@stigmer/runner 3.15.3-dev.20260914121148 → 3.16.0

package/src/activities/execute-deep-agent/__tests__/hermetic/inline-artifact-across-gate.test.ts

@@ -1,6 +1,7 @@
 /**
  * Hermetic goldens: an INLINE-PUBLISHED ARTIFACT survives a HITL gate — the
- * arbiter for Q-S3-16 (the seed's breadth), two invocations on the durable
+ * arbiter for the seed's breadth (what a reinvocation carries forward), two
+ * invocations on the durable
  * (sqlite) checkpointer.
  *
  * Turn 1: the model writes a report (`write_file`; under capture mode in a
@@ -18,19 +19,19 @@
  * list is non-empty (`update-status.ts`), so a runtime that seeded messages
  * only and then published nothing new would carry an empty list — and the
  * server would keep the old one, but a runtime that published one NEW
- * artifact from an empty list would ERASE the prior one. Q-S3-16's
+ * artifact from an empty list would ERASE the prior one.
  * `seedFromPersistedStatus` carries `artifacts` for exactly this reason;
  * this pair of goldens (`inline-artifact.turn1`, `inline-artifact.turn2`) is
  * what proves it did.
  *
- * Also recorded, F-M0-8 (a shape fact for the owner): the write's tool row
+ * Also recorded (a shape fact, as found): the write's tool row
  * shows `requiresApproval: true` with `approvalPolicySource` BUILTIN_CATEGORY
  * — the category policy's verdict — while the row is COMPLETED because
  * capture mode let it flow; the artifact carries no URL (the local store's
  * serve URL never enters the record).
  *
- * What every reinvocation golden here shows since S3 M2a (the runtime over
- * the native adapter; Q-S3-16 and Q-M2a-2): `startedAt` is THIS turn's own,
+ * What every reinvocation golden here shows since #1096 (the runtime over
+ * the native adapter): `startedAt` is THIS turn's own,
  * not turn 1's carried by the orchestrator's whole-status clone; the
  * `fileReviewEventStream` carries only the events THIS turn authored (the
  * runtime seeds messages, sub-agents, artifacts, write-backs, todos, usage,
@@ -41,7 +42,7 @@
  * runtime accountant's fields (`model`, `estimatedCostUsd`, the requested
  * tier and thinking mode).
  *
- * Golden hunk since S3 M4 (Q-M4-7, ruled Q-M4-12 A): turn 1's
+ * Golden hunk since #1096: turn 1's
  * `fileChangeProgress` is the TRUE snapshot at the WAITING write
  * (`filesChanged: 1`, `report.md` ADD +3, `capturedAt` t=2) where it was a
  * stale t=0 snapshot taken by the stream loop before the engine wrote the

package/src/activities/execute-deep-agent/__tests__/hermetic/pause-vs-shutdown.test.ts

