@stigmer/runner 3.40.0 → 3.41.0

package/src/activities/execute-deep-agent/__tests__/hermetic/file-review-capture.test.ts

@@ -27,6 +27,10 @@
  * a status the host could reach), and `goldens/file-review-capture.status.json`
  * pins the whole ledger beside Cursor's.
  *
+ * Golden hunk since #1443: the inline artifact's `createdAt` is t=1, the
+ * edit's finish, where it was t=2, the moment the publisher's upload
+ * returned (it reads the clock before its first await now).
+ *
  * Parent phase rows exercised beyond the plain arms: a `local_path` workspace
  * entry (mounted as-is in local mode, the agent rooted at the entry per
  * `provisionWorkspace`); capture-mode derivation on a git tree; the baseline

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/file-review-capture.status.json

@@ -40,7 +40,7 @@
       "kind": "EXECUTION_ARTIFACT_KIND_FILE",
       "sizeBytes": "22",
       "storageKey": "artifacts/aex_hermetic_0001/notes.md",
-      "createdAt": "2026-01-01T00:00:02.000Z",
+      "createdAt": "2026-01-01T00:00:01.000Z",
       "contentHash": "e4cdd09e8ca79e376a6ec5766d190754bc8ee4a2d6c5c7f4d86a9dc7fdf25a0f"
     }
   ],

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/inline-artifact.turn1.status.json

@@ -57,7 +57,7 @@
       "kind": "EXECUTION_ARTIFACT_KIND_FILE",
       "sizeBytes": "32",
       "storageKey": "artifacts/aex_hermetic_0001/report.md",
-      "createdAt": "2026-01-01T00:00:02.000Z",
+      "createdAt": "2026-01-01T00:00:01.000Z",
       "contentHash": "62eae4d09b2b051cf4ac5aa1fd70847b34c47994a1732ff999f47749e71b0441"
     }
   ],

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/inline-artifact.turn2.status.json

@@ -67,7 +67,7 @@
       "kind": "EXECUTION_ARTIFACT_KIND_FILE",
       "sizeBytes": "32",
       "storageKey": "artifacts/aex_hermetic_0001/report.md",
-      "createdAt": "2026-01-01T00:00:02.000Z",
+      "createdAt": "2026-01-01T00:00:01.000Z",
       "contentHash": "62eae4d09b2b051cf4ac5aa1fd70847b34c47994a1732ff999f47749e71b0441"
     }
   ],

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/recursion-limit.persisted.status.json

