@stigmer/runner 3.40.1 → 3.41.0

package/src/activities/execute-cursor/translator.ts

@@ -50,15 +50,17 @@
  *     mid-stream is WAITING until the boundary runs), so they are indexed once
  *     at construction and consumed on match (a declined row is a
  *     closed gate and never matched).
- *   - The GATE and the PROVENANCE. `gate` is the POLICY's word —
- *     this MCP tool's merged policy, or this built-in's category, requires
- *     approval — resolved exactly as the accumulator did, lease- and
- *     bypass-blind; it is NOT the hook's verdict (the hook has arms this side
- *     cannot evaluate: capture mode, grants, bypass, secret blocks — the
- *     lesson behind dropping a parked-at-creation arm that had no producer).
- *     A gated call that STARTED runs until the boundary parks
- *     it through `approval_proposed`. Provenance is the shared read-side
- *     `resolveApprovalProvenance` over the same policies and the run's leases.
+ *   - The PROVENANCE, and never the hold. A row's provenance is the shared
+ *     read-side `resolveApprovalProvenance` over the merged policies and the
+ *     run's leases: which layer governs the call. Whether the call was HELD
+ *     for a person's decision is not answered here, because at tool start
+ *     nobody knows yet: the preToolUse hook decides, with arms this side
+ *     cannot evaluate (capture mode, grants, bypass, secret blocks), and a
+ *     call the hook denies is parked by the turn boundary through
+ *     `approval_proposed` — the one writer of a row's approval fields on both
+ *     harnesses (#1117). Until then this translator stamped the policy's
+ *     category verdict at start, lease- and bypass-blind, so a leased,
+ *     bypassed or capture-mode call that ran read "requires approval".
  *   - The RESULT string (`tool-result.ts`): a failure's text is its `error`
  *     alone.
  *   - The SUB-AGENT: a `task` tool call opens a sub-agent keyed by
@@ -81,12 +83,11 @@
 import type { InteractionUpdate, SDKMessage } from "@cursor/sdk";
 import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import type { GateAnswer, ToolStartedEvent, TranscriptEvent } from "../../harness/transcript/events.js";
+import type { ToolStartedEvent, TranscriptEvent } from "../../harness/transcript/events.js";
 import { resolveApprovalProvenance, type MergedToolPolicy, type PolicySource } from "../../shared/approval-policy.js";
 import { utcTimestamp } from "../../shared/status.js";
 import { isDeclinedRow } from "../../shared/tool-row.js";
 import type { ToolApprovalCategory } from "../../shared/tool-kind.js";
-import { builtInRequiresApproval, getBuiltInApprovalMessage, lookupMcpToolPolicy, resolveApprovalMessage } from "./approval-policy.js";
 import { toolCallIdentityToken, toolIdentity, primaryToken } from "./approval-state.js";
 import { contentDigest } from "../../shared/file-tools.js";
 import { subAgentStepEvents } from "./sub-agent-steps.js";
@@ -97,7 +98,7 @@ type ToolCallEvent = Extract<SDKMessage, { type: "tool_call" }>;
 /** The delegation tool: the one tool name this translator knows, because its start opens a sub-agent. */
 const TASK_TOOL = "task";
 
-/** The run's approval posture the translator answers `gate` and `provenance` from. */
+/** The run's approval posture the translator answers `provenance` from. */
 export interface CursorTranslatorOptions {
   /** The merged four-level MCP policy map (`mergeApprovalPolicies`). */
   readonly policies: ReadonlyMap<string, MergedToolPolicy>;
@@ -303,7 +304,7 @@ export class CursorTranslator {
       }
       this.announced.add(rowId);
     }
-    out.push(this.toolStarted(rowId, name, mcp !== undefined, mcpServerSlug, input));
+    out.push(this.toolStarted(rowId, name, mcpServerSlug, input));
     // Deltas that arrived before the stream announced this call follow its
     // start, targeted at the row it resolved to.
     const heldMakers = this.held.get(event.call_id);
@@ -359,7 +360,7 @@ export class CursorTranslator {
     return seededId;
   }
 
