review: refuse --scripted-model with --scenario/--prompt; document dump's default limit (README, site en/zh); describe Stop as prompt-path dependent

Author: ScriptedAlchemy

docs/audits/2026-09-03-host-lineage-matrix.md

@@ -151,8 +151,10 @@ Findings specific to this run:
 - **Turn boundaries.** Four `UserPromptSubmit` payloads (rows 2, 58, 105,
   137), four distinct `prompt_id`s; the sequential and nested spawns ran under
   the `<task-notification>` prompt (row 58), and the registry's `generation`
-  on their lineage is that `prompt_id`. Each `-p` process produced its own
-  `Stop` + `SessionEnd` (rows 34/102–103, 129–130, 135, 140–141); resuming
+  on their lineage is that `prompt_id`. Each `-p` process produced exactly one
+  `SessionEnd` (rows 103, 130, 135, 141), while `Stop` follows the prompt
+  path: twice in turn 1 (row 34 before the re-prompt, row 102 after), once in
+  turns 2 and 4 (rows 129, 140), never in the `/compact` turn; resuming
   re-registers nothing new — the root node stays the same and every resumed
   root-side hook still resolves `depth 0, resolution: native`.
 - **MCP correlation held at every depth.** The five `probe` calls (rows 29,
@@ -382,7 +384,7 @@ header table. What changed and what did not:
 | `PostToolUseFailure` "not observed" | Emitted by 2.1.259 for a failed MCP tool call, at the root and inside subagents, with the same `session_id`/`agent_id` carrier as `PostToolUse` (orchestration rows 77, 94, 116) | Corrected: observed; the registry already closed windows on `tool/failure` |
 | `PreCompact`/`PostCompact` "not observed" | Fired by a manual `/compact` sent as a resumed `-p` prompt, bracketing a `SessionStart source: compact`; root-only, no `agent_id`, own `prompt_id` (orchestration rows 132–134) | Corrected: inducible on demand |
 | Two spawns in one message would leave the registry's `toolCallId` uncertain (`siblingsUncertain`) | The host serialised them: `SubagentStart` for the first fired before the second `Agent` `PreToolUse` opened, so both claims were certain and agree with `tool_response.agentId` and the stream's `task_started` | Held stronger than assumed |
-| Single-turn `-p` sessions only | Four `-p` turns resumed into one `session_id`; `SessionStart source: resume`, one `Stop`/`SessionEnd` per turn, root-side lineage unchanged across turns | New coverage; no framework impact |
+| Single-turn `-p` sessions only | Four `-p` turns resumed into one `session_id`; `SessionStart source: resume`, one `SessionEnd` per invocation while `Stop` follows the prompt path (two in turn 1 around the `<task-notification>` re-prompt, none in the `/compact` turn), root-side lineage unchanged across turns | New coverage; no framework impact |
 
 No lineage or projection code change was needed: the registry replay test
 (`packages/rsc-runtime/tests/lineage-registry.test.ts`) now runs against all

examples/host-test/README.md

@@ -36,6 +36,9 @@ Two MCP servers ship in the plugin:
 - `host-test` (generated routes, `src/mcp/host-test/tools/`): `dump` (filter by
   any conversation/session/subagent id, `full` for raw lines) and `reset`. Each
   `dump` call records the request context the generated server mounted for it.
+  A bare `dump` returns the newest 50 matching records — a whole log of a few
+  hundred records overflows the tool-result document — so pass `limit` (up to
+  5000) for more; `matched` and `total` always count the whole log.
 - `host-test-raw` (hand-rolled stdio factory, `src/mcp/host-test-raw.ts`):
   `probe` records the raw SDK request context — session id, JSON-RPC id,
   `_meta`, lifted envelope, negotiated client info — so hook↔MCP correlation is
@@ -82,9 +85,15 @@ pnpm --filter @agent-bundle-example/host-test probe:uninstall claude
   `{ "prompt": "..." }`). For Claude every turn after the first runs
   `claude -p --resume <session_id>` against the session the first turn's
   `system/init` envelope reported, so one capture holds a multi-turn session
-  with `SessionStart source: resume`, a fresh `prompt_id` per turn, and one
-  `Stop`/`SessionEnd` per turn. Codex and Cursor drivers take the first turn
-  only and refuse longer scenarios. `scenarios/claude-orchestration.json` is
+  with `SessionStart source: resume` and one `SessionEnd` per invocation.
+  `Stop` follows the prompt path rather than the invocation: a turn whose
+  background subagents finish re-prompts itself with a `<task-notification>`
+  and stops twice, while a `/compact` turn submits no prompt and never stops
+  (`fixtures/host-lineage/claude-2.1.259-orchestration.ndjson`). If the first
+  turn reports no `session_id`, the capture fails instead of running the
+  remaining turns as fresh sessions; `--scripted-model` plays a fixed
+  transcript and refuses `--scenario`/`--prompt`. Codex and Cursor drivers take
+  the first turn only and refuse longer scenarios. `scenarios/claude-orchestration.json` is
   the checked-in orchestration scenario (two parallel `Agent` spawns, one
   sequential spawn that nests another, the `host-test:host-test` skill, a
   plugin-command probe, a manual `/compact`, a final stop).

