Once returned, `WorkflowRun.result` never rejects: execution failures resolve with `stopReason: 'error'`, and cancellation resolves with `cancelled` within the engine's bounded grace.
 
-## Vocabulary
+A run is holder-owned. Engine-plugin unload prevents new starts but does not revoke accepted runs. The holder must call `dispose()` on every path; disposal cancels remaining work and reaches or abandons quiescence within the documented bound.
 
-- `WorkflowStartRequest` — `{ script, args?, parent: Agent, signal? }`. `parent` is REQUIRED: every child the script spawns is attributed to it. `args` must be plain host-realm JSON data.
-- `WorkflowMeta` / `WorkflowPhase` — the workflow's identity block, carried as plain JSON data on the start request (Claude Code meta vocabulary: required `name`/`description`, optional `whenToUse`/`phases`) and shape-validated by the engine.
-- `WorkflowRun` — `{ id, meta, result, cancel(reason?), dispose() }`; the consumer awaits `result` and MUST `dispose` on every path.
-- `WorkflowResult` — `{ value, stopReason: 'completed'|'cancelled'|'error', error?, agentsStarted }`; `value` is the script's materialized return (plain JSON data; `null` for no return).
-- `WorkflowError` — `HarnessError` with a `WorkflowErrorCode` and a `fatal` flag driving the combinator discipline: a fatal error (bad hook arguments, unsupported options/schemas, tripped caps, seam start failures, cancellation) always propagates through `parallel()`/`pipeline()` instead of dissolving into a per-item `null`. `isFatalWorkflowError(error)` is the catch-site predicate.
+`WorkflowStartRequest` contains `{ meta, script, args?, parent, signal? }`. `parent` attributes every child agent to the invoking agent. `meta` and `args` are plain data, not script fragments.
+
+`WorkflowRun` exposes `{ id, meta, result, cancel(reason?), dispose() }`. `WorkflowResult` contains `{ value, stopReason, error?, agentsStarted }`; `value` is plain JSON data or `null`.
 
 ## Events
 
-All observe-only emits carrying DATA SNAPSHOTS (`WorkflowRunInfo` = id + meta) — never the live `WorkflowRun`, so a listener cannot gain `cancel`/`dispose`; control stays with the `start()` caller:
+Workflow events are observe-only. They carry `WorkflowRunInfo` (`id` plus `meta`) rather than the live run, so listeners cannot acquire cancellation or disposal authority.
 
-- `workflow/start`(info) / `workflow/end`(info, resultInfo) — run lifecycle; `resultInfo` deliberately omits the value.
-- `workflow/phase`(info, title) / `workflow/log`(info, message) — script narration.
-- `workflow/agent-start`(info, agent) / `workflow/agent-end`(info, agent + outcome) — ready-child lifecycle correlated by `seq`; the [generated event contract](../../../docs/cordis-catalog/events.md#workflowagent-start--emit) defines publication and pairing.
+- `workflow/start` / `workflow/end` pair the run.
+- `workflow/phase` and `workflow/log` expose script narration.
+- `workflow/agent-start` / `workflow/agent-end` pair each child call by `seq`; a child whose async provider start rejects emits neither.
+
+Same-process event payloads are borrowed immutable values. Every listener is independently contained: a synchronous throw or rejected returned promise is logged without starving peers or changing execution.
+
+## Failure discipline
+
+`WorkflowError` carries a code and a `fatal` flag. Fatal errors always escape `parallel()` and `pipeline()` instead of becoming an ordinary per-item `null`:
+
+- `SCRIPT_PARSE` / `META_INVALID` — the workflow cannot start.
+- `INVALID_ARGUMENT` / `UNSUPPORTED_OPTION` / `UNSUPPORTED_SCHEMA` — a hook call violates the engine contract.
+- `AGENT_CAP` / `ITEM_CAP` — configured safety limits were exceeded.
+- `AGENT_START` — the provider's async start rejected.
+- `AGENT_RESULT` — a ready child's result rejected with an infrastructure fault.
+- `RESULT_UNSERIALIZABLE` — a script/worker value is not plain JSON data.
+- `CANCELLED` — cancellation owns the run and pending/future hooks reject.
+
+A child that resolves normally with a non-completed stop reason is not an infrastructure exception: `agent()` returns `null`, allowing the script to handle an ordinary child failure.
 
 ## Known Limitations and Deferred Work
 
 - **Foreground collection only** — the caller owns one live run and awaits it; background start/poll, spill handles, and detached collection are deferred.
 - **No journaling or resume** — scripts, child progress, and intermediate values are not checkpointed, so a process restart cannot continue a run.
 - **No saved or nested workflows** — the seam starts caller-supplied scripts only, and a workflow script receives no `workflow()` hook for recursive orchestration.
-- **No token-budget vocabulary** — engines cap concurrency/items/agents, but neither the request nor result accounts for model tokens across children.
+- **No token-budget vocabulary** — engines cap concurrency, items, and children, but neither the request nor result accounts for model tokens across children.
 - **Runs are holder-owned, not service-tracked** — unloading the engine does not discover independent live handles; every consumer must dispose the run it started.
 