@@ -200,89 +200,24 @@
         }
       ]
     },
-    {
-      "type": "MESSAGE_AI",
-      "content": "Reading file 10.",
-      "timestamp": "2026-01-01T00:00:11.000Z",
-      "toolCalls": [
-        {
-          "id": "call-hermetic-loop-0010",
-          "name": "read_file",
-          "args": {
-            "file_path": "/f10.md"
-          },
-          "result": "[{\"type\":\"text\",\"text\":\"Error: File '/f10.md' not found\"}]",
-          "status": "TOOL_CALL_COMPLETED",
-          "startedAt": "2026-01-01T00:00:11.000Z",
-          "completedAt": "2026-01-01T00:00:11.000Z",
-          "argsPreview": "{\"file_path\":\"/f10.md\"}",
-          "toolKind": "TOOL_KIND_FILE_READ"
-        }
-      ]
-    },
-    {
-      "type": "MESSAGE_AI",
-      "content": "Reading file 11.",
-      "timestamp": "2026-01-01T00:00:12.000Z",
-      "toolCalls": [
-        {
-          "id": "call-hermetic-loop-0011",
-          "name": "read_file",
-          "args": {
-            "file_path": "/f11.md"
-          },
-          "result": "[{\"type\":\"text\",\"text\":\"Error: File '/f11.md' not found\"}]",
-          "status": "TOOL_CALL_COMPLETED",
-          "startedAt": "2026-01-01T00:00:12.000Z",
-          "completedAt": "2026-01-01T00:00:12.000Z",
-          "argsPreview": "{\"file_path\":\"/f11.md\"}",
-          "toolKind": "TOOL_KIND_FILE_READ"
-        }
-      ]
-    },
-    {
-      "type": "MESSAGE_AI",
-      "content": "Reading file 12.",
-      "timestamp": "2026-01-01T00:00:13.000Z",
-      "toolCalls": [
-        {
-          "id": "call-hermetic-loop-0012",
-          "name": "read_file",
-          "args": {
-            "file_path": "/f12.md"
-          },
-          "result": "[{\"type\":\"text\",\"text\":\"Error: File '/f12.md' not found\"}]",
-          "status": "TOOL_CALL_COMPLETED",
-          "startedAt": "2026-01-01T00:00:13.000Z",
-          "completedAt": "2026-01-01T00:00:13.000Z",
-          "argsPreview": "{\"file_path\":\"/f12.md\"}",
-          "toolKind": "TOOL_KIND_FILE_READ"
-        }
-      ]
-    },
-    {
-      "type": "MESSAGE_AI",
-      "content": "Reading file 13.",
-      "timestamp": "2026-01-01T00:00:14.000Z"
-    },
     {
       "type": "MESSAGE_SYSTEM",
       "content": "The agent reached the tool-call limit for this message. Work completed so far has been saved. Send another message to continue where the agent left off.",
-      "timestamp": "2026-01-01T00:00:14.000Z"
+      "timestamp": "2026-01-01T00:00:10.000Z"
     }
   ],
   "phase": "EXECUTION_TERMINATED",
   "error": "Agent reached the tool-call limit for this message. Send another message to continue.",
   "startedAt": "2026-01-01T00:00:00.000Z",
-  "completedAt": "2026-01-01T00:00:14.000Z",
+  "completedAt": "2026-01-01T00:00:10.000Z",
   "streamingUsage": {
-    "inputTokens": "14000",
-    "outputTokens": "280",
-    "totalTokens": "14280",
-    "turnCount": 14,
-    "estimatedCostUsd": 0.015400000000000002,
+    "inputTokens": "10000",
+    "outputTokens": "200",
+    "totalTokens": "10200",
+    "turnCount": 10,
+    "estimatedCostUsd": 0.011000000000000001,
     "model": "claude-haiku-4.5",
-    "observedAt": "2026-01-01T00:00:14.000Z",
+    "observedAt": "2026-01-01T00:00:10.000Z",
     "requestedServiceTier": "SERVICE_TIER_STANDARD",
     "requestedThinkingMode": "THINKING_MODE_DISABLED"
   },

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/resolution-error.status.json

@@ -12,7 +12,7 @@
     }
   ],
   "phase": "EXECUTION_FAILED",
-  "error": "Execution failed: [Error] hermetic fault injected at getAgent",
+  "error": "[Error] hermetic fault injected at getAgent",
   "startedAt": "2026-01-01T00:00:00.000Z",
   "completedAt": "2026-01-01T00:00:00.000Z"
 }

package/src/activities/execute-deep-agent/__tests__/hermetic/inline-artifact-across-gate.test.ts

@@ -24,6 +24,11 @@
  * this pair of goldens (`inline-artifact.turn1`, `inline-artifact.turn2`) is
  * what proves it did.
  *
+ * Turn 2 completes, so its post-stream safety net walks the seeded history
+ * and asks for `report.md` again. The publisher re-reads it, finds the bytes
+ * the seeded row lists, and uploads nothing: the store sees turn 1's write
+ * only (stigmer/stigmer#1448).
+ *
  * Also recorded (a shape fact, as found): the write's tool row
  * shows `requiresApproval: true` with `approvalPolicySource` BUILTIN_CATEGORY
  * — the category policy's verdict — while the row is COMPLETED because
@@ -50,6 +55,12 @@
  * to persist "0 files" beside a one-file change set. The runtime now
  * refreshes the strip on every write, the terminal one included.
  *
+ * Golden hunk since #1443, in both goldens: the artifact's `createdAt` is
+ * t=1, the write's finish, where it was t=2. The publisher read the clock
+ * after its upload, which runs beside the stream, so the stamp landed on
+ * either side of the next model turn's tick and flaked under the full
+ * suite; it reads the clock before its first await now.
+ *
  * Regenerate ONLY after a deliberate behavior change:
  *   npx vitest run src/activities/execute-deep-agent/__tests__/hermetic -u
  */
@@ -88,6 +99,7 @@ import {
   runDeepAgentTurn,
 } from "../../__test-utils__/hermetic-deep-agent.js";
 import { CLOSING_TURN, EXECUTE_CALL_A } from "../../__test-utils__/hitl-script.js";
+import { LocalArtifactStorage } from "../../../../shared/artifact-storage.js";
 
