@stigmer/server 3.36.0 → 3.37.1

package/src/domain/agentexecution/__tests__/update-status.test.ts

@@ -5,6 +5,10 @@
  * transcript regression guard (shrink + front-truncation-with-append +
  * the terminal exemption), the equal-length approval finalize, and the
  * presence-guarded runner-owned field pattern (recalled_memories_report).
+ * Also pins the platform-row rules (platform-rows.ts, stigmer#980): a
+ * platform marker write is appended to the transcript and never replaces
+ * it, idempotently, and a PAUSED or CANCELLED execution's stop row stays
+ * last across the runner's late writes, whatever order they land in.
  * These exercise applyUpdateStatusMerge directly on a clone — mirroring
  * the freshly-loaded resource the merge mutates in place inside the
  * updateResource write lock.
@@ -31,6 +35,7 @@ import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexec
 
 import { createLogger } from "../../../boot/logger.js";
 import { findToolCallInExecution } from "../submit-approval.js";
+import { CANCEL_STOP_ROW, PAUSE_STOP_ROW } from "../platform-rows.js";
 import { applyUpdateStatusMerge } from "../update-status.js";
 
 const silentLogger = createLogger({
@@ -367,3 +372,215 @@ describe("the presence-guarded runner-owned field pattern (recalled_memories_rep
     expect(merged.status?.recalledMemoriesReport).toBeUndefined();
   });
 });
+
+describe("platform rows (stigmer#980)", () => {
+  // The runner's transcript: AI and tool turns, then (for a failure it
+  // reports itself) its own system rows.
+  function runnerTranscript(...contents: string[]) {
+    return contents.map((content) => ({ type: MessageType.MESSAGE_AI, content }));
+  }
+  function system(...contents: string[]) {
+    return contents.map((content) => ({ type: MessageType.MESSAGE_SYSTEM, content }));
+  }
+  function executionAt(
+    phase: ExecutionPhase,
+    msgs: MessageInitShape<typeof AgentMessageSchema>[],
+  ): AgentExecution {
+    return create(AgentExecutionSchema, {
+      metadata: { id: "exec-rows", name: "exec-rows" },
+      spec: {},
+      status: { phase, messages: msgs },
+    });
+  }
+  function contents(execution: AgentExecution): string[] {
+    return (execution.status?.messages ?? []).map((m) => m.content);
+  }
+
+  describe("a platform marker write is appended, never substituted", () => {
+    it("appends the cancel row to a transcript already persisted CANCELLED", () => {
+      // The Cancel RPC persisted CANCELLED first, then the workflow's
+      // cancellation cleanup lands its row: today it replaced the whole
+      // transcript with that one line.
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_CANCELLED, runnerTranscript("a1", "a2")),
+        { phase: ExecutionPhase.EXECUTION_CANCELLED, messages: system(CANCEL_STOP_ROW) },
+      );
+      expect(contents(merged)).toEqual(["a1", "a2", CANCEL_STOP_ROW]);
+    });
+
+    it("appends the broken-flow failure lines to a FAILED transcript", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_FAILED, runnerTranscript("a1", "a2", "a3")),
+        {
+          phase: ExecutionPhase.EXECUTION_FAILED,
+          error: "boom",
+          messages: system("Internal failure.", "Error details: boom"),
+        },
+      );
+      expect(contents(merged)).toEqual([
+        "a1",
+        "a2",
+        "a3",
+        "Internal failure.",
+        "Error details: boom",
+      ]);
+    });
+
+    it("appends a marker landing before the phase is terminal instead of dropping it to the shrink guard", () => {
+      // The runner died without persisting a terminal: the stored phase is
+      // still IN_PROGRESS, and the failure lines are shorter than the
+      // transcript. Today the shrink guard dropped them.
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_IN_PROGRESS, runnerTranscript("a1", "a2", "a3")),
+        {
+          phase: ExecutionPhase.EXECUTION_FAILED,
+          messages: system("Internal failure.", "Error details: boom"),
+        },
+      );
+      expect(contents(merged)).toEqual([
+        "a1",
+        "a2",
+        "a3",
+        "Internal failure.",
+        "Error details: boom",
+      ]);
+      expect(merged.status?.phase).toBe(ExecutionPhase.EXECUTION_FAILED);
+    });
+
+    it("is idempotent: an activity retry of the same marker appends nothing", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_FAILED, [
+          ...runnerTranscript("a1"),
+          ...system("Internal failure.", "Error details: boom"),
+        ]),
+        {
+          phase: ExecutionPhase.EXECUTION_FAILED,
+          messages: system("Internal failure.", "Error details: boom"),
+        },
+      );
+      expect(contents(merged)).toEqual(["a1", "Internal failure.", "Error details: boom"]);
+    });