 See the [dynamic-workflows RFC](../../../docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md) for the deferred workflow surface.
diff --git a/packages/workflow/workflow/src/index.ts b/packages/workflow/workflow/src/index.ts
index 19f52b5d88..0fa0289b41 100644
--- a/packages/workflow/workflow/src/index.ts
+++ b/packages/workflow/workflow/src/index.ts
@@ -9,14 +9,12 @@
  * separate-process sandbox) swap in without touching the model-facing tool
  * that consumes them (`@deepseek-ai/dsh-tool-workflow`).
  *
- * The `workflow/*` lifecycle events are OBSERVE-ONLY data snapshots: they
+ * The `workflow/*` lifecycle events are OBSERVE-ONLY data: they
  * carry {@link WorkflowRunInfo} (id + meta), never the live {@link WorkflowRun}
  * — a listener must not gain `cancel`/`dispose`; control stays with the
- * `start()` caller holding the run. Every emit is per-listener contained (a
- * throwing subscriber is logged, never propagated) and every listener gets its
- * own payload clone (mutating it corrupts nothing), so one bad observer can
- * neither strand a live run, starve later listeners, nor poison another
- * listener's view.
+ * `start()` caller holding the run. Same-process payloads are borrowed
+ * immutable values. Every listener is independently contained, so a throw or
+ * rejected promise can neither strand a run nor starve peers.
  *
  * @module @deepseek-ai/dsh-workflow
  */
@@ -78,7 +76,7 @@ declare module 'cordis' {
     /**
      * One `agent()` call established a ready child run. Paired with
      * {@link Events['workflow/agent-end']} by `agent.seq`. A call that never
-     * crosses the provider's publication/readiness boundary emits neither
+     * receives a ready run from the provider emits neither
      * event in this pair.
      * @param info - the run's identity snapshot.
      * @param agent - the call's sequence number, label, phase, and child id.
@@ -131,11 +129,10 @@ export type WorkflowEventName =
  * - `UNSUPPORTED_SCHEMA` — an `agent()` schema outside the structured-output
  *   subset (see dsh-tools).
  * - `AGENT_CAP` / `ITEM_CAP` — the run/agent caps tripped.
- * - `AGENT_START` — synchronous subagent start or the provider's asynchronous
- *   publication/readiness boundary failed before cancellation took precedence.
- * - `AGENT_RESULT` — a run whose readiness FULFILLED had its `result` REJECT: an
- *   infrastructure fault at the subagent seam, even if the rejection settled
- *   before readiness. This is distinct from a child that failed and resolved
+ * - `AGENT_START` — the provider's asynchronous start rejected before
+ *   cancellation took precedence.
+ * - `AGENT_RESULT` — a ready run had its `result` REJECT: an infrastructure
+ *   fault at the subagent seam. This is distinct from a child that failed and resolved
  *   (which is the per-item `null`, never an error).
  * - `RESULT_UNSERIALIZABLE` — a value crossing the script/host value boundary
  *   is not plain JSON data.
@@ -198,8 +195,8 @@ export function isFatalWorkflowError(error: unknown): boolean {
  *   `result` SETTLES within the implementation's bounded grace even if the
  *   script itself never settles (a consumer awaiting `result` must never be
  *   wedged past a cancellation).
- * - The `workflow/*` events fire through {@link emitWorkflowEvent} (data
- *   snapshots, per-listener containment); `workflow/end` fires exactly once
+ * - The `workflow/*` events fire through {@link emitWorkflowEvent} (borrowed
+ *   immutable data, per-listener containment); `workflow/end` fires exactly once
  *   per started run, after `result` is settled or as it settles.
  * - `dispose()` reaches quiescence within a bounded grace: it cancels, waits
  *   for the script to settle AND its started children to finish disposing,
@@ -225,12 +222,9 @@ export abstract class WorkflowService extends Service {
   abstract start(request: WorkflowStartRequest): WorkflowRun
 