@@ -1,10 +1,10 @@
 /**
  * Hermetic goldens: the two ways a turn is INTERRUPTED from outside, and how
  * the activity tells them apart — the throw-vs-return table the control
- * plane's workflow keys on. Since S3 M2a the activity is the turn runtime
+ * plane's workflow keys on. Since #1096 the activity is the turn runtime
  * over the native adapter, and the shapes below are the runtime's terminal
- * table (`harness/terminal-table.ts`), ruled at Q-S3-7 (P-1: the pause copy
- * is Cursor's) and stigmer#1071 ("persist a thrown terminal once").
+ * table (`harness/terminal-table.ts`; the pause copy is Cursor's) and
+ * stigmer#1071 ("persist a thrown terminal once").
  *
  *  1. USER PAUSE: the activity's `cancellationSignal` aborts. Whether the
  *     abort lands inside a model call (staged from the scripted model's
@@ -13,11 +13,11 @@
  *     stop controller aborts the adapter's signal, the adapter cancels the
  *     graph run and settles `interrupted`, and the runtime persists PAUSED
  *     ONCE — WITH the transcript and the row "Execution paused by user. Use
- *     resume to continue." (P-1: the runtime's pause copy is Cursor's; the
+ *     resume to continue." (the runtime's pause copy is Cursor's; the
  *     orchestrator's said "… from this checkpoint.") — then throws
- *     `CancelledFailure("Activity paused by orchestrator")`. Until M2a the
+ *     `CancelledFailure("Activity paused by orchestrator")`. Until #1096 the
  *     orchestrator persisted PAUSED TWICE, the second write bare and erasing
- *     the transcript (S3 M0 finding F-M0-6, stigmer#1054's double persist);
+ *     the transcript (stigmer#1054's double persist);
  *     `pause.bare.status.json` recorded that write and is gone with it. The
  *     one write differs by where the cancel landed — after the tool finished
  *     (`pause.loop.after-tool`) or while it was still RUNNING
@@ -28,7 +28,7 @@
  *     copy and one row, thrown as
  *     `CancelledFailure("Activity cancelled (worker shutdown, not user pause)")`
  *     (#776) — the workflow re-invokes instead of waiting for a resume. The
- *     copy is unchanged; what changed at M2a (Q-S3-7, the runtime's arm
+ *     copy is unchanged; what changed in #1096 (the runtime's arm
  *     wins) is that the runtime's arm KEEPS the transcript the turn produced
  *     and appends the row, where the orchestrator's `buildWorkerShutdownStatus`
  *     replaced the whole status with the row alone.
@@ -145,7 +145,7 @@ describe("ExecuteDeepAgent hermetic — pause vs worker shutdown", () => {
       expect(record.persistedPhases).toEqual([ExecutionPhase.EXECUTION_IN_PROGRESS, ExecutionPhase.EXECUTION_PAUSED]);
 
       const pausedWrites = record.persisted.filter((s) => s.phase === ExecutionPhase.EXECUTION_PAUSED);
-      expect(pausedWrites, "PAUSED is persisted exactly once (stigmer#1071; F-M0-6 closed at M2a)").toHaveLength(1);
+      expect(pausedWrites, "PAUSED is persisted exactly once (stigmer#1071)").toHaveLength(1);
       const [paused] = pausedWrites;
       expect(paused.messages.filter((m) => m.type === MessageType.MESSAGE_SYSTEM).map((m) => m.content)).toEqual([
         "Execution paused by user. Use resume to continue.",
@@ -188,11 +188,10 @@ describe("ExecuteDeepAgent hermetic — pause vs worker shutdown", () => {
     const final = record.lastFullStatus!;
     expect(final.error).toBe("Execution interrupted: runner worker was shut down. Retry or resume.");
     // The transcript the turn produced is kept and the row appended (the
-    // runtime's arm, Q-S3-7); the tool row rides its own empty AI message
-    // (F-M0-1, S4's).
+    // runtime's arm); the tool row sits on the message whose text
+    // proposed it (since #1097 — until then on its own empty message).
     expect(final.messages.map((m) => [m.type, m.content])).toEqual([
       [MessageType.MESSAGE_AI, "Let me look."],
-      [MessageType.MESSAGE_AI, ""],
       [
         MessageType.MESSAGE_SYSTEM,
         "Execution interrupted: the runner worker was shut down while the agent was still running. You can retry or resume.",