+
+    it("keeps an all-system write that extends the stored transcript a replacement (the runner's own growth)", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_IN_PROGRESS, system("s1")),
+        { phase: ExecutionPhase.EXECUTION_IN_PROGRESS, messages: system("s1", "s2") },
+      );
+      expect(contents(merged)).toEqual(["s1", "s2"]);
+    });
+
+    it("keeps a system write onto an empty transcript a replacement", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_IN_PROGRESS, []),
+        { phase: ExecutionPhase.EXECUTION_FAILED, messages: system("Internal failure.") },
+      );
+      expect(contents(merged)).toEqual(["Internal failure."]);
+    });
+
+    it("keeps the runner's full terminal write a replacement (the terminal exemption is untouched)", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_FAILED, runnerTranscript("a1", "a2")),
+        {
+          phase: ExecutionPhase.EXECUTION_FAILED,
+          messages: [...runnerTranscript("a1-final"), ...system("Execution failed: x")],
+        },
+      );
+      expect(contents(merged)).toEqual(["a1-final", "Execution failed: x"]);
+    });
+  });
+
+  describe("a stop row stays last across the runner's late writes", () => {
+    it("re-appends the cancel row after a late runner write that extends the transcript", () => {
+      // Cancel's three writers race: the RPC's CANCELLED persist and the
+      // workflow's row landed; the runner's settle write (it learns of the
+      // cancel on its next heartbeat) lands last, carrying no row.
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_CANCELLED, [
+          ...runnerTranscript("a1"),
+          ...system(CANCEL_STOP_ROW),
+        ]),
+        { messages: runnerTranscript("a1", "a2") },
+      );
+      expect(contents(merged)).toEqual(["a1", "a2", CANCEL_STOP_ROW]);
+      expect(merged.status?.phase).toBe(ExecutionPhase.EXECUTION_CANCELLED);
+    });
+
+    it("keeps the pause row last when the runner's settle write lands after it", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_PAUSED, [
+          ...runnerTranscript("a1"),
+          ...system(PAUSE_STOP_ROW),
+        ]),
+        { messages: runnerTranscript("a1") },
+      );
+      expect(
+        contents(merged),
+        "the settle write does not trip the shrink guard on the row, and does not drop it",
+      ).toEqual(["a1", PAUSE_STOP_ROW]);
+    });
+
+    it("merges a longer settle write under the pause row", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_PAUSED, [
+          ...runnerTranscript("a1"),
+          ...system(PAUSE_STOP_ROW),
+        ]),
+        { messages: runnerTranscript("a1", "a2", "a3") },
+      );
+      expect(contents(merged)).toEqual(["a1", "a2", "a3", PAUSE_STOP_ROW]);
+    });
+
+    it("still guards a paused transcript against a real shrink", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_PAUSED, [
+          ...runnerTranscript("a1", "a2"),
+          ...system(PAUSE_STOP_ROW),
+        ]),
+        { messages: runnerTranscript("a1") },
+      );
+      expect(contents(merged)).toEqual(["a1", "a2", PAUSE_STOP_ROW]);
+    });
+
+    it("does not duplicate the row when a retry of the stop marker lands on it", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_CANCELLED, [
+          ...runnerTranscript("a1"),
+          ...system(CANCEL_STOP_ROW),
+        ]),
+        { phase: ExecutionPhase.EXECUTION_CANCELLED, messages: system(CANCEL_STOP_ROW) },
+      );
+      expect(contents(merged)).toEqual(["a1", CANCEL_STOP_ROW]);
+    });
+
+    it("treats the pause row as ordinary history once a resume moved the phase on", () => {
+      // The resumed runner seeds the persisted transcript, row included,
+      // and grows it; nothing is held back or re-appended.
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_IN_PROGRESS, [
+          ...runnerTranscript("a1"),
+          ...system(PAUSE_STOP_ROW),
+        ]),
+        {
+          phase: ExecutionPhase.EXECUTION_IN_PROGRESS,
+          messages: [
+            ...runnerTranscript("a1"),
+            ...system(PAUSE_STOP_ROW),
+            ...runnerTranscript("a2"),
+          ],
+        },
+      );
+      expect(contents(merged)).toEqual(["a1", PAUSE_STOP_ROW, "a2"]);
+    });
+
+    it("never holds a row the phase does not own (a pause row on a CANCELLED execution is history)", () => {
+      const merged = runBuildStep(
+        executionAt(ExecutionPhase.EXECUTION_CANCELLED, [
+          ...runnerTranscript("a1"),
+          ...system(PAUSE_STOP_ROW),
+        ]),
+        { messages: [...runnerTranscript("a1"), ...system(PAUSE_STOP_ROW), ...runnerTranscript("a2")] },
+      );
+      expect(contents(merged)).toEqual(["a1", PAUSE_STOP_ROW, "a2"]);
+    });
+  });
+});

