What was wrong

delegate-tool-scoping.ts's scopeNamedDelegatesToOwnServers (introduced 5825c46e0, 2026-09-06 , a real, necessary fix for silently-broken field-ownership attribution on the chat harness, PR #2699) gave every Task-delegatable named subagent its own dedicated MCP server, each registering the full 23-tool family-tool schema set from scratch. On an account with N subagents, that's N complete copies of ~25 tool schemas configured for the SDK to connect to at session start , which is what caused real "Prompt is too long" / context-overflow incidents on accounts with many subagents (Sherlock, 2026-09-08). A same-day fix (a502820d7) addressed a different contributor (full subagent instruction bodies inlined into prompt) but never touched this one, which is why the failure kept recurring on the one real account with enough subagents (12) to hit it.

The fix

Identity now travels via a per-turn unforgeable token, not via which server a call arrives on:

• delegate-tokens.ts (new): mints one random token per named delegate (mintDelegateTokens) and the exact instruction line spliced into that delegate's own prompt (delegateTokenPromptLine). Full trust-model writeup in the file header , unforgeable (never appears anywhere two delegates can both see it), fail-safe (an unresolved token degrades to today's un-attributed identity, never an elevated one).
• subagents.ts: mints tokens after agentIdsByName is known, splices each delegate's own token into ONLY that delegate's own prompt. Delegates no longer get tools/mcpServers overrides at all , they inherit the parent's one shared server, same as general-purpose always did.
• mcp-server.ts: buildCedarSdkMcpServer takes a resolveDelegateAgentId resolver instead of a fixed agentIdOverride + serverName. Every family tool's shape gains an optional _delegateToken field (one line, not touched in any of the 23 individual tool files); a new resolveCallAgentId helper strips it from the call's args and resolves it to a real agentId, computed fresh per call instead of baked into the server at construction time.
• run-chat-agent-sdk.ts: builds exactly ONE Cedar server per turn (moved after agentIdByToken is known), wired with the resolver.
• delegate-tool-scoping.ts: the per-agent-server multiplication is gone , scopeNamedDelegatesToOwnServers/perAgentServers deleted. What's left (buildScopedMcpServers, findReservedCedarServerNameCollisions, cedarToolNamesForServer) simplifies to match: one server, one reserved name.
• legacy-tool-name-map.ts: simplified the frontend tool-name-stripping regex , it used to handle both the shared server and a per-delegate-shaped name; only the former exists now.

No changes needed to the actual gated tools (updateConversationFieldsTool.ts, writeDocumentTool.ts, task tools) , they already just read context.requestContext.get('agentId'); the fix is entirely upstream of them.

Self-review (thermo-review) , findings and fixes

Ran a structural/security review against this diff before opening. Two real findings, both fixed in the second commit:

• A dangling reference to a test file that was never created , pointed the trust-model doc at the actual isolation test instead.
• An undocumented residual gap: a delegate's own final answer (not its prompt) returns to the parent thread, and nothing stopped a delegate from narrating its own token back into it. Documented the gap explicitly (blast radius: same user's own session, so worst case is a misattributed write to data the caller already holds , a coordination bug, not a tenant-isolation one) and added a one-line prompt mitigation ("never repeat this token in your final answer").
• Also removed three non-null assertions (!) I'd introduced in the new isolation test, per this repo's no-cast policy.

How to test

• `pnpm --filter @zero/server exec vitest run src/mastra/workflows/c