package/src/activities/execute-deep-agent/__tests__/hermetic/plain-turn.test.ts

@@ -5,12 +5,12 @@
  *
  * Invariant pinned: the activity resolves the four-resource chain, builds the
  * REAL deepagents graph, streams it through the v3 protocol into
- * `V3StatusBuilder`, persists IN_PROGRESS then COMPLETED, and returns the slim
+ * `TranscriptBuilder`, persists IN_PROGRESS then COMPLETED, and returns the slim
  * status. The golden (`goldens/plain-turn.status.json`) is the smallest
  * status the native harness produces: one AI message with the scripted text
  * and the scripted usage, `startedAt` / `completedAt` on the scripted clock.
  *
- * This file is also the PROBE the M0 plan named: no earlier test drove the
+ * This file is also the PROBE the native net opened with (#1096): no earlier test drove the
  * real graph through `streamEvents(..., { version: "v3" })`. The scripted
  * model streams, so the events under this golden are the ones a provider
  * produces (`scripted-model.ts` header).
@@ -22,10 +22,10 @@
  * `thread_id` (carried from `index.test.ts`: "handles empty threadId
  * gracefully").
  *
- * Since S3 M2a the activity is the turn runtime over the native adapter, and
+ * Since #1096 the activity is the turn runtime over the native adapter, and
  * `streamingUsage` carries the runtime accountant's fields — `model`,
  * `estimatedCostUsd` priced at the registry's rates, the requested tier and
- * thinking mode (Q-M2a-2: one writer of the summary, the runtime). Nothing
+ * thinking mode (one writer of the summary, the runtime). Nothing
  * else in this golden moved with the flip.
  *
  * Regenerate ONLY after a deliberate behavior change:

package/src/activities/execute-deep-agent/__tests__/hermetic/platform-stop.test.ts

@@ -4,21 +4,21 @@
  *
  * What the arm does: the record's `controlSignal` answers STOP on the first
  * full write that carries a tool row (the tool-call boundary forces that
- * persist, `persist-decision.ts` `contentDirty`); the runtime's chokepoint
+ * persist, `persist-decision.ts` over the builder's `dirty` flag); the runtime's chokepoint
  * reads the signal off the write and aborts the adapter's `stopSignal`; the
  * adapter's loop, which AWAITED that persist, sees the abort before it pulls
  * the next event, cancels the graph run and settles `interrupted`; the
  * runtime's table maps the stop to COMPLETED with `platformStopArm`'s one
  * row, "Execution stopped by the platform.", no `status.error`, and RETURNS.
  *
- * Ruled at Q-S3-3 (a platform STOP is the platform saying "stop spending
- * now"; the runtime's abort is the one stop) and landed at S3 M2a. Until
+ * The rule (a platform STOP is the platform saying "stop spending
+ * now"; the runtime's abort is the one stop) landed in #1096. Until
  * then the orchestrator answered STOP by activating `graceful-stop.ts`,
  * which handed the model one more tool-free round: the transcript carried
  * the model's wrap-up ("Stopping here as asked.") AND the middleware's own
- * notice rendered as the agent's words (F-M0-7), and the run ended
- * COMPLETED with no row. The graceful-stop middleware was deleted at S3 M2b
- * (Q-M2a-4 sequenced it after the legacy loop that activated it); nothing in
+ * notice rendered as the agent's words, and the run ended
+ * COMPLETED with no row. The graceful-stop middleware was deleted in #1096
+ * (after the legacy loop that activated it); nothing in
  * the graph answers a STOP any more, so the second scripted turn is never
  * reached — this golden was byte-identical across the deletion.
  *
@@ -74,7 +74,7 @@ describe("ExecuteDeepAgent hermetic — platform STOP", () => {
     env.dispose();
   });
 
-  it("stops the run at the STOP and completes with the platform-stop row (Q-S3-3)", async () => {
+  it("stops the run at the STOP and completes with the platform-stop row", async () => {
     // ── Arrange ──────────────────────────────────────────────────────────────
     let stopsAnswered = 0;
     const record = deepAgentExecutionRecord({
@@ -113,7 +113,8 @@ describe("ExecuteDeepAgent hermetic — platform STOP", () => {
       "Execution stopped by the platform.",
     ]);
     const ai = final.messages.filter((m) => m.type === MessageType.MESSAGE_AI).map((m) => m.content);
-    expect(ai, "no wrap-up round and no injected notice: the run stopped at the STOP").toEqual(["Let me look.", ""]);
+    expect(ai, "no wrap-up round and no injected notice: the run stopped at the STOP").toEqual(["Let me look."]);
+    expect(final.messages[0].toolCalls.map((tc) => tc.name), "the row sits on the text that proposed it").toEqual(["read_file"]);
     expect(ai).not.toContain(WRAP_UP);
 
     // ── Assert: hermeticity ──────────────────────────────────────────────────

package/src/activities/execute-deep-agent/__tests__/hermetic/recursion-limit.test.ts