package/src/domain/agentexecution/artifacts.ts

@@ -57,6 +57,7 @@ import {
   invalidArgumentError,
 } from "../../pipeline/errors.js";
 import { authorizeDirect } from "../../pipeline/steps/authorize.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import { casBlobContentMismatch } from "./filereview/cas-blob.js";
 
@@ -254,18 +255,22 @@ export async function getArtifactContent(
     throw invalidArgumentError("storage_key does not belong to this execution");
   }
 
-  // Existence check (Go answers NotFound for any load failure here).
+  // Existence check: only a missing execution is NotFound; any other store
+  // failure is an infrastructure fault.
   try {
     await deps.store.getResource(
       ApiResourceKind.agent_execution,
       req.executionId,
       AgentExecutionSchema,
     );
-  } catch {
-    throw new ConnectError(
-      `execution not found: ${req.executionId}`,
-      Code.NotFound,
-    );
+  } catch (error) {
+    if (error instanceof ResourceNotFoundError) {
+      throw new ConnectError(
+        `execution not found: ${req.executionId}`,
+        Code.NotFound,
+      );
+    }
+    throw internalError(error, "failed to load agent execution");
   }
 
   let maxBytes = Number(req.maxBytes);
@@ -424,7 +429,8 @@ export async function getArtifactDownloadUrl(
   );
 
   // Load BEFORE the key check: the attachment arm needs spec.attachments,
-  // and this doubles as the existence check.
+  // and this doubles as the existence check (a missing execution is
+  // NotFound; any other store failure is an infrastructure fault).
   let execution: AgentExecution;
   try {
     execution = await deps.store.getResource(
@@ -432,11 +438,14 @@ export async function getArtifactDownloadUrl(
       req.executionId,
       AgentExecutionSchema,
     );
-  } catch {
-    throw new ConnectError(
-      `execution not found: ${req.executionId}`,
-      Code.NotFound,
-    );
+  } catch (error) {
+    if (error instanceof ResourceNotFoundError) {
+      throw new ConnectError(
+        `execution not found: ${req.executionId}`,
+        Code.NotFound,
+      );
+    }
+    throw internalError(error, "failed to load agent execution");
   }
 
   // Same normalize-before-check posture as getArtifactContent

package/src/domain/agentexecution/constants.ts

@@ -14,21 +14,6 @@
 export const ENGINE_UNAVAILABLE_MESSAGE =
   "The execution engine is temporarily unavailable. Please try again shortly.";
 