-  private toolStarted(callId: string, name: string, isMcp: boolean, mcpServerSlug: string, input: Record<string, unknown>): ToolStartedEvent {
+  private toolStarted(callId: string, name: string, mcpServerSlug: string, input: Record<string, unknown>): ToolStartedEvent {
     const { policies, leases } = this.options;
     const provenance: PolicySource | undefined = resolveApprovalProvenance(
       name,
@@ -368,7 +369,6 @@ export class CursorTranslator {
       leases.categories,
       leases.global,
     );
-    const gate = this.gateOf(name, isMcp, mcpServerSlug, input);
     return {
       kind: "tool_started",
       callId,
@@ -376,26 +376,9 @@ export class CursorTranslator {
       input,
       mcpServerSlug,
       ...(provenance !== undefined ? { provenance } : {}),
-      ...(gate !== undefined ? { gate } : {}),
     };
   }
 
-  /**
-   * The policy's word that this call requires approval, and the card's
-   * message — or nothing for an ungated call. An MCP call (the `mcp` envelope,
-   * whatever its provider field says) is governed by the merged policy map
-   * alone; a built-in by its category.
-   */
-  private gateOf(name: string, isMcp: boolean, mcpServerSlug: string, input: Record<string, unknown>): GateAnswer | undefined {
-    if (isMcp) {
-      const policy = lookupMcpToolPolicy(name, mcpServerSlug, this.options.policies);
-      return policy ? { message: resolveApprovalMessage(policy.approvalMessage, name, input) } : undefined;
-    }
-    if (!builtInRequiresApproval(name)) return undefined;
-    const template = getBuiltInApprovalMessage(name);
-    return template ? { message: resolveApprovalMessage(template, name, input) } : undefined;
-  }
-
   // ── The delta queue ─────────────────────────────────────────────
 
   private rowIdOf(callId: string): string {

package/src/activities/execute-cursor/turn-stream.ts

@@ -220,7 +220,10 @@ export async function consumeCursorTurnStream(
       // The stream event, then the deltas that arrived since the last one —
       // the enricher's order, kept so a completion the delta channel reported
       // in the same window as the stream's own defers to the stream's instant.
-      for (const fact of translator.translate(event)) transcript.apply(fact);
+      // The stream event is one observation, folded at one instant (a
+      // completion with no running before it starts and finishes together);
+      // each drained delta is its own, and carries `observedAt` where it stamps.
+      transcript.applyObservation(translator.translate(event));
       for (const fact of translator.drainDeltas()) transcript.apply(fact);
 
       // First-denial stop (HITL clean pause). In CAPTURE mode this fires only for

package/src/activities/execute-deep-agent/__test-utils__/hermetic-deep-agent.ts

@@ -146,6 +146,7 @@ export function hermeticDeepAgentConfig(env: HermeticEnvironment, checkpointerTy
     temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
     mcpBridgeEndpoint: null,
+    mcpPublicEndpoint: null,
     stigmerTokenRef: { current: null },
     cursorApiKey: "",
     workspaceRootDir: env.workspaceRootDir,
@@ -228,6 +229,8 @@ export class DeepAgentScenario {
     readonly config: Config,
     script: ScriptSelector,
     onTurn: DeepAgentScenarioOptions["onTurn"],
+    /** Tool calls an EARLIER message of the session settled, in its own record ({@link continueDeepAgentScenario}). */
+    settledEarlier: ReadonlySet<string> = new Set(),
   ) {
     this.model = new ScriptedModel(script, [], {
       onTurn: async (info) => {
@@ -236,8 +239,10 @@ export class DeepAgentScenario {
         // lets the producer run a turn ahead of the consumer. Wait for that
         // ground before ticking, so every stamp of the previous turn precedes
         // this turn's instant, whatever the persist's I/O took (the barrier's
-        // own header on `ExecutionRecord` carries the whole reason).
-        await this.record.whenToolCallsSettled(info.priorToolCallIds);
+        // own header on `ExecutionRecord` carries the whole reason). A
+        // follow-up message's first turn answers the previous message's last
+        // results, which that message's record settled, never this one.
+        await this.record.whenToolCallsSettled(info.priorToolCallIds.filter((id) => !settledEarlier.has(id)));
         this.clock.tick();
         if (onTurn && this.controls) await onTurn(info, this.controls);
       },
@@ -285,6 +290,32 @@ export function beginDeepAgentScenario(options: DeepAgentScenarioOptions): DeepA
   return scenario;
 }
 