 const REPORT = "report.md";
 const REPORT_BODY = "# Report\n\nAll fixtures nominal.\n";
@@ -148,6 +160,7 @@ describe("ExecuteDeepAgent hermetic — inline artifact across a gate (sqlite)",
     expect(existsSync(join(env.artifactPath, run1.artifacts[0].storageKey)), "the bytes reached the store").toBe(true);
     const writeRow = record.toolCalls().find((tc) => tc.id === WRITE_CALL_ID)!;
     expect(writeRow.status, "capture mode let the write flow").toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(run1.artifacts[0].createdAt, "the artifact is stamped at its write's finish").toBe(writeRow.completedAt);
     expect(record.waitingToolCalls().map((tc) => tc.id)).toEqual([EXECUTE_CALL_A.id]);
     await expect(statusJson(run1)).toMatchFileSnapshot("./goldens/inline-artifact.turn1.status.json");
 
@@ -155,13 +168,17 @@ describe("ExecuteDeepAgent hermetic — inline artifact across a gate (sqlite)",
     expect(record.decideWaitingToolCalls(ApprovalAction.APPROVE, DECIDED_AT)).toBe(1);
 
     // ── Turn 2 ───────────────────────────────────────────────────────────────
+    const uploads = vi.spyOn(LocalArtifactStorage.prototype, "upload");
     const turn2 = await runDeepAgentTurn(scenario, { turnSeq: 1 });
+    const turn2Keys = uploads.mock.calls.map(([key]) => key);
+    uploads.mockRestore();
     expect(turn2.outcome.kind).toBe("returned");
     expect((turn2.outcome as { value: Record<string, unknown> }).value.phase).toBe("EXECUTION_COMPLETED");
     const final = record.lastFullStatus!;
     expect(final.artifacts.map((a) => [a.name, a.storageKey, a.contentHash]), "the seed carried the artifact").toEqual(
       run1.artifacts.map((a) => [a.name, a.storageKey, a.contentHash]),
     );
+    expect(turn2Keys, "turn 2 does not upload the unchanged report again").not.toContain(run1.artifacts[0].storageKey);
     expect(final.messages.flatMap((m) => m.toolCalls).map((tc) => [tc.id, tc.status])).toEqual([
       [WRITE_CALL_ID, ToolCallStatus.TOOL_CALL_COMPLETED],
       [EXECUTE_CALL_A.id, ToolCallStatus.TOOL_CALL_COMPLETED],

package/src/activities/execute-deep-agent/__tests__/hermetic/recursion-limit.test.ts

