[Suggestion] R1-34: The code field added to ManagedToolConflictError has no read site — both 409 responses re-type the literal — so the class that reads as the single source of truth for a contract-declared "shared stable code" defines nothing.

Grep over packages/cli/src/serve: the symbol appears at the declaration, the three throws, and routes.ts (import + instanceof); nothing reads .code. The 409 bodies hardcode code: 'managed_runtime_identity_conflict' at routes.ts:133 and :152, and handleManagedRuntimeJsonError only inspects error.type. Renaming the code in the class changes nothing on the wire, breaks no test (worker.test.ts:168-170 asserts the fixture literal), and leaves the class asserting a code the route no longer sends — against doc:97 "JSON errors retain the shared stable codes". The string is hand-synced across three sites. (AGENTS.md Code Review: "For every added field ... grep its read sites ... a foo?: boolean that is declared and read but never set ... is a dead switch".)

Witness: mutation deleting the field (export class ManagedToolConflictError extends Error {}) → three serve suites 135 passed (135), identical to baseline; .code read sites → 0.

Suggested fix: either delete the field (the route literals are the only truth today), or emit it — res.status(409).json({ code: error.code, error: error.message }) at routes.ts:150-154 and drop the duplicate literal at :133 in favour of the same constant.

The wire string must stay exactly managed_runtime_identity_conflict either way (routes.ts:133/:152 send it today; doc:97 requires stable codes; the Java consumer parses the same closed error object).

— qwen3.8-max via Qwen Code /review (v0.24.6)

[Critical] R1-2: [fails-closed] [new-surface] The invocation journal is keyed on reference.callId alone, but sameInvocation/sameReference require the full 4-tuple (sessionId, promptId, callId, argsDigest). One worker serving multiple Runtime sessions permanently rejects a second session that reuses a callId.

callId is only unique per conversation (toolCallIdUtils.nextGeneratedId emits call_qwen_N from each session's own usedIds). The worker is built to serve multiple sessions (design §6: "can serve multiple Runtime sessions"; this PR's own test returns file contents for separate calls across sessions drives one worker with session-a and session-b, dodging the collision only by using different callIds). When session-b sends {sessionId:'session-b', callId:'call_qwen_1'}, entries.get('call_qwen_1') hits session-a's entry, sameReference is false, and execute throws ManagedToolConflictError → 409 managed_runtime_identity_conflict, which the Java transport marks non-retryable. Entries are never evicted, so that callId is poisoned for the whole generation; session-b's status/cancel return 200 unknown and its call can never succeed.

Witness (real executor, unmodified PR code):

session-a first execute: success [{type:text,text:"file contents"}]
session-b same callId+promptId+digest, different sessionId: threw ManagedToolConflictError "Managed Runtime invocation identity conflicts."
session-b status lookup: null    session-b cancel lookup: null
grep 'entries.(delete|clear|size)' -> 0 matches (never evicted)

Suggested fix: key the journal on the full call identity (e.g. `${sessionId}\u0000${promptId}\u0000${callId}`) at the get/set/lookup sites; keep sameInvocation comparing argsDigest and inputJson.

The composite key must not include argsDigest — ToolExecutionRecord.java:71-78 treats it as part of the Broker-side record identity, so folding it in would turn a same-callId/different-digest retry into a second real execution (double side effect); keep that case a 409 via sameInvocation.

Add a worker case: same callId+argsDigest, sessionId session-a then session-b, each executing run_shell_command appending to calls.txt; assert both settle success and calls.txt has two lines — reverting the key to reference.callId must turn it red.

session-a first execute: success [{type:text,text:"file contents"}]
session-b same callId+promptId+digest, different sessionId: threw ManagedToolConflictError "Managed Runtime invocation identity conflicts."
session-b status lookup: null    session-b cancel lookup: null
grep 'entries.(delete|clear|size)' -> 0 matches (never evicted)

— qwen3.8-max via Qwen Code /review (v0.24.6)