+/**
+ * The session's NEXT message on the scenario's thread: a new record and a new
+ * script over the same environment, runner config and checkpointer, WITHOUT
+ * the reset {@link beginDeepAgentScenario} does. On the `sqlite` checkpointer
+ * the new message therefore runs on the checkpoint the previous one left: the
+ * production shape of "send another message to continue".
+ */
+export function continueDeepAgentScenario(
+  previous: DeepAgentScenario,
+  options: Pick<DeepAgentScenarioOptions, "record" | "script" | "onTurn" | "clientOverrides">,
+): DeepAgentScenario {
+  const settledEarlier = new Set(previous.record.toolCalls().map((tc) => tc.id));
+  const scenario = new DeepAgentScenario(
+    previous.env,
+    previous.clock,
+    options.record,
+    previous.config,
+    options.script,
+    options.onTurn,
+    settledEarlier,
+  );
+  bindScriptedModel(scenario.model);
+  bindHermeticClient(options.record.client(options.clientOverrides));
+  return scenario;
+}
+
 export interface DeepAgentTurnOptions {
   /** The HITL cycle index (0 on the first turn); mints the change-set id. */
   readonly turnSeq?: number;

package/src/activities/execute-deep-agent/__tests__/adapter.test.ts

@@ -26,6 +26,7 @@ const CONFIG: Config = {
   temporalConnection: {},
   stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
+  mcpPublicEndpoint: null,
   stigmerTokenRef: { current: "tok" },
   cursorApiKey: "",
   workspaceRootDir: "/tmp/adapter-test",

package/src/activities/execute-deep-agent/__tests__/hermetic/file-review-capture.test.ts

@@ -27,6 +27,10 @@
  * a status the host could reach), and `goldens/file-review-capture.status.json`
  * pins the whole ledger beside Cursor's.
  *
+ * Golden hunk since #1443: the inline artifact's `createdAt` is t=1, the
+ * edit's finish, where it was t=2, the moment the publisher's upload
+ * returned (it reads the clock before its first await now).
+ *
  * Parent phase rows exercised beyond the plain arms: a `local_path` workspace
  * entry (mounted as-is in local mode, the agent rooted at the entry per
  * `provisionWorkspace`); capture-mode derivation on a git tree; the baseline

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/file-review-capture.status.json

@@ -40,7 +40,7 @@
       "kind": "EXECUTION_ARTIFACT_KIND_FILE",
       "sizeBytes": "22",
       "storageKey": "artifacts/aex_hermetic_0001/notes.md",
-      "createdAt": "2026-01-01T00:00:02.000Z",
+      "createdAt": "2026-01-01T00:00:01.000Z",
       "contentHash": "e4cdd09e8ca79e376a6ec5766d190754bc8ee4a2d6c5c7f4d86a9dc7fdf25a0f"
     }
   ],

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/inline-artifact.turn1.status.json

@@ -57,7 +57,7 @@
       "kind": "EXECUTION_ARTIFACT_KIND_FILE",
       "sizeBytes": "32",
       "storageKey": "artifacts/aex_hermetic_0001/report.md",
-      "createdAt": "2026-01-01T00:00:02.000Z",
+      "createdAt": "2026-01-01T00:00:01.000Z",
       "contentHash": "62eae4d09b2b051cf4ac5aa1fd70847b34c47994a1732ff999f47749e71b0441"
     }
   ],

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/inline-artifact.turn2.status.json

@@ -67,7 +67,7 @@
       "kind": "EXECUTION_ARTIFACT_KIND_FILE",
       "sizeBytes": "32",
       "storageKey": "artifacts/aex_hermetic_0001/report.md",
-      "createdAt": "2026-01-01T00:00:02.000Z",
+      "createdAt": "2026-01-01T00:00:01.000Z",
       "contentHash": "62eae4d09b2b051cf4ac5aa1fd70847b34c47994a1732ff999f47749e71b0441"
     }
   ],

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/recursion-limit.persisted.status.json

