@stigmer/runner 3.40.0 → 3.41.0

package/src/harness/transcript/__tests__/builder.test.ts

@@ -19,10 +19,13 @@
  * rows, finalize, artifacts and write-backs, the dirty flag, the error
  * guard — joined commit by commit in the same PR. The observer arm (the
  * runtime's fold-watcher: told after the fold, guarded apart from the
- * handlers, silent on seed) joined with the turn timeline.
+ * handlers, silent on seed) joined with the turn timeline. The
+ * one-observation arms (`applyObservation`: one clock read for every stamp a
+ * raw event's facts make) joined with stigmer#1390, whose Cursor flake they
+ * make deterministic by moving the clock between folds.
  */
 
-import { describe, it, expect } from "vitest";
+import { afterEach, beforeEach, describe, it, expect, vi } from "vitest";
 import { create } from "@bufbuild/protobuf";
 import { type AgentExecutionStatus, AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
@@ -124,21 +127,18 @@ describe("TranscriptBuilder — tool_finished and tool_error are upserts", () =>
     expect(row.error).toBe("EACCES");
   });
 
-  it("a gated row's error stamps approvalRequestedAt once — the boundary's shape (Cursor)", () => {
-    const { sb, status } = feed(builder(), [
+  it("an error alone writes no approval fact — a denied call is an ordinary failure until a proposal parks it (#1117)", () => {
+    const { status } = feed(builder(), [
       { kind: "message_start", runId: "run-1" },
       { kind: "text_delta", runId: "run-1", text: "Running the build." },
-      { kind: "tool_started", callId: "sh-1", name: "Shell", input: { command: "make" }, mcpServerSlug: "", gate: { message: "Run command: make" } },
+      { kind: "tool_started", callId: "sh-1", name: "Shell", input: { command: "make" }, mcpServerSlug: "", provenance: "builtin_category" },
       { kind: "tool_error", callId: "sh-1", message: "Blocked by hook" },
     ]);
     const row = rowOf(status, "sh-1");
-    expect(row.requiresApproval).toBe(true);
-    expect(row.approvalMessage).toBe("Run command: make");
     expect(row.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
-    const stamped = row.approvalRequestedAt;
-    expect(stamped).toContain("T");
-    sb.apply({ kind: "tool_error", callId: "sh-1", message: "again" });
-    expect(rowOf(status, "sh-1").approvalRequestedAt, "stamped once").toBe(stamped);
+    expect(row.requiresApproval).toBe(false);
+    expect(row.approvalMessage).toBe("");
+    expect(row.approvalRequestedAt).toBe("");
   });
 
   it("an ungated row's error stamps no approvalRequestedAt", () => {
@@ -152,12 +152,11 @@ describe("TranscriptBuilder — tool_finished and tool_error are upserts", () =>
       { kind: "tool_finished", callId: "obs-1", result: "", observedAt: "2026-01-01T00:00:07.000Z" },
     ]);
     expect(rowOf(status, "obs-1").completedAt, "the delta's own instant").toBe("2026-01-01T00:00:07.000Z");
-    sb.apply({ kind: "tool_started", callId: "obs-2", name: "Shell", input: { command: "make" }, mcpServerSlug: "", gate: { message: "Run command: make" } });
+    sb.apply({ kind: "tool_started", callId: "obs-2", name: "Shell", input: { command: "make" }, mcpServerSlug: "" });
     sb.apply({ kind: "tool_error", callId: "obs-2", message: "", observedAt: "2026-01-01T00:00:09.000Z" });
-    const gated = rowOf(status, "obs-2");
-    expect(gated.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
-    expect(gated.completedAt).toBe("2026-01-01T00:00:09.000Z");
-    expect(gated.approvalRequestedAt, "the gate's stamp shares the observed instant").toBe("2026-01-01T00:00:09.000Z");
+    const failed = rowOf(status, "obs-2");
+    expect(failed.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+    expect(failed.completedAt).toBe("2026-01-01T00:00:09.000Z");
     // The stream's own error, arriving later with the text, fills the message
     // and moves no stamp.
     sb.apply({ kind: "tool_error", callId: "obs-2", message: "blocked" });
@@ -174,6 +173,75 @@ describe("TranscriptBuilder — tool_finished and tool_error are upserts", () =>
   });
 });
 