@@ -14,8 +14,8 @@
  * (matched with `startsWith` by stigmer-cloud's `reply-extractor.ts`) and
  * its row, PERSISTS it, and returns the slim.
  *
- * Ruled at Q-S3-6 and landed at S3 M2a. Until then the orchestrator RETURNED
- * the TERMINATED status but never PERSISTED it (S3 M0 finding F-M0-4, a
+ * The rule landed in #1096. Until then the orchestrator RETURNED
+ * the TERMINATED status but never PERSISTED it (a
  * production defect): the last status the control plane held was the
  * stream's mid-run IN_PROGRESS with no error, and only the activity's return
  * value carried the truth. The golden
@@ -23,18 +23,20 @@
  * TERMINATED status the control plane holds, which is what that fix changed
  * on purpose.
  *
- * Also visible here, F-M0-1 at scale: every tool row of the run sits on ONE
- * empty AI message, because `ensureAiMessageForToolCall("")` creates it once
- * and `currentAiMessage[""]` then catches every later row.
+ * Also visible here, the message boundary at scale (since #1097): every tool
+ * row sits on the "Reading file N." message whose text proposed it. Until
+ * then all of them sat on ONE empty AI message: the namespace miss created the
+ * empty message once and its `currentAiMessage[""]` then caught every later
+ * row.
  *
  * How many rounds fit is the middleware stack's shape, not the knob's
- * (S3 M2b, owner ruling 2026-09-13 on F-M2b-26): LangChain makes every
+ * (ruled 2026-09-13, #1096): LangChain makes every
  * middleware hook its own graph node, and `max_tool_rounds` becomes a
  * super-step budget at the ×6 floor estimate, so a node fewer per round
  * means more rounds within the same 60 steps. When `graceful-stop.ts` (an
- * `afterModel` node) was deleted with Q-S3-3, this golden went from 11 tool
+ * `afterModel` node) was deleted in #1096, this golden went from 11 tool
  * calls to 13 before TERMINATED — the only hunk, the copy unchanged. That the
- * knob counts super-steps and not rounds is recorded as an S5 design item
+ * knob counts super-steps and not rounds is recorded as #1113
  * (a round counter in the budget middleware would make it mean what it
  * says); this file pins what the stack delivers today.
  *
@@ -88,7 +90,7 @@ describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
     env.dispose();
   });
 
-  it("returns TERMINATED with the cross-repo prefix, and persists nothing past IN_PROGRESS (F-M0-4)", async () => {
+  it("returns TERMINATED with the cross-repo prefix, and persists that terminal", async () => {
     // ── Arrange ──────────────────────────────────────────────────────────────
     const record = deepAgentExecutionRecord({ message: "Keep reading files.", maxToolRounds: MIN_TOOL_ROUNDS });
     const scenario = beginDeepAgentScenario({
@@ -113,21 +115,27 @@ describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
     expect(slim.phase).toBe("EXECUTION_TERMINATED");
     expect(String(slim.error).startsWith(TOOL_CALL_LIMIT_ERROR_PREFIX), "the cross-repo prefix").toBe(true);
 
-    // ── Assert: what the control plane holds (F-M0-4 closed) ─────────────────
+    // ── Assert: what the control plane holds ─────────────────────────────────
     expect(record.persistedPhases, "the TERMINATED terminal is persisted").toEqual([
       ExecutionPhase.EXECUTION_IN_PROGRESS,
       ExecutionPhase.EXECUTION_TERMINATED,
     ]);
     const persisted = record.lastFullStatus!;
     expect(String(persisted.error).startsWith(TOOL_CALL_LIMIT_ERROR_PREFIX), "the persisted error carries the prefix").toBe(true);
-    expect(persisted.error, "the event count left the copy (Q-S3-6)").not.toMatch(/\d+ events?/);
+    expect(persisted.error, "the event count left the copy").not.toMatch(/\d+ events?/);
     expect(persisted.completedAt).not.toBe("");
     const rows = record.toolCalls();
     expect(rows.length, "fewer rounds ran than were scripted: the budget stopped the graph").toBeLessThan(SCRIPTED_ROUNDS);
     expect(rows.length).toBeGreaterThanOrEqual(MIN_TOOL_ROUNDS);
+    // The message boundary: every row sits on the message whose text proposed it
+    // — one "Reading file N." message per row, no empty host (before #1097 all
+    // thirteen rows sat on ONE empty message).
     const rowHosts = persisted.messages.filter((m) => m.type === MessageType.MESSAGE_AI && m.toolCalls.length > 0);
-    expect(rowHosts, "F-M0-1: every row on one empty AI message").toHaveLength(1);
-    expect(rowHosts[0].content).toBe("");
+    expect(rowHosts).toHaveLength(rows.length);
+    for (const host of rowHosts) {
+      expect(host.content).toMatch(/^Reading file \d+\.$/);
+      expect(host.toolCalls).toHaveLength(1);
+    }
 