@@ -3,13 +3,15 @@
  * model that keeps calling tools.
  *
  * What the arm does: `max_tool_rounds = 10` (the clamp floor,
- * `shared/tool-rounds.ts` MIN_TOOL_ROUNDS) becomes LangGraph's
- * `recursionLimit = 60` (SUPER_STEPS_PER_ROUND); the script proposes a
- * DISTINCT `read_file` every round (distinct ids and paths, so the
- * loop-detection middleware's "repetitive pattern" warning does not end the
- * run first); the graph throws `GraphRecursionError`; the adapter's turn
- * classifies it as the `tool_call_limit` outcome (`shared/tool-rounds.ts`
- * `isGraphRecursionError`), and the runtime's `toolCallLimitArm` writes
+ * `shared/tool-rounds.ts` MIN_TOOL_ROUNDS) is the execution budget
+ * middleware's round limit; the script proposes a DISTINCT `read_file` every
+ * round (distinct ids and paths, so the loop-detection middleware's
+ * "repetitive pattern" warning does not end the run first); after round 10's
+ * results the middleware throws `ToolRoundLimitError` in place of round 11's
+ * model call; the adapter's turn classifies it, through LangChain's
+ * `MiddlewareError` wrapping, as the `tool_call_limit` outcome
+ * (`shared/tool-rounds.ts` `isToolCallBudgetStop`), and the runtime's
+ * `toolCallLimitArm` writes
  * TERMINATED with the cross-repo prefix `TOOL_CALL_LIMIT_ERROR_PREFIX`
  * (matched with `startsWith` by stigmer-cloud's `reply-extractor.ts`) and
  * its row, PERSISTS it, and returns the slim.
@@ -29,16 +31,26 @@
  * empty message once and its `currentAiMessage[""]` then caught every later
  * row.
  *
- * How many rounds fit is the middleware stack's shape, not the knob's
- * (ruled 2026-09-13, #1096): LangChain makes every
- * middleware hook its own graph node, and `max_tool_rounds` becomes a
- * super-step budget at the ×6 floor estimate, so a node fewer per round
- * means more rounds within the same 60 steps. When `graceful-stop.ts` (an
- * `afterModel` node) was deleted in #1096, this golden went from 11 tool
- * calls to 13 before TERMINATED — the only hunk, the copy unchanged. That the
- * knob counts super-steps and not rounds is recorded as #1113
- * (a round counter in the budget middleware would make it mean what it
- * says); this file pins what the stack delivers today.
+ * How many rounds run is the knob's, exactly (#1113): TEN tool rows, on any
+ * middleware stack. Until #1113 the knob was LangGraph's recursion limit at
+ * 10 × 6 super-steps, and since LangChain makes every middleware hook its own
+ * graph node, the rows moved with the stack: 11 until #1096 deleted
+ * `graceful-stop.ts` (an `afterModel` node), 13 after it. #1113 moved this
+ * golden from 13 rows to 10, the copy unchanged. It also dropped the golden's
+ * last AI message, "Reading file 13.": the step limit had cut that fourteenth
+ * model call's proposal before its tool ran, so the transcript ended on a
+ * call that never executed. The round stop replaces the model call instead,
+ * so the transcript ends on round 10's results, and usage counts ten model
+ * calls, not fourteen.
+ *
+ * The second arm is the copy's promise, "send another message to continue":
+ * on the durable (`sqlite`) checkpointer, a follow-up message on the same
+ * thread starts from the checkpoint the stop left. The stop is a throw inside
+ * the model node rather than a limit between super-steps, so this is proven,
+ * not assumed: the follow-up's first model turn sees all ten rounds in its
+ * transcript (the scripted model indexes its script by the rounds the
+ * transcript holds), the run completes, and the budget is the new message's
+ * own.
  *
  * Regenerate ONLY after a deliberate behavior change:
  *   npx vitest run src/activities/execute-deep-agent/__tests__/hermetic -u
@@ -65,14 +77,25 @@ import { stubRegistryFetch } from "../../../../__test-utils__/model-registry-fix
 import { MIN_TOOL_ROUNDS } from "../../../../shared/tool-rounds.js";
 import {
   beginDeepAgentScenario,
+  continueDeepAgentScenario,
   deepAgentExecutionRecord,
   runDeepAgentTurn,
 } from "../../__test-utils__/hermetic-deep-agent.js";
+import type { ScriptedTurn } from "../../__test-utils__/scripted-model.js";
 import { TOOL_CALL_LIMIT_ERROR_PREFIX } from "../../../../shared/tool-rounds.js";
 
 /** More rounds than the budget allows; the graph stops the script, not the other way round. */
 const SCRIPTED_ROUNDS = 40;
 
+/** The model that keeps calling tools: a distinct `read_file` per round. */
+function readingRounds(): ScriptedTurn[] {
+  return Array.from({ length: SCRIPTED_ROUNDS }, (_, i) => ({
+    text: `Reading file ${i}.`,
+    toolCalls: [{ id: `call-hermetic-loop-${String(i).padStart(4, "0")}`, name: "read_file", args: { file_path: `/f${i}.md` } }],
+    usage: { inputTokens: 1_000, outputTokens: 20 },
+  }));
+}
+
 describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
   let env: HermeticEnvironment;
   let registry: ReturnType<typeof stubRegistryFetch>;
@@ -97,13 +120,7 @@ describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
       env,
       clock,
       record,
-      script: () => ({
-        turns: Array.from({ length: SCRIPTED_ROUNDS }, (_, i) => ({
-          text: `Reading file ${i}.`,
-          toolCalls: [{ id: `call-hermetic-loop-${String(i).padStart(4, "0")}`, name: "read_file", args: { file_path: `/f${i}.md` } }],
-          usage: { inputTokens: 1_000, outputTokens: 20 },
-        })),
-      }),
+      script: () => ({ turns: readingRounds() }),
     });
 