+describe("TranscriptBuilder — one observation is folded at one instant", () => {
+  const T0 = "2026-01-01T00:00:00.000Z";
+
+  // The clock moves 1 ms after every fold, so any stamp that read it twice
+  // within one observation would show two instants.
+  function ticking(): Fold {
+    const status = create(AgentExecutionStatusSchema, {});
+    return { sb: new TranscriptBuilder("exec-instant", status, () => vi.advanceTimersByTime(1)), status };
+  }
+
+  beforeEach(() => {
+    vi.useFakeTimers({ toFake: ["Date"] });
+    vi.setSystemTime(new Date(T0));
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("every stamp of the batch is one instant: a row's start and finish, a sub-agent's open and close, the child's rows and messages", () => {
+    const { sb, status } = ticking();
+    sb.applyObservation([
+      { kind: "message_finish", runId: "run-1" },
+      { kind: "sub_agent_started", subAgentId: "task-1", name: "helper", subject: "Look.", input: "Look." },
+      { kind: "tool_started", callId: "task-1", name: "task", input: { subagent_type: "helper" }, mcpServerSlug: "" },
+      { kind: "tool_finished", callId: "task-1", result: "found" },
+      { kind: "message_start", runId: "sub-1", subAgentId: "task-1" },
+      { kind: "text_delta", runId: "sub-1", text: "Searching.", subAgentId: "task-1" },
+      { kind: "tool_started", callId: "g", name: "grep", input: { pattern: "x" }, mcpServerSlug: "", subAgentId: "task-1" },
+      { kind: "tool_finished", callId: "g", result: "x.ts", subAgentId: "task-1" },
+      { kind: "sub_agent_finished", subAgentId: "task-1", output: "found" },
+    ]);
+    const task = rowOf(status, "task-1");
+    const [sub] = status.subAgentExecutions;
+    const child = sub.messages.flatMap((m) => m.toolCalls)[0];
+    expect([task.startedAt, task.completedAt, sub.startedAt, sub.completedAt, child.startedAt, child.completedAt, sub.messages[0].timestamp]).toEqual(Array(7).fill(T0));
+    expect(new Date().toISOString(), "the clock did move between folds").not.toBe(T0);
+  });
+
+  it("a fact that carries its own observedAt keeps it inside a batch", () => {
+    const { sb, status } = ticking();
+    sb.applyObservation([
+      { kind: "tool_started", callId: "c1", name: "read_file", input: {}, mcpServerSlug: "" },
+      { kind: "tool_finished", callId: "c1", result: "", observedAt: "2025-12-31T23:59:58.000Z" },
+    ]);
+    expect([rowOf(status, "c1").startedAt, rowOf(status, "c1").completedAt]).toEqual([T0, "2025-12-31T23:59:58.000Z"]);
+  });
+
+  it("a re-emitted start inside a batch leaves the row's first start alone", () => {
+    const { sb, status } = ticking();
+    sb.applyObservation([{ kind: "tool_started", callId: "c1", name: "read_file", input: {}, mcpServerSlug: "" }]);
+    vi.setSystemTime(new Date("2026-01-01T00:00:05.000Z"));
+    sb.applyObservation([
+      { kind: "tool_started", callId: "c1", name: "read_file", input: {}, mcpServerSlug: "" },
+      { kind: "tool_finished", callId: "c1", result: "ok" },
+    ]);
+    expect([rowOf(status, "c1").startedAt, rowOf(status, "c1").completedAt]).toEqual([T0, "2026-01-01T00:00:05.000Z"]);
+  });
+
+  it("apply alone reads the clock per fact, and a batch ends with its call", () => {
+    const { sb, status } = ticking();