     // ── Assert: hermeticity ──────────────────────────────────────────────────
     expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);

package/src/activities/execute-deep-agent/__tests__/hermetic/resolution-error.test.ts

@@ -12,11 +12,11 @@
  * Temporal retry a deterministic failure). Nothing streamed, no lock taken
  * (the fault precedes the lock phase), no artifacts.
  *
- * The row shape is one of Q-S3-7's ruled alignments, landed at S3 M2a: the
+ * The row shape is one of the alignments #1096 made on purpose: the
  * orchestrator wrote one row `"Error: [Error] <message>"`; the runtime's arm
  * writes the boilerplate plus the details row. `status.error` itself did
  * not move (the conformance suite pins it). The setup labels are the
- * runtime's resolution phases' (a stated default of the M2a plan).
+ * runtime's resolution phases'.
  *
  * Carried from `index.test.ts` ("returns EXECUTION_FAILED status when setup
  * fails", "includes error message in failed status", "always returns a

package/src/activities/execute-deep-agent/__tests__/hermetic/structured-output.test.ts

@@ -13,13 +13,13 @@
  *  2. The text fallback (the runtime's tier 1): the model answers in prose
  *     with a fenced JSON block and `shared/extract-json.ts` recovers the
  *     object from the final text (`run-turn.ts` `extractStructuredOutputFromText`).
- *  3. The LLM fallback (the runtime's tier 2, Q-S3-7): the final text carries
+ *  3. The LLM fallback (the runtime's tier 2): the final text carries
  *     no JSON at all, so the runtime asks a second model — the registry's
  *     economy tier for the primary's provider — to extract it through
  *     `withStructuredOutput` (`shared/extract-structured-output.ts`). Native
- *     gained this arm at S3 M2a, when the turn runtime took the epilogue
- *     over; it is pinned here since M2b (F-M2b-14), where every other ruled
- *     alignment is. Two facts the golden records: the extraction call is a
+ *     gained this arm in #1096, when the turn runtime took the epilogue
+ *     over; it is pinned here, where every other alignment of that move
+ *     is. Two facts the golden records: the extraction call is a
  *     SECOND model build (`maxTokens: 4096`, on the primary — the fixture
  *     registry declares no economy row, `getEconomyModel`'s last resort),
  *     and its tool call never reaches the transcript (it is not a graph
@@ -38,10 +38,10 @@
  * `extract` (`withStructuredOutput` with no name), bound on the extraction
  * model alone, which is how the script tells the two calls apart.
  *
- * Since S3 M2a the activity is the turn runtime over the native adapter, and
+ * Since #1096 the activity is the turn runtime over the native adapter, and
  * `streamingUsage` carries the runtime accountant's fields — `model`,
  * `estimatedCostUsd` priced at the registry's rates, the requested tier and
- * thinking mode (Q-M2a-2: one writer of the summary, the runtime). Nothing
+ * thinking mode (one writer of the summary, the runtime). Nothing
  * else in this golden moved with the flip.
  *
  * Regenerate ONLY after a deliberate behavior change:
@@ -176,7 +176,7 @@ describe("ExecuteDeepAgent hermetic — structured output", () => {
     await expect(json).toMatchFileSnapshot("./goldens/structured-output.text-fallback.status.json");
   });
 