-/**
- * getExecutionUsageReport's unknown-execution refusal. Go
- * (get_execution_usage_report.go) calls
- * NotFoundError("agent execution '%s' not found", executionID) — but that
- * helper's signature is (resource, id) rendering "%s not found: %s", so
- * the literal '%s' and the doubled "not found" reach the wire. Ported
- * byte-faithfully per sub-project DD-001 (owner-ratified 2026-08-24);
- * the both-editions fix is stigmer/stigmer#859.
- */
-export function executionUsageReportNotFoundMessage(
-  executionId: string,
-): string {
-  return `agent execution '%s' not found not found: ${executionId}`;
-}
-
 /**
  * The run gate's deny copy per request shape (P1 sp.run-gate, ruling
  * Q-RG-4; wire once merged, asserted by the conformance run-gate suite).

package/src/domain/agentexecution/lifecycle.ts

@@ -135,9 +135,11 @@ function newLoadExecutionByIdStep<Desc extends DescMessage>(
           executionId,
           AgentExecutionSchema,
         );
-      } catch {
-        // Go converts every load failure here to the same NotFound.
-        throw notFoundError("agent_execution", executionId);
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          throw notFoundError("agent_execution", executionId);
+        }
+        throw internalError(error, "failed to load agent execution");
       }
       ctx.set(LOADED_EXECUTION_KEY, execution);
     },

package/src/domain/agentexecution/platform-rows.ts

@@ -0,0 +1,133 @@
+/**
+ * Platform rows: the MESSAGE_SYSTEM lines the server itself writes into
+ * an execution's transcript, and the transcript rules that keep them.
+ * The runner owns the transcript; these are the few rows only the
+ * platform can write, because only the platform knows the fact they
+ * state (stigmer#980).
+ *
+ * - Stop rows say why a run stopped when the stop came from outside the
+ *   turn. The runner cannot tell a Pause from a Cancel: both reach its
+ *   activity as the same Temporal cancellation (reason CANCELLED), and
+ *   both RPCs signal the engine before they persist the phase
+ *   (lifecycle.ts), so no stored fact distinguishes them in time. The
+ *   invoke workflow knows which stop it is running, so it writes the row
+ *   (workflows/invoke-agent-execution.ts) and the runner writes none.
+ * - A platform marker write is a status update whose messages are all
+ *   MESSAGE_SYSTEM and do not extend the stored transcript: the
+ *   workflow's stop rows and its broken-flow failure lines. A marker is
+ *   appended, never substituted for the transcript. Every runner write
+ *   is a superset of the stored transcript (a resumed runner seeds from
+ *   it, runner/src/harness/turn-context.ts) and the runner only ever
+ *   appends system rows, so a runner write never reads as a marker.
+ *
+ * Messages carry no id (agentexecution/v1/message.proto), so rows are
+ * identified by type and content: the stop copy is these exact
+ * constants, defined once here for the workflow and the merge, and never
+ * matched against copy some other component authors.
+ *
+ * Pure (protos only): the workflow bundle imports this module by direct
+ * path (src/temporal/README.md, workflow-bundle import discipline).
+ */
+import {
+  ExecutionPhase,
+  MessageType,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+
+/** The stop row of a paused execution. Byte-identical to the copy the runner wrote before stigmer#980 moved it here. */
+export const PAUSE_STOP_ROW =
+  "Execution paused by user. Use resume to continue.";
+
+/** The stop row of a cancelled execution: a quiet terminal state, never a failure (stigmer#282). */
+export const CANCEL_STOP_ROW = "Execution was cancelled.";
+
+/** The stop row a phase carries, or undefined for a phase the platform does not explain. */
+export function stopRowForPhase(phase: ExecutionPhase): string | undefined {
+  switch (phase) {
+    case ExecutionPhase.EXECUTION_PAUSED:
+      return PAUSE_STOP_ROW;
+    case ExecutionPhase.EXECUTION_CANCELLED:
+      return CANCEL_STOP_ROW;
+    default:
+      return undefined;
+  }
+}
+
+/** Whether two rows are the same row: messages carry no id, so identity is type and content. */
+function sameRow(a: AgentMessage, b: AgentMessage): boolean {
+  return a.type === b.type && a.content === b.content;
+}
+
+/** Whether transcript ends with tail, row for row. */
+export function endsWithRows(
+  transcript: readonly AgentMessage[],
+  tail: readonly AgentMessage[],
+): boolean {
+  if (tail.length > transcript.length) {
+    return false;
+  }
+  const offset = transcript.length - tail.length;
+  return tail.every((row, i) => sameRow(transcript[offset + i], row));
+}
+
+/**
+ * Whether incoming is a platform marker write against existing: every
+ * incoming row is MESSAGE_SYSTEM, and it does not extend a non-empty
+ * stored transcript (existing is not a row-for-row prefix of incoming).
+ * An all-system write that does extend it is the runner's own growth; a
+ * write onto an empty transcript has nothing to preserve.
+ */
+export function isPlatformMarkerWrite(
+  existing: readonly AgentMessage[],
+  incoming: readonly AgentMessage[],
+): boolean {
+  if (existing.length === 0 || incoming.length === 0) {
+    return false;
+  }
+  if (!incoming.every((row) => row.type === MessageType.MESSAGE_SYSTEM)) {
+    return false;
+  }
+  const extendsExisting =
+    incoming.length >= existing.length &&
+    existing.every((row, i) => sameRow(row, incoming[i]));
+  return !extendsExisting;
+}
+
+/**
+ * Appends a marker write's rows to the transcript; a retry of a marker
+ * already at the transcript's end appends nothing, so the workflow's
+ * activity retries stay idempotent.
+ */
+export function appendPlatformMarker(
+  existing: readonly AgentMessage[],
+  marker: readonly AgentMessage[],
+): AgentMessage[] {
+  if (endsWithRows(existing, marker)) {
+    return [...existing];
+  }
+  return [...existing, ...marker];
+}
+
+/**
+ * The stop row the merge holds last: the stored transcript's final row
+ * when it is the stored phase's own stop row. While the execution rests
+ * in that phase, the row is the platform's, not part of what the runner's
+ * later writes replace; once the phase moves on (a resume), it is
+ * ordinary history and nothing is held.
+ */
+export function heldStopRow(
+  phase: ExecutionPhase,
+  transcript: readonly AgentMessage[],
+): AgentMessage | undefined {
+  const copy = stopRowForPhase(phase);
+  const last = transcript[transcript.length - 1];
+  if (
+    copy === undefined ||
+    last === undefined ||
+    last.type !== MessageType.MESSAGE_SYSTEM ||
+    last.content !== copy
+  ) {
+    return undefined;
+  }
+  return last;
+}