+    sb.apply({ kind: "tool_started", callId: "c1", name: "read_file", input: {}, mcpServerSlug: "" });
+    sb.apply({ kind: "tool_finished", callId: "c1", result: "ok" });
+    expect(rowOf(status, "c1").completedAt).toBe("2026-01-01T00:00:00.001Z");
+    sb.applyObservation([{ kind: "tool_started", callId: "c2", name: "read_file", input: {}, mcpServerSlug: "" }]);
+    sb.apply({ kind: "tool_finished", callId: "c2", result: "ok" });
+    expect([rowOf(status, "c2").startedAt, rowOf(status, "c2").completedAt]).toEqual(["2026-01-01T00:00:00.002Z", "2026-01-01T00:00:00.003Z"]);
+  });
+});
+
 describe("TranscriptBuilder — every row with args carries them redacted, and an elided, redacted argsPreview", () => {
   it("an ungated row's preview is its args, secret keys redacted", () => {
     const { status } = feed(builder(), [
@@ -327,17 +395,21 @@ describe("TranscriptBuilder — approval_proposed is the one place a row is ever
     const { sb, status } = feed(builder(), [
       { kind: "message_start", runId: "run-1" },
       { kind: "text_delta", runId: "run-1", text: "Running the build." },
-      { kind: "tool_started", callId: "sh-1", name: "Shell", input: { command: "make" }, mcpServerSlug: "", gate: { message: "Run command: make" } },
+      { kind: "tool_started", callId: "sh-1", name: "Shell", input: { command: "make" }, mcpServerSlug: "" },
       { kind: "tool_error", callId: "sh-1", message: "Blocked by hook" },
     ]);
-    const stamped = rowOf(status, "sh-1").approvalRequestedAt;
     sb.apply(proposal("sh-1", { name: "Shell", message: "Run command: make", contentDigest: "d-1" }));
     const row = rowOf(status, "sh-1");
     expect(row.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(row.requiresApproval, "the proposal is the one writer of the hold").toBe(true);
+    expect(row.approvalMessage).toBe("Run command: make");
     expect(row.error).toBe("");
     expect(row.result).toBe("");
     expect(row.completedAt).toBe("");
-    expect(row.approvalRequestedAt, "the first stamp stands").toBe(stamped);
+    const stamped = row.approvalRequestedAt;
+    expect(stamped).toContain("T");
+    sb.apply(proposal("sh-1", { name: "Shell", message: "Run command: make", contentDigest: "d-1" }));
+    expect(rowOf(status, "sh-1").approvalRequestedAt, "the first stamp stands").toBe(stamped);
     expect(row.approvalContentDigest).toBe("d-1");
     expect(status.messages.flatMap((m) => m.toolCalls), "no second row").toHaveLength(1);
     expect(sb.awaitingApproval).toBe(true);
@@ -347,7 +419,7 @@ describe("TranscriptBuilder — approval_proposed is the one place a row is ever
     const { sb, status } = feed(builder(), [
       { kind: "message_start", runId: "run-1" },
       { kind: "text_delta", runId: "run-1", text: "Editing notes." },
-      { kind: "tool_started", callId: "ed-1", name: "edit", input: { path: "notes.md", content: "partial" }, mcpServerSlug: "", gate: { message: "Write file: notes.md" } },
+      { kind: "tool_started", callId: "ed-1", name: "edit", input: { path: "notes.md", content: "partial" }, mcpServerSlug: "" },
       { kind: "tool_error", callId: "ed-1", message: "Blocked by hook" },
     ]);
     // The boundary's overlay carries the hook's captured input — the whole
@@ -368,7 +440,7 @@ describe("TranscriptBuilder — approval_proposed is the one place a row is ever
 