-  it("LLM fallback (tier 2): prose with no JSON is extracted by a second model call the transcript never sees (Q-S3-7)", async () => {
+  it("LLM fallback (tier 2): prose with no JSON is extracted by a second model call the transcript never sees", async () => {
     // ── Arrange ──────────────────────────────────────────────────────────────
     clock.reset();
     // The OSS direct-credential posture, for this arm only: with no proxy the

package/src/activities/execute-deep-agent/__tests__/hermetic/sub-agent-delegation.test.ts

@@ -8,35 +8,51 @@
  * runner's `shell`) on the SAME model double through `modelFactory`; the root
  * proposes `task({ subagent_type, description })`; the tools node runs the
  * sub-agent graph under a nested namespace (`tools:<uuid>|...`); the
- * `SubAgentTracker` opens a `SubAgentExecution` keyed by the `task` call id
- * (not by the namespace uuid, which never reaches the status), routes the
- * nested model events into its own transcript, and closes it COMPLETED when
- * the `task` tool finishes; the root's transcript carries the `task` row and
- * its closing text. The golden (`goldens/sub-agent-delegation.status.json`)
- * pins the nested transcript shape S4 must reproduce.
+ * translator's `sub_agent_started` opens a `SubAgentExecution` keyed by the
+ * `task` call id (not by the namespace uuid, which never reaches the status),
+ * the builder folds the nested model events into that row's own transcript
+ * scope, and `sub_agent_finished` closes it COMPLETED when the `task` tool
+ * finishes; the root's transcript carries the `task` row and its closing
+ * text. The golden (`goldens/sub-agent-delegation.status.json`) pins the
+ * nested transcript shape; its three moves in #1097 are quoted below with
+ * their reasons, and every other line is byte-identical through that PR.
  *
  * Role selection: `createDeepAgent` gives the sub-agent the same tool set as
  * its parent (`task` included), so the script tells the roles apart by the
  * system prompt (`ScriptRoleContext.systemPrompt`), which carries the
  * sub-agent's own instructions — the one thing that differs.
  *
- * Since S3 M2a the activity is the turn runtime over the native adapter, and
+ * Since #1096 the activity is the turn runtime over the native adapter, and
  * `streamingUsage` carries the runtime accountant's fields — `model`,
  * `estimatedCostUsd` priced at the registry's rates, the requested tier and
- * thinking mode (Q-M2a-2: one writer of the summary, the runtime). Nothing
+ * thinking mode (one writer of the summary, the runtime). Nothing
  * else in this golden moved with the flip.
  *
- * Since S3 M2b (Q-M2b-1, owner ruling 2026-09-13) the sub-agent's spend is
+ * Since #1096 (ruled 2026-09-13) the sub-agent's spend is
  * the execution's spend: the helper's one turn (600 in, 12 out) is reported
  * through the same hook as the root's, so `streamingUsage` reads 3,900 in /
  * 102 out / 3 turns where it read 3,300 / 90 / 2, and `estimatedCostUsd`
  * 0.00441 where it read 0.00375 — the helper's 660 micro-dollars at the
- * PARENT's rate (per-sub-agent pricing is an S5 item; the in-graph cost cap
+ * PARENT's rate (per-sub-agent pricing is #1121; the in-graph cost cap
  * this replaces priced sub-agents the same way). The five lines of
  * `streamingUsage` are the whole diff; the transcript and the sub-agent row
  * are byte-identical. `max_cost_usd` is now enforced over this total by the
  * runtime, the one enforcement since the cost middleware became advisory
- * (Q-S3-3).
+ * (#1096).
+ *
+ * Since #1097: deepagents' `task` tool
+ * returns a LangGraph `Command` like `write_todos` does, so the `task` row's
+ * `result` and the sub-agent row's `output` are the nested ToolMessage's
+ * content — `[{"type":"text","text":"The fixture value is forty-two."}]`,
+ * the blocks array the image offload reads — where they were the whole
+ * serialized Command. Those two lines are the whole of that hunk.
+ *
+ * Also since #1097: the `task` row sits on the AI message whose text
+ * delegated ("Delegating to the helper."), not on an empty AI message of its
+ * own after it — two root AI messages (the delegating text with the row, the
+ * closing text) where there were three; the same scoping fix
+ * `tool-call.test.ts` records. And the row carries
+ * `argsPreview`, the one preview rule for every row on every harness.
  *
  * Regenerate ONLY after a deliberate behavior change:
  *   npx vitest run src/activities/execute-deep-agent/__tests__/hermetic -u
@@ -137,9 +153,9 @@ describe("ExecuteDeepAgent hermetic — sub-agent delegation", () => {
     expect(rows.map((tc) => [tc.id, tc.name, tc.status])).toEqual([[TASK_CALL_ID, "task", ToolCallStatus.TOOL_CALL_COMPLETED]]);
     expect(final.messages.filter((m) => m.type === MessageType.MESSAGE_AI).map((m) => m.content)).toEqual([
       "Delegating to the helper.",
-      "",
       ROOT_CLOSING,
     ]);
+    expect(final.messages[0].toolCalls.map((tc) => tc.id), "the task row sits on the text that delegated").toEqual([TASK_CALL_ID]);
 
