fix: address codex review round 3

- Strict steer additionally requires an OPEN STEP: between steps the
  loop may be awaiting its continuation/turn-stop checkpoints, where
  pending steering was already folded and a terminal stop discards a
  later arrival. A message accepted during an open step is drained and
  recorded at that step's settlement before any terminal decision, so
  the acknowledged-then-discarded window is closed. New keyless test
  holds agent/turn-stop open and pins the rejection.
- tool-subagent-control README: distinguish synchronous not-delivered
  errors from started-Task failures (unknown/foreign/descriptor-less
  ids settle the started Task as failed), and drop the claim that the
  completion notice carries the child's response.

.agents/notes/implemented/feature/2026-07-21-continuable-background-subagents.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write
-2026-07-21-continuable-background-subagents.md: abb8a89bd6ec0fbe4a36e7f82c1356fb96b38390
-2026-07-21-continuable-background-subagents.zh.md: 30207dfd757eeada3e8ba961b67c79db3c98aad6
+2026-07-21-continuable-background-subagents.md: a23943a0226d2ef4eee27d7294d7a98a84c5f109
+2026-07-21-continuable-background-subagents.zh.md: e645cfb0a11c554a30a7ad092b612c5bac7d8dea

.agents/notes/implemented/feature/2026-07-21-continuable-background-subagents.md

@@ -49,7 +49,7 @@ For a continuable initial activation, the control service allocates the stable c
 
 Every continuable child turn is admitted through this Task-backed path. A non-terminal Task is the only supported live activation; when no activation exists, its run has already been disposed and the durable child is resumable. Before routing any by-id operation, the control service synchronously compares its association with `ctx.agents.get(childId)`. A registry Agent with no association, or a registry Agent different from the associated `run.localAgent`, is an ownership conflict: the control service fails rather than adopting an idle Agent or attaching an untracked turn. When neither exists, cold resume may proceed; a competing publication after that check still loses at the Agent registry collision boundary.
 
-Routing follows the Task association. A running Task accepts live delivery through the run's optional strict `SubagentRun.steer` capability. An absent Task starts a fresh Task and cold-resumes the child. In-process spawn and fork implement this capability with synchronous checks that share one frame with the `Agent.steer()` call: the child must be `running`, its turn must still be open in the log (status stays `running` through a closed turn's durability flush, where the loop strands drained steering), and no structured capture may have committed (its terminal stop makes the loop discard late steering). Providers must not expose the Agent-level idle fallback as strict steering, because that fallback may start an untracked turn after the observed run has ended. If the Task settles between association lookup and this strict check, `steer()` fails, `send_message` reports the message as not delivered, and that call does not fall through to cold resume; a later retry after Task terminal may start the next activation.
+Routing follows the Task association. A running Task accepts live delivery through the run's optional strict `SubagentRun.steer` capability. An absent Task starts a fresh Task and cold-resumes the child. In-process spawn and fork implement this capability with synchronous checks that share one frame with the `Agent.steer()` call: the child must be `running`, its turn must still be open in the log (status stays `running` through a closed turn's durability flush, where the loop strands drained steering), a step must be open (between steps the loop may sit at its continuation/turn-stop checkpoints, where steering was already folded and a terminal stop discards a later arrival), and no structured capture may have committed (its terminal stop makes the loop discard late steering). Providers must not expose the Agent-level idle fallback as strict steering, because that fallback may start an untracked turn after the observed run has ended. If the Task settles between association lookup and this strict check, `steer()` fails, `send_message` reports the message as not delivered, and that call does not fall through to cold resume; a later retry after Task terminal may start the next activation.
 
 The control service does not serialize two callers that race a stopped child through paths outside it, nor does it model a separate settling phase between result production and disposal. The synchronous association install before the producer's first await admits one activation per child in this process — a competing `sendMessage` during resume load observes the pending activation and fails explicitly — while a bypassing publication still loses at the Agent registry's same-session collision boundary. Delivery racing startup, cancellation, completion, or cleanup may also fail. These limitations are explicit rather than hidden behind a larger lifecycle abstraction.
 