package/src/domain/agentexecution/subscribe.ts

@@ -46,10 +46,12 @@ import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
 import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
 import {
+  internalError,
   invalidArgumentError,
   notFoundError,
 } from "../../pipeline/errors.js";
 import { authorizeDirect } from "../../pipeline/steps/authorize.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 
 import { isTranscriptTerminalPhase } from "./phases.js";
@@ -97,9 +99,11 @@ export async function* subscribeExecution(
         id,
         AgentExecutionSchema,
       );
-    } catch {
-      // Go converts every load failure here to the same NotFound.
-      throw notFoundError("AgentExecution", id);
+    } catch (error) {
+      if (error instanceof ResourceNotFoundError) {
+        throw notFoundError("AgentExecution", id);
+      }
+      throw internalError(error, "failed to load agent execution");
     }
 
     yield snapshot;

package/src/domain/agentexecution/update-status.ts

@@ -2,8 +2,8 @@
  * UpdateStatus — ports controller/update_status.go: the runner's
  * progressive status-update RPC and the domain's single merge chokepoint.
  *
- * Chain per Go: ValidateUpdateStatusInput → MergeAndPersistExecution →
- * NotifyStatusObservers → BroadcastToStreams. The merge+persist is ONE
+ * Chain: Authorize → ValidateUpdateStatusInput → MergeAndPersistExecution
+ * → NotifyStatusObservers → BroadcastToStreams. The merge+persist is ONE
  * atomic read-modify-write under the store's per-resource write lock
  * (store.updateResource) — the same discipline SubmitApproval uses,
  * load-bearing now that the append-only approval_event_stream is the
@@ -24,10 +24,14 @@
  * wholesale with the runner's latest complete state, while server-owned
  * fields (approval decisions, the approval_event_stream, the file_review
  * ledger) are preserved/authored here because the runner never sends
- * them.
+ * them. The transcript's platform rows are the same kind of server-owned
+ * state (platform-rows.ts, stigmer#980): a platform marker write is
+ * appended and never replaces the transcript, and a PAUSED or CANCELLED
+ * execution's stop row stays last across the runner's later writes,
+ * because the Pause and Cancel RPCs, the invoke workflow and the runner
+ * all write a stopped execution and nothing orders them.
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, PublishToRedis, and
- * Publish steps (broadcast rides in-memory channels per ADR 011).
+ * Broadcast rides in-memory channels (ADR 011).
  */
 import { create } from "@bufbuild/protobuf";
 
