feat(delegate): cross-agent file state coordination for concurrent subagents

[teknium1]

Concurrent subagents that touch the same file can no longer produce mangled edits — the mangle scenario from #11215 is now caught with a sibling-named warning before the stale write lands.

What changed

New tools/file_state.py — process-wide FileStateRegistry singleton.

• Tracks per-agent read stamps: {task_id: {abspath: (mtime, read_ts, partial)}}
• Tracks the last writer globally: {abspath: (task_id, write_ts)}
• Per-path threading.Lock for read→modify→write critical sections
• check_stale names the sibling subagent ('agent_B') when a non-owner wrote after our last read
• Opt-out via HERMES_DISABLE_FILE_STATE_GUARD=1

Wiring in tools/file_tools.py:

• read_file_tool → file_state.record_read (with partial=True on offset/limit or truncated reads)
• write_file_tool → wraps the write in lock_path; check_stale result (when set) takes priority over the legacy per-task warning and names the sibling
• patch_tool → locks all target paths in sorted order (deadlock-free for multi-file V4A patches)

Delegate-completion reminder in tools/delegate_tool.py:

• Snapshots parent's read set + wall_start before running the child
• After the child returns, writes_since(parent, wall_start, parent_reads) finds subagent writes to paths the parent had read
• Appends [NOTE: subagent modified files the parent previously read — re-read before editing: X, Y] to entry.summary

Parent task_id exposure (run_agent.py):

• One-line addition: self._current_task_id = effective_task_id at the top of run_conversation so delegate_task can identify the parent in the registry

Design

Complements — does not replace — _should_parallelize_tool_batch's path-overlap check. The batch check prevents same-file parallel dispatch within one agent's turn (cheap, zero API cost). The registry catches cross-subagent and cross-turn staleness at write time. Different phases, one mechanism per phase.

Warning-only, never hard-fails. Matches existing project style and lets the model continue. In practice, sibling writes usually invalidate the old_string in patch operations, which already errors cleanly — the warning just surfaces why.

Validation

	Before	After
Agent A reads x, Agent B writes x, Agent A writes x	A silently overwrites B's changes	A's write carries _warning naming agent_B with timestamps
Parallel writes to same path	Interleave	Serialized via per-path lock
Parallel writes to different paths	Parallel	Still parallel
Parent reads foo.py, child edits foo.py	Parent unaware	Parent summary gets [NOTE: subagent modified foo.py — re-read before editing]
Same agent consecutive writes	Clean	Clean (no false warning)
HERMES_DISABLE_FILE_STATE_GUARD=1	—	All checks become no-ops

Tests: tests/tools/test_file_state_registry.py — 16 tests (registry unit + real-handler integration).

scripts/run_tests.sh tests/tools/test_file_state_registry.py \
  tests/tools/test_file_staleness.py \
  tests/tools/test_file_tools.py \
  tests/tools/test_file_write_safety.py \
  tests/tools/test_file_read_guards.py \
  tests/tools/test_accretion_caps.py \
  tests/tools/test_delegate.py
# 142 passed

Also E2E-tested the motivating scenario with real handlers in an isolated HERMES_HOME: parallel agents A+B patching the same file → B wins, A's patch errors with old_string not found AND carries the sibling-named warning, final file content matches B's edit. No mangle path exists.