.agents/notes/implemented/feature/2026-07-21-continuable-background-subagents.zh.md

@@ -49,7 +49,7 @@ durable child Session
 
 每个可继续 child 轮次都通过这条由 Task 支撑的路径准入。非终态 Task 是唯一受支持的存活激活；不存在激活时，其 run 已被 dispose，持久化 child 可以恢复。在路由任何按 id 的操作之前，控制服务会同步将自身关联与 `ctx.agents.get(childId)` 比较。如果注册表中的 Agent 没有关联，或者它与所关联的 `run.localAgent` 不同，就属于所有权冲突：控制服务会失败，而不会接管 idle Agent 或附加未受跟踪的轮次。二者均不存在时，可以从持久化存储恢复；如果检查后又有竞争方发布，仍会在 Agent 注册表的冲突边界上失败。
 
-系统依据 Task 关联进行路由。运行中的 Task 通过 run 可选且严格的 `SubagentRun.steer` 功能接收在线消息。Task 不存在时，系统创建新 Task，并从持久化存储恢复 child。进程内 spawn 和 fork 用与 `Agent.steer()` 调用共享同一同步帧的检查来实现该功能：child 必须处于 `running` 状态，其轮次在日志中必须仍然打开（已关闭轮次的持久化 flush 期间状态仍是 `running`，此时循环会丢弃排空的 steering 消息），且不得已有结构化捕获提交（其终止性 stop 会让循环丢弃迟到的 steering）。提供方不得将 Agent 层的 idle fallback 暴露为严格 steering（中途引导），因为观察到的 run 结束后，该 fallback 可能启动一个未受 Task 跟踪的轮次。如果 Task 在查找关联与执行这项严格检查之间进入结算，`steer()` 会失败，`send_message` 会报告消息未送达，而且该次调用不会改用从持久化存储恢复路径；在 Task 终态发布后重试，才可能启动下一次激活。
+系统依据 Task 关联进行路由。运行中的 Task 通过 run 可选且严格的 `SubagentRun.steer` 功能接收在线消息。Task 不存在时，系统创建新 Task，并从持久化存储恢复 child。进程内 spawn 和 fork 用与 `Agent.steer()` 调用共享同一同步帧的检查来实现该功能：child 必须处于 `running` 状态，其轮次在日志中必须仍然打开（已关闭轮次的持久化 flush 期间状态仍是 `running`，此时循环会丢弃排空的 steering 消息），必须有打开的 step（step 之间循环可能停在其 continuation/turn-stop 检查点上，此时 steering 已被折叠，终止性 stop 会丢弃之后到达的消息），且不得已有结构化捕获提交（其终止性 stop 会让循环丢弃迟到的 steering）。提供方不得将 Agent 层的 idle fallback 暴露为严格 steering（中途引导），因为观察到的 run 结束后，该 fallback 可能启动一个未受 Task 跟踪的轮次。如果 Task 在查找关联与执行这项严格检查之间进入结算，`steer()` 会失败，`send_message` 会报告消息未送达，而且该次调用不会改用从持久化存储恢复路径；在 Task 终态发布后重试，才可能启动下一次激活。
 
 控制服务不会串行化两个通过其外部路径同时争抢已停止 child 的调用方，也不会为结果产生与 dispose 之间的阶段单独建立 settling 状态。在 producer 首次 await 之前同步安装的关联，使本进程内每个 child 只准入一次激活——resume 加载期间竞争的 `sendMessage` 会观察到待处理的激活并显式失败——而绕开该关联的发布仍会在 Agent 注册表相同会话的冲突边界上失败。发送也可能因与启动、取消、完成或清理发生竞态而失败。这些限制是明确的，而非隐藏在更大的生命周期抽象之后。
 

packages/subagent/subagent-inprocess/README.md

@@ -30,7 +30,7 @@ The required request signal covers both startup and the live run. Before publica
 
 After fulfillment, the caller owns the run. Provider-plugin unload does not revoke it. `dispose()` removes the live abort listener, records cancellation, and delegates to the returned `AgentHandle.dispose()`, whose memoized quiescence transaction stops the loop, removes the agent and session, and unwinds scoped registrations. Cancellation owns every non-completed in-flight outcome and reports `aborted`; an already-completed turn remains completed.
 
-Runs expose the strict `steer` capability: the synchronous checks and the `Agent.steer()` call share one frame, so delivery joins the observed turn or throws. Delivery requires `AgentStatus.running`, an open turn in the child log (status stays `running` through a closed turn's durability flush, where the loop would strand the message), and no committed structured capture (whose terminal stop makes the loop discard late steering). The Agent-level idle fallback (queue and start a new turn) is deliberately not reachable through the run — that would start an untracked turn after the run's result was read.
+Runs expose the strict `steer` capability: the synchronous checks and the `Agent.steer()` call share one frame, so delivery joins the observed turn or throws. Delivery requires `AgentStatus.running`, an open turn in the child log (status stays `running` through a closed turn's durability flush, where the loop would strand the message), an open step (between steps the loop may sit at its continuation/turn-stop checkpoints, where steering was already folded and a terminal stop discards a later arrival; a message accepted during an open step is recorded at that step's settlement before any terminal decision), and no committed structured capture (whose terminal stop makes the loop discard late steering). The Agent-level idle fallback (queue and start a new turn) is deliberately not reachable through the run — that would start an untracked turn after the run's result was read.
 