examples/host-test/scripts/probe.mjs

@@ -4,7 +4,7 @@
 // uninstall. Nothing here touches the real ~/.claude, ~/.codex, or ~/.cursor.
 //
 //   node scripts/probe.mjs install   <claude|codex|cursor> [--no-auth] [--root <dir>]
-//   node scripts/probe.mjs capture   <claude|codex|cursor> [--prompt <text> | --scenario <file.json>] [--model <m>] [--timeout <ms>] [--scripted-model]
+//   node scripts/probe.mjs capture   <claude|codex|cursor> [--prompt <text> | --scenario <file.json> | --scripted-model] [--model <m>] [--timeout <ms>]
 //   node scripts/probe.mjs uninstall <claude|codex|cursor> [--keep-home]
 //   node scripts/probe.mjs status    <claude|codex|cursor>
 import { spawn, spawnSync } from 'node:child_process';
@@ -296,6 +296,12 @@ const describeStream = (envelopes) => {
  */
 const captureClaude = () => {
   const scripted = flags.scriptedModel === true;
+  // The scripted model answers one canned transcript; it cannot follow a
+  // scenario, so refuse the combination instead of silently running the
+  // canned turn under the scenario's name.
+  if (scripted && (flags.scenario !== undefined || flags.prompt !== undefined)) {
+    throw new Error('--scripted-model plays a fixed transcript and ignores prompts: drop --scenario/--prompt, or run the scenario against the real model');
+  }
   const turns = scripted ? ['You are exercising the host-test probe plugin. Do the scripted steps.'] : scenarioTurns();
   const baseArgs = [
     '--output-format', 'stream-json',

website/docs/en/examples/index.mdx

@@ -23,7 +23,7 @@ walked through here:
 | --- | --- |
 | [Worktree Proximity](https://github.com/ScriptedAlchemy/agent-bundle/tree/main/examples/worktree-proximity) | One root task and two child agents in linked worktrees, coordinated through durable notices. |
 | [RSC Agent Runtime](https://github.com/ScriptedAlchemy/agent-bundle/tree/main/examples/rsc-agent-runtime) | An opt-in architecture experiment: one RSC runtime shared by hooks, MCP tools, and an MCP App timeline. Not a public API. |
-| [Host Test](https://github.com/ScriptedAlchemy/agent-bundle/tree/main/examples/host-test) | A probe plugin that records every hook payload and MCP call a host delivers, with the `request.lineage` each one resolved to. Its `probe:install` / `probe:capture` / `probe:uninstall` scripts drive a real host in an isolated home; `probe:capture <host> --scenario <file.json>` runs an ordered list of prompts as one multi-turn session (Claude: `claude -p --output-format stream-json`, later turns `--resume`d), saving the model's own tool-use stream beside the hook log. The Workbench walkthrough needs no signed-in host; the probe lifecycle does. |
+| [Host Test](https://github.com/ScriptedAlchemy/agent-bundle/tree/main/examples/host-test) | A probe plugin that records every hook payload and MCP call a host delivers, with the `request.lineage` each one resolved to. Its `probe:install` / `probe:capture` / `probe:uninstall` scripts drive a real host in an isolated home; `probe:capture <host> --scenario <file.json>` runs an ordered list of prompts as one multi-turn session (Claude: `claude -p --output-format stream-json`, later turns `--resume`d), saving the model's own tool-use stream beside the hook log. The plugin's `dump` MCP tool returns the newest 50 matching records unless `limit` is given (`matched` counts the whole log). The Workbench walkthrough needs no signed-in host; the probe lifecycle does. |
 
 ## Running them
 

website/docs/zh/examples/index.mdx

@@ -21,7 +21,7 @@ description: '可运行的 agent-bundle 示例：从 Skill 起步项目到完整
 | --- | --- |
 | [Worktree Proximity](https://github.com/ScriptedAlchemy/agent-bundle/tree/main/examples/worktree-proximity) | 一个根任务与两个位于关联 worktree 中的子智能体，通过持久通知协调。 |
 | [RSC Agent Runtime](https://github.com/ScriptedAlchemy/agent-bundle/tree/main/examples/rsc-agent-runtime) | 一个可选启用的架构实验：一个 RSC 运行时同时服务钩子、MCP 工具与 MCP App 时间线。不是公开 API。 |
-| [Host Test](https://github.com/ScriptedAlchemy/agent-bundle/tree/main/examples/host-test) | 一个探针插件，记录宿主投递的每个钩子负载与 MCP 调用，以及各自解析出的 `request.lineage`。它的 `probe:install` / `probe:capture` / `probe:uninstall` 脚本在隔离的 home 中驱动真实宿主；`probe:capture <host> --scenario <file.json>` 把一组有序提示作为一个多轮会话运行（Claude 使用 `claude -p --output-format stream-json`，后续轮次以 `--resume` 续接），并把模型自身的工具调用流保存在钩子日志旁。Workbench 导览不需要已登录的宿主；探针生命周期则需要。 |
+| [Host Test](https://github.com/ScriptedAlchemy/agent-bundle/tree/main/examples/host-test) | 一个探针插件，记录宿主投递的每个钩子负载与 MCP 调用，以及各自解析出的 `request.lineage`。它的 `probe:install` / `probe:capture` / `probe:uninstall` 脚本在隔离的 home 中驱动真实宿主；`probe:capture <host> --scenario <file.json>` 把一组有序提示作为一个多轮会话运行（Claude 使用 `claude -p --output-format stream-json`，后续轮次以 `--resume` 续接），并把模型自身的工具调用流保存在钩子日志旁。插件的 `dump` MCP 工具默认只返回最新的 50 条匹配记录，除非传入 `limit`（`matched` 统计整份日志）。Workbench 导览不需要已登录的宿主；探针生命周期则需要。 |
 
 ## 如何运行