@@ -200,89 +200,24 @@
         }
       ]
     },
-    {
-      "type": "MESSAGE_AI",
-      "content": "Reading file 10.",
-      "timestamp": "2026-01-01T00:00:11.000Z",
-      "toolCalls": [
-        {
-          "id": "call-hermetic-loop-0010",
-          "name": "read_file",
-          "args": {
-            "file_path": "/f10.md"
-          },
-          "result": "[{\"type\":\"text\",\"text\":\"Error: File '/f10.md' not found\"}]",
-          "status": "TOOL_CALL_COMPLETED",
-          "startedAt": "2026-01-01T00:00:11.000Z",
-          "completedAt": "2026-01-01T00:00:11.000Z",
-          "argsPreview": "{\"file_path\":\"/f10.md\"}",
-          "toolKind": "TOOL_KIND_FILE_READ"
-        }
-      ]
-    },
-    {
-      "type": "MESSAGE_AI",
-      "content": "Reading file 11.",
-      "timestamp": "2026-01-01T00:00:12.000Z",
-      "toolCalls": [
-        {
-          "id": "call-hermetic-loop-0011",
-          "name": "read_file",
-          "args": {
-            "file_path": "/f11.md"
-          },
-          "result": "[{\"type\":\"text\",\"text\":\"Error: File '/f11.md' not found\"}]",
-          "status": "TOOL_CALL_COMPLETED",
-          "startedAt": "2026-01-01T00:00:12.000Z",
-          "completedAt": "2026-01-01T00:00:12.000Z",
-          "argsPreview": "{\"file_path\":\"/f11.md\"}",
-          "toolKind": "TOOL_KIND_FILE_READ"
-        }
-      ]
-    },
-    {
-      "type": "MESSAGE_AI",
-      "content": "Reading file 12.",
-      "timestamp": "2026-01-01T00:00:13.000Z",
-      "toolCalls": [
-        {
-          "id": "call-hermetic-loop-0012",
-          "name": "read_file",
-          "args": {
-            "file_path": "/f12.md"
-          },
-          "result": "[{\"type\":\"text\",\"text\":\"Error: File '/f12.md' not found\"}]",
-          "status": "TOOL_CALL_COMPLETED",
-          "startedAt": "2026-01-01T00:00:13.000Z",
-          "completedAt": "2026-01-01T00:00:13.000Z",
-          "argsPreview": "{\"file_path\":\"/f12.md\"}",
-          "toolKind": "TOOL_KIND_FILE_READ"
-        }
-      ]
-    },
-    {
-      "type": "MESSAGE_AI",
-      "content": "Reading file 13.",
-      "timestamp": "2026-01-01T00:00:14.000Z"
-    },
     {
       "type": "MESSAGE_SYSTEM",
       "content": "The agent reached the tool-call limit for this message. Work completed so far has been saved. Send another message to continue where the agent left off.",
-      "timestamp": "2026-01-01T00:00:14.000Z"
+      "timestamp": "2026-01-01T00:00:10.000Z"
     }
   ],
   "phase": "EXECUTION_TERMINATED",
   "error": "Agent reached the tool-call limit for this message. Send another message to continue.",
   "startedAt": "2026-01-01T00:00:00.000Z",
-  "completedAt": "2026-01-01T00:00:14.000Z",
+  "completedAt": "2026-01-01T00:00:10.000Z",
   "streamingUsage": {
-    "inputTokens": "14000",
-    "outputTokens": "280",
-    "totalTokens": "14280",
-    "turnCount": 14,
-    "estimatedCostUsd": 0.015400000000000002,
+    "inputTokens": "10000",
+    "outputTokens": "200",
+    "totalTokens": "10200",
+    "turnCount": 10,
+    "estimatedCostUsd": 0.011000000000000001,
     "model": "claude-haiku-4.5",
-    "observedAt": "2026-01-01T00:00:14.000Z",
+    "observedAt": "2026-01-01T00:00:10.000Z",
     "requestedServiceTier": "SERVICE_TIER_STANDARD",
     "requestedThinkingMode": "THINKING_MODE_DISABLED"
   },

package/src/activities/execute-deep-agent/__tests__/hermetic/goldens/resolution-error.status.json