   it("no tool_started ever sets awaitingApproval; only a proposal does", () => {
     const { sb, status } = feed(builder(), [
-      { kind: "tool_started", callId: "sh-1", name: "Shell", input: {}, mcpServerSlug: "", gate: { message: "Run command" } },
+      { kind: "tool_started", callId: "sh-1", name: "Shell", input: {}, mcpServerSlug: "", provenance: "builtin_category" },
     ]);
     expect(sb.awaitingApproval).toBe(false);
     expect(rowOf(status, "sh-1").status).toBe(ToolCallStatus.TOOL_CALL_RUNNING);

package/src/harness/transcript/builder.ts

@@ -48,6 +48,11 @@
  *     observed earlier and delivers later stamps its own instant
  *     (`observedAt`); an output chunk for a settled row is stale
  *     and dropped — the completion's result is the whole output.
+ *   - One observation, one instant: the facts a translator made of one
+ *     raw engine event, folded through {@link applyObservation}, share
+ *     one clock read for every stamp they make (a Cursor completion with
+ *     no running before it starts and finishes at the same instant,
+ *     stigmer#1390); {@link apply} alone reads the clock per fact.
  *   - The AI-message boundary (native's own rule, made correct by
  *     scoping): a tool row attaches to the scope's current AI message — the
  *     latest with text, the seed's last AI message over a seeded transcript
@@ -148,6 +153,8 @@ export class TranscriptBuilder {
   private readonly observer: TranscriptObserver | undefined;
   private _dirty = false;
   private _awaitingApproval = false;
+  /** The one instant of the observation being folded, while {@link applyObservation} runs; absent otherwise. */
+  private observationInstant: string | undefined;
 
   /**
    * Builds INTO `status`, by reference: its `messages`, `subAgentExecutions`
@@ -233,6 +240,32 @@ export class TranscriptBuilder {
     }
   }
 
+  /**
+   * Fold the facts ONE harness observation yields — the events a translator
+   * made of one raw engine event — at one instant: the clock is read once,
+   * and every stamp the facts make (a row's start and finish, a sub-agent's
+   * open and close, a message's timestamp) is that instant. A Cursor
+   * completion the stream reports with no running before it is a start and a
+   * finish in one event, and it must carry one instant, not two reads a
+   * millisecond apart (stigmer#1390). A fact that carries its own
+   * `observedAt` keeps it. Each fact is applied exactly as {@link apply}
+   * applies it, observer included.
+   */
+  applyObservation(facts: readonly TranscriptEvent[]): void {
+    const outer = this.observationInstant;
+    this.observationInstant = outer ?? utcTimestamp();
+    try {
+      for (const fact of facts) this.apply(fact);
+    } finally {
+      this.observationInstant = outer;
+    }
+  }
+
+  /** The instant a stamp records: the observation's, while one is being folded, else now. */
+  private instant(): string {
+    return this.observationInstant ?? utcTimestamp();
+  }
+
   private fold(event: TranscriptEvent): void {
     try {
       switch (event.kind) {
@@ -354,7 +387,7 @@ export class TranscriptBuilder {
       subject: event.subject,
       input: event.input,
       status: SubAgentStatus.SUB_AGENT_IN_PROGRESS,
-      startedAt: utcTimestamp(),
+      startedAt: this.instant(),
     });
     this.state.openSubAgent(row);
     this._dirty = true;
@@ -364,7 +397,7 @@ export class TranscriptBuilder {
     const scope = this.state.subAgent(event.subAgentId);
     if (!scope) return;
     scope.row.status = SubAgentStatus.SUB_AGENT_COMPLETED;
-    scope.row.completedAt = utcTimestamp();
+    scope.row.completedAt = this.instant();
     if (event.output !== undefined) scope.row.output = event.output;
     finalizeStreaming(scope.transcript);
     this._dirty = true;
@@ -374,7 +407,7 @@ export class TranscriptBuilder {
     const scope = this.state.subAgent(event.subAgentId);
     if (!scope) return;
     scope.row.status = SubAgentStatus.SUB_AGENT_FAILED;
-    scope.row.completedAt = utcTimestamp();
+    scope.row.completedAt = this.instant();
     scope.row.error = event.error;
     finalizeStreaming(scope.transcript);
     this._dirty = true;
@@ -427,7 +460,7 @@ export class TranscriptBuilder {
     const msg = create(AgentMessageSchema, {
       type: MessageType.MESSAGE_THINKING,
       content: text,
-      timestamp: utcTimestamp(),
+      timestamp: this.instant(),
       isStreaming: true,
     });
     scope.messages.push(msg);
@@ -466,17 +499,16 @@ export class TranscriptBuilder {
     // only when the scope has no message yet.
     const parentMsg = scope.currentAiMessage ?? this.ensureAiMessageForToolCall(scope);
 