   /**
-   * Emit one `workflow/*` lifecycle event with PER-LISTENER containment and
-   * PER-LISTENER payload snapshots: each subscriber is dispatched individually
-   * with its OWN structural clone of the payload (the payloads are plain JSON
-   * data by the seam contract), so a listener mutating what it received can
-   * corrupt neither the engine's live state nor any other listener's or later
-   * event's view; a thrown listener is logged (never propagated — the logging
+   * Emit one `workflow/*` lifecycle event with per-listener containment. Each
+   * subscriber receives the same borrowed immutable payload; a throw or
+   * asynchronously rejected listener is logged (never propagated — the logging
    * itself is total, even for a thrown value whose own string coercion
    * throws), so one bad subscriber can neither fail the engine mid-run,
    * surface as an unhandled rejection on a detached settle hook, nor starve
@@ -242,9 +236,10 @@ export abstract class WorkflowService extends Service {
   protected emitWorkflowEvent(name: WorkflowEventName, ...args: unknown[]): void {
     for (const callback of this.ctx.events.dispatch('emit', [name, ...args])) {
       try {
-        // The declared workflow/* signatures are all void-returning emits; the
-        // dispatch callback applies the payload tuple.
-        ;(callback as (...payload: unknown[]) => void)(...structuredClone(args))
+        const returned: unknown = (callback as (...payload: unknown[]) => unknown)(...args)
+        void Promise.resolve(returned).catch((error: unknown) => {
+          this.ctx.logger.warn(`workflow: ${name} listener rejected: ${renderListenerError(error)}`)
+        })
       } catch (error: unknown) {
         this.ctx.logger.warn(`workflow: ${name} listener threw: ${renderListenerError(error)}`)
       }
diff --git a/packages/workflow/workflow/src/types.ts b/packages/workflow/workflow/src/types.ts
index 66da4f1268..981a2da172 100644
--- a/packages/workflow/workflow/src/types.ts
+++ b/packages/workflow/workflow/src/types.ts
@@ -128,7 +128,7 @@ export interface WorkflowRun {
   dispose(): Promise<void>
 }
 
-/** Identifying detail for a run, carried by every `workflow/*` event (a data snapshot, never the live run). */
+/** Identifying detail for a run, carried by every `workflow/*` event as borrowed immutable data, never the live run. */
 export interface WorkflowRunInfo {
   /** The run's id. */
   id: WorkflowRunId
diff --git a/packages/workflow/workflow/tests/workflow.spec.ts b/packages/workflow/workflow/tests/workflow.spec.ts
index a983e5a2b3..0df3824071 100644
--- a/packages/workflow/workflow/tests/workflow.spec.ts
+++ b/packages/workflow/workflow/tests/workflow.spec.ts
@@ -66,26 +66,21 @@ describe('dsh-workflow (interface)', () => {
     ])
   })
 
-  it('gives each listener its OWN payload snapshot: mutation corrupts neither peers nor the caller', async () => {
+  it('contains an asynchronously rejected listener without starving peers', async () => {
     const ctx = new Context()
     await ctx.plugin(StubEngine)
+    const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => ctx.logger)
     const seen: string[] = []
-    ctx.on('workflow/agent-start', (info, agent) => {
-      agent.label = 'HACKED'
-      info.meta.name = 'HACKED'
-      seen.push('mutator')
-    })
-    ctx.on('workflow/agent-start', (info, agent) => {
-      seen.push(`${info.meta.name}/${agent.label}`)
-    })
+    // Runtime listeners may return thenables even though the declaration's observable result is void.
+    // eslint-disable-next-line @typescript-eslint/no-misused-promises -- exercises rejected-listener containment
+    ctx.on('workflow/agent-start', async () => { throw new Error('async observer failed') })
+    ctx.on('workflow/agent-start', (_info, agent) => { seen.push(agent.label) })
     const engine = ctx.workflows as StubEngine
-    const info: WorkflowRunInfo = { id: WorkflowRunId('run-2'), meta: { name: 'w', description: 'd' } }
     const payload = { seq: 1, label: 'original', childId: 'c' }
-    engine.emit('workflow/agent-start', info, payload)
-    expect(seen).toEqual(['mutator', 'w/original'])
-    // The caller's own objects are pristine too — no listener ever saw them.
-    expect(info.meta.name).toBe('w')
-    expect(payload.label).toBe('original')
+    engine.emit('workflow/agent-start', INFO, payload)
+    await Promise.resolve()
+    expect(seen).toEqual(['original'])
+    expect(String(warn.mock.calls[0]![0])).toContain('listener rejected')
   })
 
   it('contains a throwing listener PER LISTENER: later listeners still run, nothing propagates', async () => {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 68ec4e3183..649a986385 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -75,34 +75,6 @@ importers:
         specifier: ^4.1.8
         version: 4.1.8(@types/node@22.20.0)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@22.20.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0))
 