@@ -12,7 +12,7 @@
     }
   ],
   "phase": "EXECUTION_FAILED",
-  "error": "Execution failed: [Error] hermetic fault injected at getAgent",
+  "error": "[Error] hermetic fault injected at getAgent",
   "startedAt": "2026-01-01T00:00:00.000Z",
   "completedAt": "2026-01-01T00:00:00.000Z"
 }

package/src/activities/execute-deep-agent/__tests__/hermetic/inline-artifact-across-gate.test.ts

@@ -24,6 +24,11 @@
  * this pair of goldens (`inline-artifact.turn1`, `inline-artifact.turn2`) is
  * what proves it did.
  *
+ * Turn 2 completes, so its post-stream safety net walks the seeded history
+ * and asks for `report.md` again. The publisher re-reads it, finds the bytes
+ * the seeded row lists, and uploads nothing: the store sees turn 1's write
+ * only (stigmer/stigmer#1448).
+ *
  * Also recorded (a shape fact, as found): the write's tool row
  * shows `requiresApproval: true` with `approvalPolicySource` BUILTIN_CATEGORY
  * — the category policy's verdict — while the row is COMPLETED because
@@ -50,6 +55,12 @@
  * to persist "0 files" beside a one-file change set. The runtime now
  * refreshes the strip on every write, the terminal one included.
  *
+ * Golden hunk since #1443, in both goldens: the artifact's `createdAt` is
+ * t=1, the write's finish, where it was t=2. The publisher read the clock
+ * after its upload, which runs beside the stream, so the stamp landed on
+ * either side of the next model turn's tick and flaked under the full
+ * suite; it reads the clock before its first await now.
+ *
  * Regenerate ONLY after a deliberate behavior change:
  *   npx vitest run src/activities/execute-deep-agent/__tests__/hermetic -u
  */
@@ -88,6 +99,7 @@ import {
   runDeepAgentTurn,
 } from "../../__test-utils__/hermetic-deep-agent.js";
 import { CLOSING_TURN, EXECUTE_CALL_A } from "../../__test-utils__/hitl-script.js";
+import { LocalArtifactStorage } from "../../../../shared/artifact-storage.js";
 
 const REPORT = "report.md";
 const REPORT_BODY = "# Report\n\nAll fixtures nominal.\n";
@@ -148,6 +160,7 @@ describe("ExecuteDeepAgent hermetic — inline artifact across a gate (sqlite)",
     expect(existsSync(join(env.artifactPath, run1.artifacts[0].storageKey)), "the bytes reached the store").toBe(true);
     const writeRow = record.toolCalls().find((tc) => tc.id === WRITE_CALL_ID)!;
     expect(writeRow.status, "capture mode let the write flow").toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(run1.artifacts[0].createdAt, "the artifact is stamped at its write's finish").toBe(writeRow.completedAt);
     expect(record.waitingToolCalls().map((tc) => tc.id)).toEqual([EXECUTE_CALL_A.id]);
     await expect(statusJson(run1)).toMatchFileSnapshot("./goldens/inline-artifact.turn1.status.json");
 
@@ -155,13 +168,17 @@ describe("ExecuteDeepAgent hermetic — inline artifact across a gate (sqlite)",
     expect(record.decideWaitingToolCalls(ApprovalAction.APPROVE, DECIDED_AT)).toBe(1);
 
     // ── Turn 2 ───────────────────────────────────────────────────────────────
+    const uploads = vi.spyOn(LocalArtifactStorage.prototype, "upload");
     const turn2 = await runDeepAgentTurn(scenario, { turnSeq: 1 });
+    const turn2Keys = uploads.mock.calls.map(([key]) => key);
+    uploads.mockRestore();
     expect(turn2.outcome.kind).toBe("returned");
     expect((turn2.outcome as { value: Record<string, unknown> }).value.phase).toBe("EXECUTION_COMPLETED");
     const final = record.lastFullStatus!;
     expect(final.artifacts.map((a) => [a.name, a.storageKey, a.contentHash]), "the seed carried the artifact").toEqual(
       run1.artifacts.map((a) => [a.name, a.storageKey, a.contentHash]),
     );
+    expect(turn2Keys, "turn 2 does not upload the unchanged report again").not.toContain(run1.artifacts[0].storageKey);
     expect(final.messages.flatMap((m) => m.toolCalls).map((tc) => [tc.id, tc.status])).toEqual([
       [WRITE_CALL_ID, ToolCallStatus.TOOL_CALL_COMPLETED],
       [EXECUTE_CALL_A.id, ToolCallStatus.TOOL_CALL_COMPLETED],

package/src/activities/execute-deep-agent/__tests__/hermetic/recursion-limit.test.ts