-    // A started call is RUNNING, gated or not: a gated call that has started
-    // runs until the harness's boundary parks it through `approval_proposed`
-    // (Cursor), and on native a held call never starts at all — the engine
-    // interrupts before the tool runs and the post-stream seed proposes it.
-    // The builder writes the gate's word it is told and decides nothing
-    // about approval.
+    // A started call is RUNNING and carries no approval fact: whether it is
+    // held is known only after the engine's gate has run, and a held call
+    // reaches the transcript as `approval_proposed` (Cursor's boundary after
+    // the hook denied it; native's post-stream seed, where a held call never
+    // starts at all). The builder decides nothing about approval.
     const tc = create(ToolCallSchema, {
       id: callId,
       name,
       status: ToolCallStatus.TOOL_CALL_RUNNING,
-      startedAt: utcTimestamp(),
+      startedAt: this.instant(),
     });
 
     if (Object.keys(input).length > 0) {
@@ -503,13 +535,6 @@ export class TranscriptBuilder {
       tc.policyEngineVersion = POLICY_ENGINE_VERSION;
     }
 
-    // The gate's word: the row says it is gated and what the card will ask;
-    // `approvalRequestedAt` is stamped when the boundary actually parks it
-    // (`approval_proposed`, or a gated row's `tool_error`), never here.
-    if (event.gate) {
-      tc.requiresApproval = true;
-      tc.approvalMessage = event.gate.message;
-    }
 
     parentMsg.toolCalls.push(tc);
     scope.toolCalls.set(callId, tc);
@@ -543,8 +568,8 @@ export class TranscriptBuilder {
     const resultChanged = !!result && result !== tc.result;
     if (!wasSettled) tc.status = ToolCallStatus.TOOL_CALL_COMPLETED;
     // The instant the harness OBSERVED the completion when it delivers it
-    // later (Cursor's queued delta); otherwise now.
-    if (!tc.completedAt) tc.completedAt = observedAt ?? utcTimestamp();
+    // later (Cursor's queued delta); otherwise the fold's instant.
+    if (!tc.completedAt) tc.completedAt = observedAt ?? this.instant();
     if (resultChanged) tc.result = result;
     stopStreaming(tc);
     scope.argBuffers.delete(callId);
@@ -571,17 +596,15 @@ export class TranscriptBuilder {
     const tc = scope.toolCalls.get(callId);
     if (!tc) return;
 
-    // The same upsert as a finish. A gated row that fails is the
-    // Cursor boundary's shape — the hook denied the call and the stream
-    // reports `error`; the boundary parks it after the stream — so the
-    // moment approval became due is stamped here if nothing stamped it yet.
+    // The same upsert as a finish. A call the Cursor hook denied also reports
+    // `error` here; it is an ordinary failure until the boundary parks it
+    // through `approval_proposed`, which stamps the approval fields.
     const wasSettled = isSettled(tc.status);
     const messageChanged = !!message && message !== tc.error;
-    const at = observedAt ?? utcTimestamp();
+    const at = observedAt ?? this.instant();
     if (!wasSettled) tc.status = ToolCallStatus.TOOL_CALL_FAILED;
     if (!tc.completedAt) tc.completedAt = at;
     if (messageChanged) tc.error = message;
-    if (tc.requiresApproval && !tc.approvalRequestedAt) tc.approvalRequestedAt = at;
     stopStreaming(tc);
     scope.argBuffers.delete(callId);
 
@@ -629,7 +652,7 @@ export class TranscriptBuilder {
   // ── Post-Stream Facts ──────────────────────────────────────────────
 
   private handleApprovalProposed(scope: Transcript, event: ApprovalProposedEvent): void {
-    const now = utcTimestamp();
+    const now = this.instant();
     const existing = scope.toolCalls.get(event.callId);
     if (existing) {
       // Reopen (Cursor's `markWaitingApproval`): the boundary is re-proposing
@@ -693,7 +716,7 @@ export class TranscriptBuilder {
     scope.messages.push(create(AgentMessageSchema, {
       type: MessageType.MESSAGE_SYSTEM,
       content: text,
-      timestamp: utcTimestamp(),
+      timestamp: this.instant(),
     }));
     this._dirty = true;
   }
@@ -712,7 +735,7 @@ export class TranscriptBuilder {
     const msg = create(AgentMessageSchema, {
       type: MessageType.MESSAGE_AI,
       content: "",
-      timestamp: utcTimestamp(),
+      timestamp: this.instant(),
       isStreaming: true,
     });
 