     // ── Act ──────────────────────────────────────────────────────────────────
@@ -125,8 +142,7 @@ describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
     expect(persisted.error, "the event count left the copy").not.toMatch(/\d+ events?/);
     expect(persisted.completedAt).not.toBe("");
     const rows = record.toolCalls();
-    expect(rows.length, "fewer rounds ran than were scripted: the budget stopped the graph").toBeLessThan(SCRIPTED_ROUNDS);
-    expect(rows.length).toBeGreaterThanOrEqual(MIN_TOOL_ROUNDS);
+    expect(rows.length, "exactly max_tool_rounds rounds ran: the budget counts rounds, not graph steps").toBe(MIN_TOOL_ROUNDS);
     // The message boundary: every row sits on the message whose text proposed it
     // — one "Reading file N." message per row, no empty host (before #1097 all
     // thirteen rows sat on ONE empty message).
@@ -144,4 +160,48 @@ describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
     const json = JSON.stringify(toJson(AgentExecutionStatusSchema, persisted), null, 2) + "\n";
     await expect(json).toMatchFileSnapshot("./goldens/recursion-limit.persisted.status.json");
   });
+
+  it("continues on the next message from the checkpoint the stop left (sqlite)", async () => {
+    // ── Arrange: the first message exhausts its budget ───────────────────────
+    const first = beginDeepAgentScenario({
+      env,
+      clock,
+      record: deepAgentExecutionRecord({ message: "Keep reading files.", maxToolRounds: MIN_TOOL_ROUNDS }),
+      checkpointer: "sqlite",
+      script: () => ({ turns: readingRounds() }),
+    });
+    await runDeepAgentTurn(first);
+    expect(first.record.lastFullStatus!.phase).toBe(ExecutionPhase.EXECUTION_TERMINATED);
+    expect(first.record.toolCalls()).toHaveLength(MIN_TOOL_ROUNDS);
+
+    // The follow-up's script is indexed by the rounds its transcript holds: a
+    // model that saw the ten rounds answers in text; one that lost them would
+    // play turn 0 and read a file.
+    const LOST_THREAD: ScriptedTurn = {
+      text: "Starting over.",
+      toolCalls: [{ id: "call-hermetic-lost-thread", name: "read_file", args: { file_path: "/lost.md" } }],
+    };
+    const PICKED_UP: ScriptedTurn = { text: "Picking up where I left off: all ten files are read." };
+    const roundsSeen: number[] = [];
+    const record = deepAgentExecutionRecord({ message: "Continue.", maxToolRounds: MIN_TOOL_ROUNDS });
+    const next = continueDeepAgentScenario(first, {
+      record,
+      script: () => ({ turns: [...Array.from({ length: MIN_TOOL_ROUNDS }, () => LOST_THREAD), PICKED_UP] }),
+      onTurn: (info) => {
+        roundsSeen.push(info.round);
+      },
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runDeepAgentTurn(next);
+
+    // ── Assert ───────────────────────────────────────────────────────────────
+    expect(invocation.outcome.kind).toBe("returned");
+    expect(roundsSeen, "the follow-up's one model turn saw the ten rounds the stop checkpointed").toEqual([MIN_TOOL_ROUNDS]);
+    expect(record.persistedPhases).toEqual([ExecutionPhase.EXECUTION_IN_PROGRESS, ExecutionPhase.EXECUTION_COMPLETED]);
+    const persisted = record.lastFullStatus!;
+    expect(persisted.error).toBe("");
+    const answer = persisted.messages.filter((m) => m.type === MessageType.MESSAGE_AI).at(-1);
+    expect(answer?.content).toBe(PICKED_UP.text);
+  });
 });

package/src/activities/execute-deep-agent/__tests__/hermetic/resolution-error.test.ts

@@ -5,7 +5,7 @@
  * Invariant pinned: the runtime's blueprint phase throws, the runtime's
  * catch takes its generic-error arm (`terminal-table.ts` `unexpectedErrorArm`),
  * persists ONE EXECUTION_FAILED status carrying
- * `status.error = "Execution failed: [Error] <message>"` and two system rows
+ * `status.error = "[Error] <message>"` and two system rows
  * — the boilerplate "Internal system error occurred. Please contact support
  * if this issue persists." and `"Error details: [Error] <message>"` — and
  * RETURNS the slim status (the workflow reads the phase; a throw would make
@@ -14,10 +14,14 @@
  *
  * The row shape is one of the alignments #1096 made on purpose: the
  * orchestrator wrote one row `"Error: [Error] <message>"`; the runtime's arm
- * writes the boilerplate plus the details row. `status.error` itself did
- * not move (the conformance suite pins it). The setup labels are the
+ * writes the boilerplate plus the details row. The setup labels are the
  * runtime's resolution phases'.
  *
+ * Golden hunk since stigmer#1122: `status.error` is `[Error] <message>`, the
+ * details row's text, where it was `Execution failed: [Error] <message>`.
+ * This arm alone framed the error; every other FAILED arm, and this
+ * harness's own thrown-turn classification, writes the failure unframed.
+ *
  * Carried from `index.test.ts` ("returns EXECUTION_FAILED status when setup
  * fails", "includes error message in failed status", "always returns a
  * serializable result").
@@ -70,7 +74,7 @@ describe("ExecuteDeepAgent hermetic — resolution error", () => {
     env.dispose();
   });
 