-  packages/ui/user-approval:
-    dependencies:
-      schemastery:
-        specifier: ^3.18.0
-        version: 3.18.0
-    devDependencies:
-      '@deepseek-ai/dsh-agent':
-        specifier: workspace:^
-        version: link:../../core/agent
-      '@deepseek-ai/dsh-brand':
-        specifier: workspace:^
-        version: link:../../util/brand
-      '@deepseek-ai/dsh-llm':
-        specifier: workspace:^
-        version: link:../../llm/llm
-      '@deepseek-ai/dsh-scope':
-        specifier: workspace:^
-        version: link:../../core/scope
-      '@deepseek-ai/dsh-session':
-        specifier: workspace:^
-        version: link:../../core/session
-      '@deepseek-ai/dsh-system-prompt':
-        specifier: workspace:^
-        version: link:../../core/system-prompt
-      cordis:
-        specifier: ^4.0.0-rc.6
-        version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
-
   packages/bash/bash:
     devDependencies:
       '@deepseek-ai/dsh-brand':
@@ -167,9 +139,6 @@ importers:
       '@deepseek-ai/dsh-agent-loop':
         specifier: workspace:^
         version: link:../../core/agent-loop
-      '@deepseek-ai/dsh-user-approval':
-        specifier: workspace:^
-        version: link:../../ui/user-approval
       '@deepseek-ai/dsh-bash':
         specifier: workspace:^
         version: link:../bash
@@ -197,6 +166,9 @@ importers:
       '@deepseek-ai/dsh-tools':
         specifier: workspace:^
         version: link:../../core/tools
+      '@deepseek-ai/dsh-user-approval':
+        specifier: workspace:^
+        version: link:../../ui/user-approval
       cordis:
         specifier: ^4.0.0-rc.6
         version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
@@ -449,9 +421,6 @@ importers:
       '@deepseek-ai/dsh-agent':
         specifier: workspace:^
         version: link:../agent
-      '@deepseek-ai/dsh-user-approval':
-        specifier: workspace:^
-        version: link:../../ui/user-approval
       '@deepseek-ai/dsh-code-runtime':
         specifier: workspace:^
         version: link:../../code-runtime/code-runtime
@@ -467,6 +436,9 @@ importers:
       '@deepseek-ai/dsh-system-prompt':
         specifier: workspace:^
         version: link:../system-prompt
+      '@deepseek-ai/dsh-user-approval':
+        specifier: workspace:^
+        version: link:../../ui/user-approval
       cordis:
         specifier: ^4.0.0-rc.6
         version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
@@ -1076,12 +1048,6 @@ importers:
       '@deepseek-ai/dsh-session':
         specifier: workspace:^
         version: link:../../core/session
-      '@deepseek-ai/dsh-system-prompt':
-        specifier: workspace:^
-        version: link:../../core/system-prompt
-      '@deepseek-ai/dsh-tools':
-        specifier: workspace:^
-        version: link:../../core/tools
       cordis:
         specifier: ^4.0.0-rc.6
         version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
@@ -1177,9 +1143,6 @@ importers:
       '@deepseek-ai/dsh-agent-loop':
         specifier: workspace:^
         version: link:../../core/agent-loop
-      '@deepseek-ai/dsh-user-approval':
-        specifier: workspace:^
-        version: link:../user-approval
       '@deepseek-ai/dsh-bash':
         specifier: workspace:^
         version: link:../../bash/bash
@@ -1228,6 +1191,9 @@ importers:
       '@deepseek-ai/dsh-tools':
         specifier: workspace:^
         version: link:../../core/tools
+      '@deepseek-ai/dsh-user-approval':
+        specifier: workspace:^
+        version: link:../user-approval
       '@deepseek-ai/dsh-user-interaction':
         specifier: workspace:^
         version: link:../user-interaction
@@ -1355,6 +1321,34 @@ importers:
         specifier: ^4.0.0-rc.6
         version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
 
+  packages/ui/user-approval:
+    dependencies:
+      schemastery:
+        specifier: ^3.18.0
+        version: 3.18.0
+    devDependencies:
+      '@deepseek-ai/dsh-agent':
+        specifier: workspace:^
+        version: link:../../core/agent
+      '@deepseek-ai/dsh-brand':
+        specifier: workspace:^
+        version: link:../../util/brand
+      '@deepseek-ai/dsh-llm':
+        specifier: workspace:^
+        version: link:../../llm/llm
+      '@deepseek-ai/dsh-scope':
+        specifier: workspace:^
+        version: link:../../core/scope
+      '@deepseek-ai/dsh-session':
+        specifier: workspace:^
+        version: link:../../core/session
+      '@deepseek-ai/dsh-system-prompt':
+        specifier: workspace:^
+        version: link:../../core/system-prompt
+      cordis:
+        specifier: ^4.0.0-rc.6
+        version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4)
+
   packages/ui/user-interaction:
     devDependencies:
       '@deepseek-ai/dsh-agent':
diff --git a/scripts/gen-cordis-catalog.ts b/scripts/gen-cordis-catalog.ts
index 32ea8539c6..68139e9ff8 100644
--- a/scripts/gen-cordis-catalog.ts
+++ b/scripts/gen-cordis-catalog.ts
@@ -87,6 +87,7 @@ export const LINK_MAP: Record<string, string> = {
   GenerateOptions: 'core.md',
   LlmCallConfig: 'core.md',
   SessionEvent: 'core.md',
+  SessionStartSource: 'core.md',
   StreamChunk: 'llm-streaming.md',
   TurnEndReason: 'session.md',
   ToolDefinition: 'tools.md',
diff --git a/scripts/gen-doc-graphs.ts b/scripts/gen-doc-graphs.ts
index 074cfd83d2..c4c8186f38 100644
--- a/scripts/gen-doc-graphs.ts
+++ b/scripts/gen-doc-graphs.ts
@@ -246,6 +246,22 @@ const SERVICE_ROLES: ServiceRole[] = [
 ]
 