@@ -737,7 +760,7 @@ export class TranscriptBuilder {
     const msg = create(AgentMessageSchema, {
       type: MessageType.MESSAGE_AI,
       content: "",
-      timestamp: utcTimestamp(),
+      timestamp: this.instant(),
       isStreaming: false,
     });
 

package/src/harness/transcript/events.ts

@@ -18,11 +18,12 @@
  *     what a row or a message carries; usage is neither.
  *   - `tool_finished` carries `result: string`; the engine's output
  *     envelope is the translator's to render.
- *   - `tool_started` carries the attribution (`mcpServerSlug`), the
- *     provenance and — where the harness runs a gated call before its
- *     boundary parks it — the gate's word. The translator resolves them from
- *     the harness's policy state; the builder writes what it is told and
- *     decides nothing about approval.
+ *   - `tool_started` carries the attribution (`mcpServerSlug`) and the
+ *     provenance, which the translator resolves from the harness's policy
+ *     state. It never says whether the call is held: a started call is
+ *     running, and a held one reaches the transcript as `approval_proposed`
+ *     on both harnesses, the one writer of a row's approval fields (#1117).
+ *     The builder writes what it is told and decides nothing about approval.
  *   - Scope is `subAgentId?` — the only scope either harness has is
  *     "the root, or one sub-agent by the id its row carries" — and the
  *     translator says when a sub-agent opens and closes
@@ -89,25 +90,18 @@ export interface MessageFinishEvent extends Scoped {
 // ── Tool Events ───────────────────────────────────────────────────
 
 /**
- * The translator's word that a call is GATED — the fields the row carries,
- * never a decision the builder makes (#1097, 2026-09-14). A gated call that
- * has STARTED is running until the
- * harness's boundary parks it through `approval_proposed`: that is Cursor's
- * shape (the SDK runs the tool; the deny-and-retry boundary parks it after
- * the stream). Native never emits this member — LangGraph's `interrupt()`
- * fires before the tool handler runs, so a held call never produces a
- * `tool_started` at all, and the arrival of one IS the engine's word that
- * the call was authorized (capture mode let it flow, a lease or policy
- * cleared it, or the user approved it). Native's gate fact reaches the
- * transcript through `approval_proposed` from the post-stream seed. So a
- * row is never WAITING at creation on either harness; the plan's `parked:
- * true` arm had no producer and was dropped.
+ * A tool call has started. It carries no approval fact, on either harness
+ * (#1117): whether a call is HELD for a person's decision is known only after
+ * the engine's own gate has run, and it reaches the transcript as
+ * `approval_proposed` — native's post-stream seed after LangGraph's
+ * `interrupt()` (which fires before the tool handler, so a held call never
+ * starts), Cursor's deny-and-retry boundary after the preToolUse hook denied
+ * it. A call that runs under a lease, a bypass or capture mode is therefore
+ * never marked as requiring approval. A `gate` member carried the policy's
+ * category verdict here until #1117; it had one producer (Cursor), which made
+ * the field mean different things per harness, and it was dropped, as a
+ * `parked: true` arm with no producer was before it.
  */
-export interface GateAnswer {
-  /** The approval card's message, placeholders already resolved. */
-  readonly message: string;
-}
-
 export interface ToolStartedEvent extends Scoped {
   readonly kind: "tool_started";
   readonly callId: string;
@@ -121,7 +115,6 @@ export interface ToolStartedEvent extends Scoped {
    * on both harnesses today, #1133) or no layer governs it.
    */
   readonly provenance?: PolicySource;
-  readonly gate?: GateAnswer;
 }
 