     // ── Assert: the sub-agent execution ──────────────────────────────────────
     expect(final.subAgentExecutions).toHaveLength(1);

package/src/activities/execute-deep-agent/__tests__/hermetic/tool-call.test.ts

@@ -10,27 +10,27 @@
  * into ONE tool row, and the turn ends COMPLETED. A read-only built-in is never
  * gated (`shared/tool-kind.ts` FILE_READ), so no approval fields are set. The
  * mid-stream persist the tool-call boundary forces (`persist-decision.ts`
- * `contentDirty`) is what the platform-stop arm relies on.
+ * over the builder's `dirty` flag) is what the platform-stop arm relies on.
  *
- * What the golden shows about TODAY's transcript shape, recorded as found
- * (S3 M0 finding F-M0-1; a transcript-shape fact for S4): the row does NOT sit on
- * the AI message that carries the text of the same LLM turn. LangGraph 1.3.2
- * stamps the model's events with namespace `["model_request:<uuid>"]` and the
- * tools node's with `["tools:<uuid>"]`; `V3StatusBuilder.ensureAiMessage`
- * files the text under the raw namespace while `handleToolStarted` looks the
- * parent up under `resolveAgentNamespace(...)`, which strips only `tools:`
- * segments and so resolves to `""` — a miss, and `ensureAiMessageForToolCall`
- * appends an EMPTY AI message for the row. So the transcript is THREE AI
- * messages: the text, an empty one carrying the row, the closing text. The
- * hand-authored fixtures in `v3-event-fixtures.ts` use `namespace: []` and
- * never reached this arm; this golden, on the real graph, does. The golden
- * (`goldens/tool-call.status.json`) is the shape S4's canonical transcript
- * builder is measured against, and the shape any fix must change on purpose.
+ * The transcript shape (since #1097): the row sits on the AI
+ * message whose text proposed it — TWO AI messages, the text carrying the
+ * row and the closing text. Until then it did not (found in #1096):
+ * LangGraph 1.3.2 stamps the model's events with namespace
+ * `["model_request:<uuid>"]` and the tools node's with `["tools:<uuid>"]`, the
+ * builder filed the text under the raw namespace and looked the tool's
+ * parent up under a namespace stripped of `tools:` only — a miss, so the row
+ * rode an EMPTY AI message between the two texts. The fix is not a patch on
+ * the lookup: scope became `subAgentId?` (the root, or one sub-agent) and the
+ * translator resolves it from the namespace, so the builder has one
+ * "current AI message" per scope and that class of miss cannot exist. The
+ * hand-authored fixtures now default to the real namespaces too.
+ * The golden (`goldens/tool-call.status.json`) is the shape any later change
+ * must move on purpose.
  *
- * Since S3 M2a the activity is the turn runtime over the native adapter, and
+ * Since #1096 the activity is the turn runtime over the native adapter, and
  * `streamingUsage` carries the runtime accountant's fields — `model`,
  * `estimatedCostUsd` priced at the registry's rates, the requested tier and
- * thinking mode (Q-M2a-2: one writer of the summary, the runtime). Nothing
+ * thinking mode (one writer of the summary, the runtime). Nothing
  * else in this golden moved with the flip.
  *
  * Regenerate ONLY after a deliberate behavior change:
@@ -134,17 +134,17 @@ describe("ExecuteDeepAgent hermetic — ungated tool call", () => {
     expect(row.result, "the built-in's numbered listing of the seeded file").toContain("A fixture readme.");
     expect(row.requiresApproval, "a read-only built-in is not gated").toBe(false);
 