-  it("fails with the fault's message in status.error and one system row, and returns", async () => {
+  it("fails with the fault's message in status.error and two system rows, and returns", async () => {
     // ── Arrange ──────────────────────────────────────────────────────────────
     const record = deepAgentExecutionRecord({ message: "Never reaches a model." });
     const scenario = beginDeepAgentScenario({
@@ -101,7 +105,7 @@ describe("ExecuteDeepAgent hermetic — resolution error", () => {
 
     // ── Assert: the copy ─────────────────────────────────────────────────────
     const final = record.lastFullStatus!;
-    expect(final.error).toBe(`Execution failed: [Error] ${CONTROL_PLANE_FAULT}`);
+    expect(final.error).toBe(`[Error] ${CONTROL_PLANE_FAULT}`);
     expect(final.messages.filter((m) => m.type === MessageType.MESSAGE_SYSTEM).map((m) => m.content)).toEqual([
       "Internal system error occurred. Please contact support if this issue persists.",
       `Error details: [Error] ${CONTROL_PLANE_FAULT}`,

package/src/activities/execute-deep-agent/__tests__/hermetic/thrown-turn-drains-publishes.test.ts

@@ -0,0 +1,159 @@
+/**
+ * Hermetic: a THROWN TURN still carries every artifact it published — the
+ * native harness drains its in-flight inline publishes before the runtime
+ * writes the terminal status (stigmer#1116).
+ *
+ * The model writes a report in round one (`write_file`), and
+ * `streaming-side-effects.ts` hands the path to `InlinePublisher`, whose
+ * upload runs beside the stream. Round two's model call fails mid-stream
+ * (the scripted model's `fail` ending: a provider error), so the turn never
+ * reaches its settle — the one place that used to drain the publishes. The
+ * adapter classifies the throw as `failed`, and the runtime writes the
+ * turn's terminal status as soon as the adapter returns. The report is an
+ * edit on the tree, and the hermetic environment runs in capture mode (it
+ * carries artifact storage, as every hosted runner does), so that status is
+ * the file review's WAITING_FOR_APPROVAL with the failure's rows riding it
+ * and its phase deferred (`terminal-table.ts` `awaitingReviewArm`): the
+ * production shape of this fault.
+ *
+ * The order is made deterministic, not left to I/O timing: the upload is
+ * held until the turn asks for its publishes to drain, or until the
+ * activity has returned, whichever comes first. With the drain on the
+ * turn's every exit, the drain asks first and the artifact is on the
+ * persisted status. Without it the activity returns first, the upload
+ * lands afterwards on a status nobody persists again, and the assertion on
+ * the persisted artifacts fails — the defect this pins.
+ */
+
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase, MessageType } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+vi.mock("../../../../shared/model-client.js", async () =>
+  (await import("../../__test-utils__/scripted-model-module.js")).scriptedModelClientModule(),
+);
+vi.mock("../../../../client/stigmer-client.js", async () =>
+  (await import("../../../../__test-utils__/hermetic-activity.js")).hermeticStigmerClientModule(),
+);
+
+import {
+  ScriptedClock,
+  createHermeticEnvironment,
+  type HermeticEnvironment,
+} from "../../../../__test-utils__/hermetic-activity.js";
+import { stubRegistryFetch } from "../../../../__test-utils__/model-registry-fixture.js";
+import {
+  FIXTURE,
+  beginDeepAgentScenario,
+  deepAgentExecutionRecord,
+  runDeepAgentTurn,
+} from "../../__test-utils__/hermetic-deep-agent.js";
+import { LocalArtifactStorage } from "../../../../shared/artifact-storage.js";
+import { StreamingSideEffects } from "../../streaming-side-effects.js";
+import { TERMINAL_COPY } from "../../../../harness/terminal-table.js";
+
+const REPORT = "report.md";
+const REPORT_BODY = "# Report\n\nWritten before the provider failed.\n";
+const WRITE_CALL_ID = "call-hermetic-write-0001";
+const PROVIDER_FAULT = "provider stream failed mid-turn";