 const DYNAMIC_EVENT_DISPATCHERS: Array<{ event: string; pkg: string; method: string }> = [
+  // Creation notifications preserve synchronous veto/rollback but observe
+  // returned promises explicitly so async listener rejection is not unhandled.
+  { event: 'agent/created', pkg: 'agent', method: 'events.dispatch' },
+  // Registry disposal reuses the stable carrier captured before entry commit
+  // and contains each listener directly rather than rebuilding via agentEvents.
+  { event: 'agent/disposed', pkg: 'agent', method: 'events.dispatch' },
+  { event: 'session/created', pkg: 'session', method: 'events.dispatch' },
+  // Session event callbacks are likewise resolved before the log push, then
+  // invoked individually after commit so observer failures are contained.
+  { event: 'session/event', pkg: 'session', method: 'events.dispatch' },
+  // Flush resolves the scoped callback set directly so internal instrumentation
+  // cannot substitute the accepted session before parallel invocation.
+  { event: 'session/flush', pkg: 'session', method: 'events.dispatch' },
+  // Session disposal uses direct callback resolution so teardown contains each
+  // synchronous throw and returned-promise rejection independently.
+  { event: 'session/disposed', pkg: 'session', method: 'events.dispatch' },
   // tools/result uses ctx.events.dispatch directly so the registry can await
   // every observer while containing each callback independently.
   { event: 'tools/result', pkg: 'tools', method: 'events.dispatch' },
@@ -268,6 +284,12 @@ const DYNAMIC_EVENT_DISPATCHERS: Array<{ event: string; pkg: string; method: str
   { event: 'workflow/end', pkg: 'workflow', method: 'events.dispatch' },
 ]
 
+const DYNAMIC_EVENT_LISTENERS: Array<{ event: string; pkg: string }> = [
+  // The invariants oracle marks the session started from its global
+  // internal/dispatch listener before product session-start callbacks run.
+  { event: 'agent/session-start', pkg: 'invariants' },
+]
+
 function generatedHeader(title: string): string[] {
   return [
     '<!-- Generated by scripts/gen-doc-graphs.ts - do not edit by hand.',
@@ -566,12 +588,12 @@ function collectEventRelations(): Map<string, EventRelation> {
         if (method === 'on') {
           const event = eventArg(node.arguments, method)
           if (event) ensure(event).listeners.add(leaf)
-        } else if (method === 'emit' || method === 'parallel' || method === 'serial' || method === 'strictSerial' || method === 'waterfall') {
+        } else if (method === 'emit' || method === 'parallel' || method === 'serial' || method === 'waterfall') {
           const event = eventArg(node.arguments, method)
           if (event) {
             const relation = ensure(event)
             const methods = relation.dispatchers.get(leaf) ?? new Set<string>()
-            methods.add(method === 'strictSerial' ? 'strictSerial (serial)' : method)
+            methods.add(method)
             relation.dispatchers.set(leaf, methods)
           }
         }
@@ -586,6 +608,9 @@ function collectEventRelations(): Map<string, EventRelation> {
     methods.add(entry.method)
     relation.dispatchers.set(entry.pkg, methods)
   }
+  for (const entry of DYNAMIC_EVENT_LISTENERS) {
+    ensure(entry.event).listeners.add(entry.pkg)
+  }
   return out
 }
 
diff --git a/scripts/run-gates.ts b/scripts/run-gates.ts
index da238cf7b1..cefd7c45e9 100644
--- a/scripts/run-gates.ts
+++ b/scripts/run-gates.ts
@@ -143,6 +143,11 @@ function gatesForMode(selected: Mode): Gate[] {
     case 'node-compat':
       return [
         pnpmScript('typecheck', 'typecheck'),
+        pnpmExec('source-worker-smoke', [
+          'vitest',
+          'run',
+          'packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts',
+        ], { label: 'source worker smoke' }),
       ]
     case 'pre-push':
       return [
diff --git a/scripts/type-equiv.manifest.json b/scripts/type-equiv.manifest.json
index 4be54d89f4..a219ea1b1d 100644
--- a/scripts/type-equiv.manifest.json
+++ b/scripts/type-equiv.manifest.json
@@ -17,6 +17,14 @@
     { "doc": "docs/core-data-structures/core.md", "symbol": "ContinuationStop", "source": "packages/core/agent/src/types.ts" },
     { "doc": "docs/core-data-structures/core.md", "symbol": "SessionStartSource", "source": "packages/core/agent/src/types.ts" },
 
