What broke

An agent runner accepted notifications from two authenticated work endpoints. Each channel turn was deliberately restricted to its originating endpoint's tools. The queue folded untracked follow-up prompts into an active turn without checking whether their channel origin matched that turn.

How it showed

A fresh telemetry probe reached the durable work queue and remained pending. The worker attempted its claim tool. The transcript returned a tool-not-found error; the available tool list contained the other endpoint's tools. A validator that waited for a worker acknowledgement timed out despite successful transport.

What was watching

Health checks verified the receiver and queue service. An integration probe verified an idle worker's claim and completion path. Queue tests covered run IDs, cancellation, and ordinary follow-up prompts, but did not mix channel origins. Tool isolation was correct for the active turn and therefore excluded the tool the queued notification required. The end-to-end validator finally failed, and an operator inspected the transcript to identify the mismatch within two hours.

Where it sits

This is a runtime failure in interleaved notification delivery. It is an invariants failure because queued work lost the execution boundary associated with its origin. Integration tests were present but covered the happy path and queue lifecycle separately. Runtime invariants protected tool reach per turn, but the queue did not require matching origins before combining prompts into that turn.

What we did

The step queue now folds only same-origin prompts. A notification from another channel waits for its own turn, which receives that channel's tool scope. Tool permissions were not broadened. The complete agent test subtree passed. The replacement runtime was installed with a rollback backup, and the worker was restarted after both endpoint queues showed no active claims. A fresh scheduled telemetry probe was claimed and acknowledged after the restart. The change is proposed in the runner pull request.

What now fails loudly

The queue regression starts with a same-origin prompt, another channel's prompt, and a local prompt. Only the same-origin prompt folds. The others preserve their origins and remain available for subsequent turns. Reintroducing the old predicate makes the test fail because three prompts fold instead of one. Existing cancellation, system delivery, and run-completion tests also pass. Deployment validation requires the worker's completion receipt as well as durable delivery.