+
+function systemMessages(status: AgentExecutionStatus): string[] {
+  return status.messages.filter((m) => m.type === MessageType.MESSAGE_SYSTEM).map((m) => m.content);
+}
+
+describe("ExecuteDeepAgent hermetic — a thrown turn drains its inline publishes", () => {
+  let env: HermeticEnvironment;
+  let registry: ReturnType<typeof stubRegistryFetch>;
+  const clock = new ScriptedClock();
+
+  beforeAll(() => {
+    env = createHermeticEnvironment();
+    registry = stubRegistryFetch();
+    clock.install();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  afterAll(() => {
+    clock.uninstall();
+    registry.restore();
+    env.dispose();
+  });
+
+  it("persists the turn's end with the artifact it published before the model call threw", async () => {
+    // ── Arrange ──────────────────────────────────────────────────────────────
+    const record = deepAgentExecutionRecord({ message: "Write the report." });
+    const scenario = beginDeepAgentScenario({
+      env,
+      clock,
+      record,
+      script: () => ({
+        turns: [
+          {
+            text: "Writing the report.",
+            toolCalls: [{ id: WRITE_CALL_ID, name: "write_file", args: { file_path: `/${REPORT}`, content: REPORT_BODY } }],
+            usage: { inputTokens: 1_300, outputTokens: 60 },
+          },
+          { text: "Now summarising", ends: { kind: "fail", error: new Error(PROVIDER_FAULT) } },
+        ],
+      }),
+    });
+
+    // The artifact's upload waits on `held`; the first of "the turn drains"
+    // and "the activity returned" releases it (the header's deterministic
+    // order). Capture mode's own blobs share the store and are never held:
+    // the runtime writes them after the adapter returns.
+    const artifactKey = `artifacts/${FIXTURE.executionId}/${REPORT}`;
+    let release = (): void => undefined;
+    const held = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const upload = LocalArtifactStorage.prototype.upload;
+    const uploads = vi.spyOn(LocalArtifactStorage.prototype, "upload").mockImplementation(async function (
+      this: LocalArtifactStorage,
+      ...args: Parameters<LocalArtifactStorage["upload"]>
+    ) {
+      if (args[0] === artifactKey) await held;
+      return upload.apply(this, args);
+    });
+    const drain = StreamingSideEffects.prototype.drainPublishes;
+    const drains = vi.spyOn(StreamingSideEffects.prototype, "drainPublishes").mockImplementation(async function (
+      this: StreamingSideEffects,
+    ) {
+      release();
+      return drain.apply(this);
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runDeepAgentTurn(scenario);
+    release();
+
+    // ── Assert: the turn failed, deferred behind the review, and returned ────
+    expect(invocation.outcome.kind, "a provider failure RETURNS the status").toBe("returned");
+    const final = record.lastFullStatus!;
+    expect(final.phase, "the edit reaches review before the failure settles").toBe(
+      ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+    );
+    expect(final.error, "a deferred terminal writes no error yet").toBe("");
+    expect(systemMessages(final), "the failure's rows ride the review").toEqual([
+      TERMINAL_COPY.internalFailure.row,
+      `Error details: [Error] ${PROVIDER_FAULT}`,
+    ]);
+
+    // ── Assert: the artifact reached the terminal status ─────────────────────
+    expect(
+      uploads.mock.calls.map(([key]) => key).filter((key) => key === artifactKey),
+      "the write was published inline, once",
+    ).toHaveLength(1);
+    expect(final.artifacts.map((a) => [a.name, a.storageKey])).toEqual([[REPORT, artifactKey]]);
+    expect(drains, "the thrown turn drained its publishes").toHaveBeenCalled();
+    expect(existsSync(join(env.artifactPath, final.artifacts[0].storageKey)), "the bytes reached the store").toBe(true);
+
+    // ── Assert: hermeticity ──────────────────────────────────────────────────
+    expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
+  });
+});