@@ -3,13 +3,15 @@
  * model that keeps calling tools.
  *
  * What the arm does: `max_tool_rounds = 10` (the clamp floor,
- * `shared/tool-rounds.ts` MIN_TOOL_ROUNDS) becomes LangGraph's
- * `recursionLimit = 60` (SUPER_STEPS_PER_ROUND); the script proposes a
- * DISTINCT `read_file` every round (distinct ids and paths, so the
- * loop-detection middleware's "repetitive pattern" warning does not end the
- * run first); the graph throws `GraphRecursionError`; the adapter's turn
- * classifies it as the `tool_call_limit` outcome (`shared/tool-rounds.ts`
- * `isGraphRecursionError`), and the runtime's `toolCallLimitArm` writes
+ * `shared/tool-rounds.ts` MIN_TOOL_ROUNDS) is the execution budget
+ * middleware's round limit; the script proposes a DISTINCT `read_file` every
+ * round (distinct ids and paths, so the loop-detection middleware's
+ * "repetitive pattern" warning does not end the run first); after round 10's
+ * results the middleware throws `ToolRoundLimitError` in place of round 11's
+ * model call; the adapter's turn classifies it, through LangChain's
+ * `MiddlewareError` wrapping, as the `tool_call_limit` outcome
+ * (`shared/tool-rounds.ts` `isToolCallBudgetStop`), and the runtime's
+ * `toolCallLimitArm` writes
  * TERMINATED with the cross-repo prefix `TOOL_CALL_LIMIT_ERROR_PREFIX`
  * (matched with `startsWith` by stigmer-cloud's `reply-extractor.ts`) and
  * its row, PERSISTS it, and returns the slim.
@@ -29,16 +31,26 @@
  * empty message once and its `currentAiMessage[""]` then caught every later
  * row.
  *
- * How many rounds fit is the middleware stack's shape, not the knob's
- * (ruled 2026-09-13, #1096): LangChain makes every
- * middleware hook its own graph node, and `max_tool_rounds` becomes a
- * super-step budget at the ×6 floor estimate, so a node fewer per round
- * means more rounds within the same 60 steps. When `graceful-stop.ts` (an
- * `afterModel` node) was deleted in #1096, this golden went from 11 tool
- * calls to 13 before TERMINATED — the only hunk, the copy unchanged. That the
- * knob counts super-steps and not rounds is recorded as #1113
- * (a round counter in the budget middleware would make it mean what it
- * says); this file pins what the stack delivers today.
+ * How many rounds run is the knob's, exactly (#1113): TEN tool rows, on any
+ * middleware stack. Until #1113 the knob was LangGraph's recursion limit at
+ * 10 × 6 super-steps, and since LangChain makes every middleware hook its own
+ * graph node, the rows moved with the stack: 11 until #1096 deleted
+ * `graceful-stop.ts` (an `afterModel` node), 13 after it. #1113 moved this
+ * golden from 13 rows to 10, the copy unchanged. It also dropped the golden's
+ * last AI message, "Reading file 13.": the step limit had cut that fourteenth
+ * model call's proposal before its tool ran, so the transcript ended on a
+ * call that never executed. The round stop replaces the model call instead,
+ * so the transcript ends on round 10's results, and usage counts ten model
+ * calls, not fourteen.
+ *
+ * The second arm is the copy's promise, "send another message to continue":
+ * on the durable (`sqlite`) checkpointer, a follow-up message on the same
+ * thread starts from the checkpoint the stop left. The stop is a throw inside
+ * the model node rather than a limit between super-steps, so this is proven,
+ * not assumed: the follow-up's first model turn sees all ten rounds in its
+ * transcript (the scripted model indexes its script by the rounds the
+ * transcript holds), the run completes, and the budget is the new message's
+ * own.
  *
  * Regenerate ONLY after a deliberate behavior change:
  *   npx vitest run src/activities/execute-deep-agent/__tests__/hermetic -u
@@ -65,14 +77,25 @@ import { stubRegistryFetch } from "../../../../__test-utils__/model-registry-fix
 import { MIN_TOOL_ROUNDS } from "../../../../shared/tool-rounds.js";
 import {
   beginDeepAgentScenario,
+  continueDeepAgentScenario,
   deepAgentExecutionRecord,
   runDeepAgentTurn,
 } from "../../__test-utils__/hermetic-deep-agent.js";
+import type { ScriptedTurn } from "../../__test-utils__/scripted-model.js";
 import { TOOL_CALL_LIMIT_ERROR_PREFIX } from "../../../../shared/tool-rounds.js";
 