+    { "doc": "docs/core-data-structures/scope.md", "symbol": "ScopeKey", "source": "packages/core/scope/src/index.ts" },
+    { "doc": "docs/core-data-structures/scope.md", "symbol": "Scoped", "source": "packages/core/scope/src/index.ts" },
+    { "doc": "docs/core-data-structures/scope.md", "symbol": "Scope", "source": "packages/core/scope/src/index.ts" },
+
+    { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "AssembleContext", "source": "packages/core/system-prompt/src/index.ts" },
+    { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "PromptSection", "source": "packages/core/system-prompt/src/index.ts" },
+    { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "ToolProviderResult", "source": "packages/core/system-prompt/src/index.ts" },
+
     { "doc": "docs/core-data-structures/llm-streaming.md", "symbol": "StreamChunk", "source": "packages/llm/llm/src/types.ts" },
     { "doc": "docs/core-data-structures/llm-streaming.md", "symbol": "TokenUsage", "source": "packages/llm/llm/src/types.ts" },
     { "doc": "docs/core-data-structures/llm-streaming.md", "symbol": "ContentBlockMap", "source": "packages/llm/llm/src/types.ts" },
@@ -44,6 +52,7 @@
     { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolExecutionInput", "source": "packages/core/tools/src/index.ts" },
     { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolExecution", "source": "packages/core/tools/src/index.ts" },
     { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolGuard", "source": "packages/core/tools/src/index.ts" },
+    { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolRestriction", "source": "packages/core/tools/src/index.ts" },
     { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolExecutionResult", "source": "packages/core/tools/src/index.ts" },
     { "doc": "docs/core-data-structures/tools.md", "symbol": "PreToolDecision", "source": "packages/core/tools/src/index.ts" },
     { "doc": "docs/core-data-structures/tools.md", "symbol": "PostToolDecision", "source": "packages/core/tools/src/index.ts" },
diff --git a/vendor/README.md b/vendor/README.md
index bf0f0b5a8c..0a709495db 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -35,6 +35,7 @@ Keep this log exhaustive — every divergence from upstream must be listed.
 3. **All `tsconfig.json` files**: regenerated to extend the repo-root `tsconfig.base.json`, emit TypeScript intermediates to `lib/types`, and declare project references.
 4. **Vendored TypeScript source internal specifiers**: changed local relative imports/exports from upstream's specifier shape to explicit `.ts` specifiers so TypeScript rewrites emitted JS to `.js` while declarations keep explicit, NodeNext-safe `.ts` specifiers. This includes `loader/src/config/isolate.ts` using `declare module './entry.ts'`.
 5. **`schemastery/tsdown.config.ts` and `logger-console/tsdown.config.ts`**: ours, not upstream files — per-package build-shape overrides (dual ESM+CJS output; separate node/browser entries) for the repo-root tsdown build. They read the JS emitted under `lib/types` and then write the publish runtime entries under `lib/`. Like the regenerated tsconfigs, they are not part of the upstream sync surface.
+6. **`cordis/src/fiber.ts` lifecycle hardening**: locally closes three reentrant disposal gaps. An effect's owner-list wrapper is registered before its setup body runs, so an unload begun from inside setup awaits setup and every collected cleanup; synchronous setup failure removes the wrapper and rolls back collected cleanup. Async cleanup stays owner-visible until quiescence, and Cordis's internal effect composition joins an already-running cleanup while repeated public disposer calls retain their upstream single-shot result. Effect creation is rejected while the owner is `UNLOADING` (while `PENDING` and `LOADING` remain legal), preventing cleanup-time registrations from escaping the unload snapshot. Child fibers register and receive their parent-owned disposer before `internal/plugin` publication, resolve dependency declarations added by that notification before activation, drain effects attached while pending, skip plugin execution when reentrant disposal invalidates the load epoch before its first checkpoint, and contain teardown-notification failures per observer so one callback cannot starve peers or interrupt ownership cleanup.
 
