Start with the read. `ctx.session.state.get(AUDIT_FINDINGS_KEY)` is a dictionary lookup with a default [6]. In-process, that dictionary belongs to a session both agents share, so the Auditor's `output_key` write is sitting there when the Orchestrator looks [1][2]. Move the Auditor behind a `RemoteA2aAgent` and the same lookup runs against the caller's session while the write lands in the worker's [3]. A missing key returns the default, which is exactly what a well behaved dictionary should do.
Which line executed is a property of the code. Which session object that line executed against is a property of the deployment. A statement and branch gate proves the first and is silent on the second, which is why Arjun Ganesh's fleet could pass its configured coverage gate on the in-process graph [5][21]. The diff between the passing shape and the failing one is one argument list: same graph, different construction, including `a2a_request_meta_provider=_forward_investigation` [7]. For a coverage figure to say anything about the deployed system, CI would have to stand up a second process with its own session service and route the hop over real A2A transport. Absent that, the number is a claim about the single-process topology and nothing else.
There are two loss directions, and the writeup is careful to separate them: a remote worker writing `output_key` into its own session without exposing it to the caller, and a caller-side event whose useful result exists only as state, contributing no outgoing A2A content for the next remote step [9]. Neither throws. Ganesh notes that plausible older content can remain in the caller and keep the workflow looking successful while the new state never crossed [10], and his summary of that is the honest one: a silent wrong answer "only beats a loud failure in the sense that it survives longer" [11].
The repair is the part worth copying. Authoritative findings now cross as structured message content, and reading the reply is sound rather than a hack because `output_schema` makes the Auditor's final content validated JSON instead of prose the caller has to interpret; unparseable output is skipped and an empty result fails closed downstream [12]. The caller then checks that content field by field against deterministic tool output, so IDs, categories, departments, scores and required routing must all match, and a model can supply bounded rationale but cannot author or alter the finding set [13]. Correlation is split by scope: `invocation_id` groups one ADK run and stops at the boundary, while `investigation_id` travels as request metadata that no model reads or restates [14]. Completion is explicit, gated on a validated receipt for every required department delivery [15].
Upstream, the deployed reproducer and both directions are in google/adk-python#6854, still open [16]. Sylvester Kaczmarek's #6859 covers the state-only outbound loss and the rejected inbound remote-state-delta case, also open and unmerged [17]. A Google collaborator has said the `output_key` half is expected behaviour because remote sessions are per-agent by design, which Ganesh accepts, having asked for the boundary to become observable rather than for the semantics to change [18]; he supplied the reproduction they requested for testing #6859 the same day [19]. Two days after the deployed run, a Google maintainer closed his #6862 construction-time warning unmerged [20][22]. So the detector, for now, is yours to build, and a validated contract at the seam is cheaper than copying state across it.