 /** More rounds than the budget allows; the graph stops the script, not the other way round. */
 const SCRIPTED_ROUNDS = 40;
 
+/** The model that keeps calling tools: a distinct `read_file` per round. */
+function readingRounds(): ScriptedTurn[] {
+  return Array.from({ length: SCRIPTED_ROUNDS }, (_, i) => ({
+    text: `Reading file ${i}.`,
+    toolCalls: [{ id: `call-hermetic-loop-${String(i).padStart(4, "0")}`, name: "read_file", args: { file_path: `/f${i}.md` } }],
+    usage: { inputTokens: 1_000, outputTokens: 20 },
+  }));
+}
+
 describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
   let env: HermeticEnvironment;
   let registry: ReturnType<typeof stubRegistryFetch>;
@@ -97,13 +120,7 @@ describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
       env,
       clock,
       record,
-      script: () => ({
-        turns: Array.from({ length: SCRIPTED_ROUNDS }, (_, i) => ({
-          text: `Reading file ${i}.`,
-          toolCalls: [{ id: `call-hermetic-loop-${String(i).padStart(4, "0")}`, name: "read_file", args: { file_path: `/f${i}.md` } }],
-          usage: { inputTokens: 1_000, outputTokens: 20 },
-        })),
-      }),
+      script: () => ({ turns: readingRounds() }),
     });
 
     // ── Act ──────────────────────────────────────────────────────────────────
@@ -125,8 +142,7 @@ describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
     expect(persisted.error, "the event count left the copy").not.toMatch(/\d+ events?/);
     expect(persisted.completedAt).not.toBe("");
     const rows = record.toolCalls();
-    expect(rows.length, "fewer rounds ran than were scripted: the budget stopped the graph").toBeLessThan(SCRIPTED_ROUNDS);
-    expect(rows.length).toBeGreaterThanOrEqual(MIN_TOOL_ROUNDS);
+    expect(rows.length, "exactly max_tool_rounds rounds ran: the budget counts rounds, not graph steps").toBe(MIN_TOOL_ROUNDS);
     // The message boundary: every row sits on the message whose text proposed it
     // — one "Reading file N." message per row, no empty host (before #1097 all
     // thirteen rows sat on ONE empty message).
@@ -144,4 +160,48 @@ describe("ExecuteDeepAgent hermetic — tool-call budget exhausted", () => {
     const json = JSON.stringify(toJson(AgentExecutionStatusSchema, persisted), null, 2) + "\n";
     await expect(json).toMatchFileSnapshot("./goldens/recursion-limit.persisted.status.json");
   });
+
+  it("continues on the next message from the checkpoint the stop left (sqlite)", async () => {
+    // ── Arrange: the first message exhausts its budget ───────────────────────
+    const first = beginDeepAgentScenario({
+      env,
+      clock,
+      record: deepAgentExecutionRecord({ message: "Keep reading files.", maxToolRounds: MIN_TOOL_ROUNDS }),
+      checkpointer: "sqlite",
+      script: () => ({ turns: readingRounds() }),
+    });
+    await runDeepAgentTurn(first);
+    expect(first.record.lastFullStatus!.phase).toBe(ExecutionPhase.EXECUTION_TERMINATED);
+    expect(first.record.toolCalls()).toHaveLength(MIN_TOOL_ROUNDS);
+
+    // The follow-up's script is indexed by the rounds its transcript holds: a
+    // model that saw the ten rounds answers in text; one that lost them would
+    // play turn 0 and read a file.
+    const LOST_THREAD: ScriptedTurn = {
+      text: "Starting over.",
+      toolCalls: [{ id: "call-hermetic-lost-thread", name: "read_file", args: { file_path: "/lost.md" } }],
+    };
+    const PICKED_UP: ScriptedTurn = { text: "Picking up where I left off: all ten files are read." };
+    const roundsSeen: number[] = [];
+    const record = deepAgentExecutionRecord({ message: "Continue.", maxToolRounds: MIN_TOOL_ROUNDS });
+    const next = continueDeepAgentScenario(first, {
+      record,
+      script: () => ({ turns: [...Array.from({ length: MIN_TOOL_ROUNDS }, () => LOST_THREAD), PICKED_UP] }),
+      onTurn: (info) => {
+        roundsSeen.push(info.round);
+      },
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runDeepAgentTurn(next);
+
+    // ── Assert ───────────────────────────────────────────────────────────────
+    expect(invocation.outcome.kind).toBe("returned");
+    expect(roundsSeen, "the follow-up's one model turn saw the ten rounds the stop checkpointed").toEqual([MIN_TOOL_ROUNDS]);
+    expect(record.persistedPhases).toEqual([ExecutionPhase.EXECUTION_IN_PROGRESS, ExecutionPhase.EXECUTION_COMPLETED]);
+    const persisted = record.lastFullStatus!;
+    expect(persisted.error).toBe("");
+    const answer = persisted.messages.filter((m) => m.type === MessageType.MESSAGE_AI).at(-1);
+    expect(answer?.content).toBe(PICKED_UP.text);
+  });
 });