 ## Sync procedure
 
diff --git a/vendor/cordis/src/fiber.ts b/vendor/cordis/src/fiber.ts
index fd472e7733..7e7766b48d 100644
--- a/vendor/cordis/src/fiber.ts
+++ b/vendor/cordis/src/fiber.ts
@@ -80,6 +80,35 @@ interface EffectRunner<T> {
   getOuterStack: () => string[]
 }
 
+// Public effect disposers remain single-shot, but structural owners and outer
+// effects must still be able to join a cleanup that another caller started.
+const effectInertia = new WeakMap<Disposable, () => void | Promise<void>>()
+
+function runDisposable(dispose: Disposable) {
+  const result = dispose()
+  return effectInertia.get(dispose)?.() ?? result
+}
+
+/** Notify plugin teardown without allowing one observer to break ownership cleanup. */
+function emitPluginDisposed(context: Context, fiber: Fiber) {
+  const args: any[] = ['internal/plugin', fiber]
+  let callbacks: Function[]
+  try {
+    callbacks = context.events.dispatch('emit', args)
+  } catch (error) {
+    context.logger.error(error)
+    return
+  }
+  for (const callback of callbacks) {
+    try {
+      const returned = callback(...args)
+      void Promise.resolve(returned).catch(error => context.logger.error(error))
+    } catch (error) {
+      context.logger.error(error)
+    }
+  }
+}
+
 /** Lifecycle state for one plugin fiber. */
 export const enum FiberState {
   PENDING,
@@ -175,24 +204,19 @@ export class Fiber {
         collect,
       }
 
-      this.context.emit('internal/plugin', this)
-
-      for (const name of Object.keys(this.inject)) {
-        this._checkImpl(name)
-      }
-
+      let shouldRefresh = false
       this.dispose = parent.fiber.effect(() => {
         const remove = runtime.fibers.push(this)
         try {
           this.config = resolveConfig(runtime, config)
-          this._refresh()
+          shouldRefresh = true
         } catch (error) {
           this.ctx.logger.error(error)
           this._error = error
         }
         return async () => {
           this.uid = null
-          this.context.emit('internal/plugin', this)
+          emitPluginDisposed(this.context, this)
           if (this.ctx.registry.has(runtime.callback)) {
             remove()
             if (!runtime.fibers.length) {
@@ -200,6 +224,16 @@ export class Fiber {
             }
           }
           this._setEpoch(INACTIVE)
+          // A PENDING fiber can already own effects registered by an
+          // internal/plugin observer. Its epoch is still INACTIVE, so
+          // _setEpoch() has no transition to drive; explicitly unload that
+          // pre-activation work before reporting disposal complete.
+          if (!this.inertia) {
+            this._updateState(() => {
+              this.inertia = this._unload()
+              return FiberState.UNLOADING
+            })
+          }
           // `this.inertia` itself should never reject — both `_reload` and
           // `_unload` swallow their own work errors via `ctx.logger.error`.
           // If it *does* reject, the only remaining cause is the logger
@@ -211,6 +245,28 @@ export class Fiber {
           }
         }
       }, 'ctx.plugin()')
+
+      try {
+        // Publish only after the parent owns a fully assigned disposer. A
+        // synchronous observer may dispose either this fiber or its parent.
+        this.context.emit('internal/plugin', this)
+      } catch (error) {
+        // Publication failed synchronously. The disposer removes the child
+        // from both the parent and runtime before control escapes.
+        void Promise.resolve(this.dispose()).catch(reason => this.ctx.logger.error(reason))
+        throw error
+      }
+
+      // Keep the initial notification's historical PENDING view. The loader
+      // may also extend `inject` in that notification, so resolve dependencies
+      // only after publication. A reentrant parent unload makes the child
+      // disposer responsible for draining any PENDING effects instead.
+      if (this.uid !== null && parent.fiber.state !== FiberState.UNLOADING) {
+        for (const name of Object.keys(this.inject)) {
+          this._checkImpl(name)
+        }
+        if (shouldRefresh) this._refresh()
+      }
     } else {
       this.uid = 0
       this.ctx = this.context = parent
@@ -292,21 +348,28 @@ export class Fiber {
   effect(execute: () => Effect, label?: string): AsyncDisposable<Promise<void>>
   effect(execute: () => Effect, label = 'anonymous'): any {
     this.assertActive()
+    if (this.state === FiberState.UNLOADING) {
+      throw new CordisError('INACTIVE_EFFECT')
+    }
 
     const disposables: Disposable[] = []
+    let disposing = false
+    let disposalTask: void | Promise<void>
     const dispose = () => {
+      if (disposing) return disposalTask
+      disposing = true
       let task!: void | Promise<void>
-      for (const dispose of disposables.splice(0).reverse()) {
+      for (const disposable of disposables.splice(0).reverse()) {
         if (task) {
-          task = task.then(dispose)
+          task = task.then(() => runDisposable(disposable))
         } else {
-          const result = dispose()
+          const result = runDisposable(disposable)
           if (isObject(result) && 'then' in result) {
             task = result as any
           }
         }
       }
-      return task
+      return disposalTask = task
     }
 