@@ -78,6 +82,12 @@ import {
   isTerminalExecutionPhase,
   isTranscriptTerminalPhase,
 } from "./phases.js";
+import {
+  appendPlatformMarker,
+  endsWithRows,
+  heldStopRow,
+  isPlatformMarkerWrite,
+} from "./platform-rows.js";
 import {
   applyResponseDecorators,
   notifyStatusObservers,
@@ -257,6 +267,54 @@ export function nonTerminalTranscriptRegression(
   return { reject: false, reason: "" };
 }
 
+/**
+ * The transcript the merge persists, or undefined to keep the stored one.
+ * The stored phase's stop row, when it closes the transcript, is held
+ * aside so the runner's settle write (which never carries it) is judged
+ * against the transcript beneath it, and re-appended after. A platform
+ * marker write is appended; anything else is the runner's write, replaced
+ * wholesale unless the regression guard rejects it.
+ */
+function mergeTranscript(
+  existingPhase: ExecutionPhase,
+  existing: AgentMessage[],
+  incoming: AgentMessage[],
+  executionId: string,
+  logger: Logger,
+): AgentMessage[] | undefined {
+  const held = heldStopRow(existingPhase, existing);
+  const base = held === undefined ? existing : existing.slice(0, -1);
+
+  let next: AgentMessage[];
+  if (isPlatformMarkerWrite(base, incoming)) {
+    next = appendPlatformMarker(base, incoming);
+  } else {
+    const { reject, reason } = nonTerminalTranscriptRegression(
+      existingPhase,
+      base,
+      incoming,
+    );
+    if (reject) {
+      logger.warn(
+        "Rejected status update that would drop committed transcript history for a non-terminal execution; keeping existing messages",
+        {
+          executionId,
+          existingMessages: existing.length,
+          incomingMessages: incoming.length,
+          reason,
+        },
+      );
+      return undefined;
+    }
+    next = incoming;
+  }
+
+  if (held !== undefined && !endsWithRows(next, [held])) {
+    next = [...next, held];
+  }
+  return next;
+}
+
 /**
  * Merges an incoming status update into the execution in place — the
  * runner-owns-the-transcript merge rules, exactly update_status.go
@@ -294,7 +352,8 @@ export function applyUpdateStatusMerge(
   // any update that would drop committed transcript history for a
   // non-terminal execution. The runner owns the transcript and only ever
   // GROWS it in flight; two regressions are rejected at this single
-  // persistence chokepoint:
+  // persistence chokepoint (the platform's own rows are handled first,
+  // see mergeTranscript):
   //  1. A strictly SHORTER transcript — the classic partial write.
   //  2. A transcript that DROPS a committed tool-call id while appending
   //     enough later turns to keep the count equal-or-greater
@@ -305,23 +364,15 @@ export function applyUpdateStatusMerge(
   // post-denial narration redaction), so a content check would reject
   // valid writes.
   if (requestStatus.messages.length > 0) {
-    const { reject, reason } = nonTerminalTranscriptRegression(
+    const merged = mergeTranscript(
       existingPhase,
       existingMessages,
       requestStatus.messages,
+      input.executionId,
+      logger,
     );
-    if (reject) {
-      logger.warn(
-        "Rejected status update that would drop committed transcript history for a non-terminal execution; keeping existing messages",
-        {
-          executionId: input.executionId,
-          existingMessages: existingMessages.length,
-          incomingMessages: requestStatus.messages.length,
-          reason,
-        },
-      );
-    } else {
-      status.messages = requestStatus.messages;
+    if (merged !== undefined) {
+      status.messages = merged;
     }
   }