Work handed to a second model, which may not ask

subagent_run gives a self-contained piece of work to a helper carrying the
parent's connection, directory, model and effort, and hands its answer back as
the tool result. The mechanism is the one scheduled runs already use -- a hidden
chat, one turn, wake_chat, and a poll -- so tools, rounds, budgets, metrics and
steps all work with no second implementation. The two alternatives were
rejected where they had already been rejected once: a nested Generation is two
replies writing one transcript, and a one-shot complete() has no tools, which
schedule/runner.py records as useless for exactly this case.

Every restriction is a property of the child's row, applied by resolve_tools
after the gates, because a rule that lives in a system message is one a page the
model just read can argue with. No questions, no recursion, nothing that writes
unless the call asked for it and the parent's own mode would not have stopped
first, and commands only from a fixed read-only list -- in every mode including
Auto, because the task text can have come from a page.

Withdrawing ask_user turned out to be half of "nobody is watching". An approval
still built a card nobody could see and parked the reply until approval_timeout,
which from every screen is the feature not working. Chat.unattended is the
question now, and not the kind: _authorise answers with a refusal instead. A
scheduled task's chat had the same hole and is covered by the same flag.

Three bounds, counted where each is knowable: per reply on the parent's
Generation, instance-wide in a set a restart clears, and per helper in settings
of its own so one runs out of room long before the reply that asked. Past the
clock the helper is stopped rather than abandoned, so a partial answer comes
back with a sentence saying so.

Also: four gates had shipped into the scope menu with no name, taking the first
tool's label instead -- the canvas switch read "Canvas written". There is a test
that refuses a family without one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -20,7 +20,7 @@ lembas info                         # paths + counts, useful when confused
 lembas secret-key                   # generate LEMBAS_SECRET_KEY
 lembas create-admin                 # create or promote an admin
 
-pytest                              # 1914 tests, ~2min
+pytest                              # 1949 tests, ~2min
                                     # PLAN.md tracks what is and is not built
 ruff check .                        # lint (line length 100)
 python scripts/build_artwork.py     # regenerate artwork (SVG + PWA icons;
@@ -153,6 +153,8 @@ src/lembas/
     crypto.py        Fernet encrypt/decrypt/mask
     files.py         attachment validation, images, PDF/text extraction
     reasoning.py     splits thinking from the answer
+    subagent.py      a helper another model sent: a hidden chat, one turn,
+                     and everything it may not do
     settings_store.py  runtime instance settings
     canvas.py        what is open in the canvas panel, and where it comes from
     scratch.py       a chat's own working document
@@ -188,6 +190,10 @@ touching the code it names -- these are the same notes, not a summary.
   schedule something wrote a note and said it had).
 - `docs/notes/image-generation.md` -- the ComfyUI workflow with holes in it, what
   substitution walks, the review-and-retry loop, and how a failure reports itself.
+- `docs/notes/subagents.md` -- the hidden chat a helper runs in, why `unattended`
+  is a column and not a kind, the two halves that stop a helper stalling on a
+  card nobody can see, what it may run and why Auto is never inherited, and where
+  the three bounds are counted.
 
 **`render()`, not `TemplateResponse`.** `web/templating.py:render()` injects
 `user`, `theme`, `layout`, `version` and `allow_signup`. Templates assume they