 export interface ToolArgDeltaEvent extends Scoped {
@@ -139,15 +132,17 @@ export interface ToolOutputDeltaEvent extends Scoped {
 /**
  * A fact the harness observed at one instant and delivers at another. The
  * builder is the transcript's one clock — every row stamp is `utcTimestamp()`
- * at apply — except here: a Cursor completion arrives first on the SDK's
+ * at apply, read once per observation when the loop folds a raw event's
+ * facts together (`TranscriptBuilder.applyObservation`) — except here: a
+ * Cursor completion arrives first on the SDK's
  * delta channel, and the translator must QUEUE it for the loop to apply after
  * the current stream event (a delta applied mid-persist would land on a row
  * the offload is replacing). Without the observed
  * instant the row's `completedAt` would be the fold's moment, one stream
  * event late — seconds late while the model narrates — and the tool's
  * duration in the console would lie (fixed 2026-09-15, #1097). Absent
- * means "now": native, and every fact a translator emits as it sees it,
- * never set it.
+ * means the fold's instant: native, and every fact a translator emits as it
+ * sees it, never set it.
  */
 interface Observed {
   readonly observedAt?: string;

package/src/harness/turn-context.ts

@@ -649,7 +649,9 @@ export async function reconcileReinvocation(
  * The MCP-bound env map (and ONLY it, never the agent process env) carries
  * the reserved caller-identity keys, so a server that declares them in
  * spec.env can template the platform-verified caller into its headers;
- * filterEnvToDeclaredKeys keeps every other server blind. The resolved list
+ * filterEnvToDeclaredKeys keeps every other server blind. Resolution fills a
+ * missing STIGMER_SERVER_ADDRESS per server from `config`'s endpoints
+ * (shared/platform-server-address.ts). The resolved list
  * then mutates through the Connect backfill and three synthesized
  * attachments, deliberately AFTER resolve + backfill so the backfill's
  * destructiveHint tightener can never force-gate an attachment's tools:
@@ -702,7 +704,7 @@ export async function resolveMcpServersAndPolicies(
     sessionId,
   );
   let servers = (await resolveMcpServers(
-    client, blueprint.mergedMcpServerUsages, mcpEnvVars, transportPosture,
+    client, blueprint.mergedMcpServerUsages, mcpEnvVars, transportPosture, config,
   )).resolvedServers;
   deps.timing.mark("resolve_mcp_servers");
 
@@ -710,7 +712,7 @@ export async function resolveMcpServersAndPolicies(
   const sessionOrg = session.metadata?.org ?? "";
   servers = await backfillMcpServersIfNeeded(
     client, servers, blueprint.mergedMcpServerUsages, mcpEnvVars, sessionOrg,
-    transportPosture, deps.heartbeat, environment.secretKeys,
+    transportPosture, config, deps.heartbeat, environment.secretKeys,
   );
   deps.timing.mark("backfill_mcp");
 

package/src/main.ts

@@ -46,6 +46,7 @@ import type { IpcCommand, IpcResponse } from "./ipc-protocol.js";
 
 import { handleUnhandledRejection } from "./activities/execute-cursor/rejection-capture.js";
 import { installProcessPipeGuards, reportFatal } from "./pipe-safety.js";
+import { armExitBackstop } from "./exit-backstop.js";
 
 // Guard the host pipes before anything writes to them. A dropped stderr/stdout
 // reader otherwise turns the next write into an uncaught EPIPE loop that starves
@@ -510,17 +511,20 @@ async function main(): Promise<void> {
     await runManagerMode(config);
     // Manager mode is driven by the host over stdin. Once it returns — via the IPC `shutdown`
     // command or stdin EOF when the host process dies — exit deterministically so a stray open
-    // handle can't keep a shut-down runner alive as an orphan (issue #177). Static mode is left
-    // to exit naturally so its OTel flush completes.
+    // handle can't keep a shut-down runner alive as an orphan (issue #177).
     process.exit(0);
   }
 
+  // Static and pool modes exit naturally once their shutdown has returned (worker drained,
+  // OTel flushed). The backstop is the safety net, not the path: a healthy runner exits in
+  // milliseconds and it never fires; a leaked handle gets a named bound and a log line naming
+  // it, instead of holding the process for the orchestrator's whole grace (exit-backstop.ts).
   if (runnerMode === "pool") {
     await runPoolMode(config, poolMemberId!);
-    return;
+  } else {
+    await runStaticMode(config);
   }
-
-  await runStaticMode(config);
+  armExitBackstop();
 }
 
 main().catch((err) => {