-    // ── Assert: the transcript, as it is today (F-M0-1 in the header) ────────
+    // ── Assert: the transcript — the row beside the text that proposed it ──
     const final = record.lastFullStatus!;
     const ai = final.messages.filter((m) => m.type === MessageType.MESSAGE_AI);
-    expect(ai.map((m) => m.content), "text, an EMPTY message carrying the row, closing text").toEqual([
+    expect(ai.map((m) => m.content), "the proposing text, then the closing text").toEqual([
       "Let me read it.",
-      "",
       ASSISTANT_TEXT,
     ]);
-    expect(ai[1].toolCalls.map((tc) => tc.id), "the row sits on the empty message, not beside its text").toEqual([
+    expect(ai[0].toolCalls.map((tc) => tc.id), "the row sits on the message whose text proposed it").toEqual([
       CALL_ID,
     ]);
+    expect(ai[1].toolCalls).toHaveLength(0);
     expect(final.streamingUsage?.turnCount).toBe(2);
 
     // ── Assert: hermeticity ──────────────────────────────────────────────────

package/src/activities/execute-deep-agent/__tests__/hermetic/workspace-lock-timeout.test.ts

@@ -11,7 +11,7 @@
  * and one system row, persists ONCE, and returns — a Temporal retry would only
  * queue behind the same holder.
  *
- * The order, ruled at Q-S3-8 and landed at S3 M2a: the runtime takes the
+ * The order, since #1096: the runtime takes the
  * lock right after provisioning the workspace, BEFORE the tool surface, the
  * skills, the attachments and the graph — so a turn that cannot have the
  * tree builds no model and compiles no sub-agent. Until then the
@@ -21,8 +21,8 @@
  * appear, because the turn ends before the adapter runs.
  *
  * Why this is the one terminal arm WITHOUT a file golden (owner ruling,
- * 2026-09-11, entry 20260911.03 M0; carried for native): the wire copy embeds
- * the absolute workspace path, a per-run temp directory. The S0 rule is to
+ * 2026-09-11, #1070; carried for native): the wire copy embeds
+ * the absolute workspace path, a per-run temp directory. The hermetic rule (#1048) is to
  * control a volatile source at its origin or escalate — never redact — so
  * this scenario pins every byte the path does not touch with explicit
  * assertions and builds the expected message with the SAME error class over
@@ -136,11 +136,11 @@ describe("ExecuteDeepAgent hermetic — workspace lock timeout", () => {
         "Provisioning workspace",
         "Waiting for workspace — in use by another session",
       ]);
-      expect(recordedModelBuilds(), "no model is built for a turn that cannot have the tree (Q-S3-8)").toHaveLength(0);
+      expect(recordedModelBuilds(), "no model is built for a turn that cannot have the tree").toHaveLength(0);
 
       // ── Assert: hermeticity ────────────────────────────────────────────────
       expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
-      // The runtime's heartbeat posture (Q-S3-8, parent Q8): every resolution
+      // The runtime's heartbeat posture: every resolution
       // phase pulses on entry and the terminal write pulses once, so a turn
       // that ends at the lock has heartbeated before any stream existed.
       expect(invocation.heartbeats.length, "the runtime heartbeats through resolution").toBeGreaterThan(0);