 ## Spawn and fork inputs
 

packages/subagent/subagent-inprocess/src/index.ts

@@ -276,6 +276,19 @@ function driveTurn(
       if (lastBoundary?.type !== 'turn/start') {
         throw new Error(`subagent child "${childId}" turn has already closed; the message was not delivered`)
       }
+      // Terminal turn-stops only run between steps: with no step open, the
+      // loop may be awaiting its continuation/turn-stop checkpoints, where
+      // pending steering was already folded and a terminal decision discards
+      // a later arrival. A message accepted during an OPEN step is instead
+      // drained and recorded at that step's settlement checkpoint before any
+      // terminal decision (cancellation remains the documented shared-outcome
+      // race).
+      const lastStep = child.session.events.findLast(
+        event => event.type === 'step/start' || event.type === 'step/end',
+      )
+      if (lastStep?.type !== 'step/start') {
+        throw new Error(`subagent child "${childId}" is between steps; the message was not delivered`)
+      }
       // A committed structured capture makes the pending `agent/turn-stop`
       // checkpoint terminal, and the loop then discards late steering. The
       // capture is synchronously observable, so reject rather than

packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts

@@ -258,6 +258,35 @@ describe('startInProcessRun', () => {
     await run.dispose()
   })
 
+  it('strict steer rejects the between-steps window where a terminal turn-stop discards steering', async () => {
+    // Hold `agent/turn-stop` open: the step has closed, pending steering was
+    // already folded into the continuation decision, and a terminal stop
+    // would discard a message arriving now — the exact window an
+    // acknowledged delivery would be a lie.
+    const { ctx, parent } = await setup([textResponse('quick')])
+    let releaseStop: (() => void) | undefined
+    ctx.on('agent/turn-stop', (agent) => {
+      if (agent.session.header.parentSession === undefined || releaseStop !== undefined) return undefined
+      return new Promise((resolve) => {
+        releaseStop = () => { resolve(undefined) }
+      })
+    })
+    const run = await startInProcessRun(request(parent), {})
+    const child = ctx.agents.get(run.id)!
+    await new Promise<void>((resolve) => {
+      const timer = setInterval(() => {
+        if (releaseStop !== undefined) { clearInterval(timer); resolve() }
+      }, 5)
+    })
+    expect(child.status).toBe('running')
+    expect(() => { run.steer!([{ type: 'text', text: 'too late for this turn' }]) })
+      .toThrow(/between steps; the message was not delivered/)
+    releaseStop!()
+    await run.result
+    expect(child.session.events.some(event => event.type === 'steering/message')).toBe(false)
+    await run.dispose()
+  })
+
   it('strict steer rejects the closed-turn flush window where the loop discards steering', async () => {
     // Hold the turn-end durability flush open: the turn has closed in the log
     // and status is still `running`, exactly the window where the loop would

packages/subagent/tool-subagent-control/README.md

@@ -24,11 +24,11 @@ Prefix-stable; the schema does not change at runtime.
 
 #### What the model sees
 
-`message delivered to running task <taskId>` when the message joined the running activation, or `message started task <taskId> continuing subagent <subagent_id>` when it cold-resumed the child. Failures are errored results whose message states the message was not delivered (unknown or foreign child, ownership conflict, settlement race, no live-delivery capability).
+`message delivered to running task <taskId>` when the message joined the running activation, or `message started task <taskId> continuing subagent <subagent_id>` when it started a cold-resume activation. Synchronous routing failures — an ownership conflict, a lost steering race, no live-delivery capability — are errored results whose message states the message was not delivered. An absent activation always reports `started`: lookup runs inside that Task, so an unknown, foreign, or descriptor-less child surfaces as the started Task settling `failed` (read through `task_output`), not as an errored `send_message` result.
 
 #### Token effect
 
-One short acknowledgement per call; the child's response enters parent history only when collected through `task_output` or injected by the task completion notice.
+One short acknowledgement per call; the child's response enters parent history only when collected through `task_output` (the completion notice is a status line, never the response).
 
 #### KV Cache effect