     const meta: EffectMeta = { label, children: [] }
@@ -324,34 +387,107 @@ export class Fiber {
     }
 
     let task: void | Promise<void>
+    let executing = true
+    let resolveSetup: (() => void) | undefined
+    let rejectSetup: ((reason: unknown) => void) | undefined
+    let setupBarrier: Promise<void> | undefined
+    let setupFailed = false
+    let inFlight: void | Promise<void>
+    let removeWrapper = () => false
+
+    const waitForSetup = () => {
+      setupBarrier ??= new Promise<void>((resolve, reject) => {
+        resolveSetup = resolve
+        rejectSetup = reject
+      })
+      return setupBarrier
+    }
+
+    const disposeAfter = (setup: PromiseLike<void>) => {
+      return Promise.resolve(setup).then(
+        () => dispose(),
+        async (reason) => {
+          await dispose()
+          throw reason
+        },
+      )
+    }
+
+    const finalizeDisposal = (callback: () => void | Promise<void>) => {
+      let result: void | Promise<void>
+      try {
+        result = callback()
+      } catch (error) {
+        removeWrapper()
+        throw error
+      }
+      if (isObject(result) && 'then' in result) {
+        const pending = Promise.resolve(result).finally(() => {
+          removeWrapper()
+          if (inFlight === pending) inFlight = undefined
+        })
+        return inFlight = pending
+      }
+      removeWrapper()
+      return result
+    }
+
+    const wrapper = defineProperty(() => {
+      // A synchronous setup failure can race an owner unload that already
+      // captured this wrapper but has not invoked it yet. The failed effect is
+      // never returned publicly, so let that internal caller await rollback.
+      if (!runner.epoch) return setupFailed ? inFlight : undefined
+      runner.epoch = false
+      return finalizeDisposal(() => {
+        if (executing) return disposeAfter(waitForSetup())
+        return task ? disposeAfter(task) : dispose()
+      })
+    }, symbols.effect, meta) as AsyncDisposable
+    effectInertia.set(wrapper, () => inFlight)
+
+    // Make the effect visible to a reentrant owner unload before execute()
+    // runs any plugin code. Async teardown stays owner-visible until it
+    // settles, allowing an outer effect to join cleanup another caller began.
+    removeWrapper = this._disposables.push(wrapper)
     try {
       task = this._execute(runner)
     } catch (reason) {
-      dispose()
+      executing = false
+      setupFailed = true
+      runner.epoch = false
+      let cleanup: void | Promise<void>
+      try {
+        cleanup = finalizeDisposal(dispose)
+      } finally {
+        rejectSetup?.(reason)
+      }
+      if (isObject(cleanup) && 'then' in cleanup) {
+        cleanup.catch(error => this.ctx.logger.error(error))
+      }
       throw reason
     }
+    executing = false
+    if (setupBarrier) {
+      Promise.resolve(task).then(resolveSetup, rejectSetup)
+    }
 
     // prevent unhandled rejection — both from `task` itself and from the
     // disposer chain if it fails to settle cleanly.
-    task?.catch(dispose).catch((error) => this.ctx.logger.error(error))
-
-    const wrapper = defineProperty(() => {
-      if (!runner.epoch) return
-      runner.epoch = false
-      return task ? task.then(dispose) : dispose()
-    }, symbols.effect, meta) as AsyncDisposable
+    task?.catch(() => {
+      if (!runner.epoch) return dispose()
+      return finalizeDisposal(dispose)
+    }).catch((error) => this.ctx.logger.error(error))
 
     const disposeAsync = () => {
       if (!runner.epoch) return
       runner.epoch = false
-      return dispose()
+      return finalizeDisposal(dispose)
     }
     wrapper.then = async (onFulfilled, onRejected) => {
       return Promise.resolve(task)
         .then(() => disposeAsync)
         .then(onFulfilled, onRejected)
     }
-    disposables.push(this._disposables.push(wrapper))
     return wrapper
   }
 
@@ -434,7 +570,12 @@ export class Fiber {
     const oldEpoch = this._runner.epoch
     try {
       await Promise.resolve()
-      await this._execute(this._runner)
+      // A disposer queued before this checkpoint may already have invalidated
+      // the load. Do not run plugin code for a stale epoch; the state update
+      // below will drain any effects collected while the fiber was PENDING.
+      if (this._runner.epoch === oldEpoch) {
+        await this._execute(this._runner)
+      }
     } catch (reason) {
       // impl guarantees that the error is non-null (?)
       this.ctx.logger.error(reason)
@@ -457,7 +598,7 @@ export class Fiber {
         await composeError(async (info) => {
           await Promise.resolve()
           info.error = new Error()
-          await dispose()
+          await runDisposable(dispose)
         }, this._runner.getOuterStack)
       } catch (reason) {
         this.ctx.logger.error(reason)