package/src/activities/execute-deep-agent/__tests__/hermetic/resolution-error.test.ts

@@ -5,7 +5,7 @@
  * Invariant pinned: the runtime's blueprint phase throws, the runtime's
  * catch takes its generic-error arm (`terminal-table.ts` `unexpectedErrorArm`),
  * persists ONE EXECUTION_FAILED status carrying
- * `status.error = "Execution failed: [Error] <message>"` and two system rows
+ * `status.error = "[Error] <message>"` and two system rows
  * — the boilerplate "Internal system error occurred. Please contact support
  * if this issue persists." and `"Error details: [Error] <message>"` — and
  * RETURNS the slim status (the workflow reads the phase; a throw would make
@@ -14,10 +14,14 @@
  *
  * The row shape is one of the alignments #1096 made on purpose: the
  * orchestrator wrote one row `"Error: [Error] <message>"`; the runtime's arm
- * writes the boilerplate plus the details row. `status.error` itself did
- * not move (the conformance suite pins it). The setup labels are the
+ * writes the boilerplate plus the details row. The setup labels are the
  * runtime's resolution phases'.
  *
+ * Golden hunk since stigmer#1122: `status.error` is `[Error] <message>`, the
+ * details row's text, where it was `Execution failed: [Error] <message>`.
+ * This arm alone framed the error; every other FAILED arm, and this
+ * harness's own thrown-turn classification, writes the failure unframed.
+ *
  * Carried from `index.test.ts` ("returns EXECUTION_FAILED status when setup
  * fails", "includes error message in failed status", "always returns a
  * serializable result").
@@ -70,7 +74,7 @@ describe("ExecuteDeepAgent hermetic — resolution error", () => {
     env.dispose();
   });
 
-  it("fails with the fault's message in status.error and one system row, and returns", async () => {
+  it("fails with the fault's message in status.error and two system rows, and returns", async () => {
     // ── Arrange ──────────────────────────────────────────────────────────────
     const record = deepAgentExecutionRecord({ message: "Never reaches a model." });
     const scenario = beginDeepAgentScenario({
@@ -101,7 +105,7 @@ describe("ExecuteDeepAgent hermetic — resolution error", () => {
 
     // ── Assert: the copy ─────────────────────────────────────────────────────
     const final = record.lastFullStatus!;
-    expect(final.error).toBe(`Execution failed: [Error] ${CONTROL_PLANE_FAULT}`);
+    expect(final.error).toBe(`[Error] ${CONTROL_PLANE_FAULT}`);
     expect(final.messages.filter((m) => m.type === MessageType.MESSAGE_SYSTEM).map((m) => m.content)).toEqual([
       "Internal system error occurred. Please contact support if this issue persists.",
       `Error details: [Error] ${CONTROL_PLANE_FAULT}`,