Tests (issue #5)
- Update all FakeProvider mocks from chat() to chat_stream() async
  generators; all 4 tests now pass (were 3/4 failing)

_strip_think_blocks (issue #6)
- Apply as a safety net on visible_content so think-tagged text
  that leaks through text deltas is stripped before the final result
- Use visible_content (stripped) for final_content too

System prompt alignment (issue #3)
- memory_delegate: build tools before constructing the system prompt
- Call SessionPrompt.build_system_prompts() with a synthetic session_id
  so the sub-agent gets PROMPT_DEFAULT (SecOps identity + guardrails),
  tool_protocol, and agent_identity — identical foundation to main loop

Parallel TOCTOU guard (issue #4)
- delegate_task is now serial against any non-delegation tool: prevents
  TOCTOU races where a sub-agent writes files while the parent loop
  concurrently reads (glob/grep); multiple delegations can still run
  concurrently against each other

gateway.chat_stream tool_calls robustness (issue #11)
- Emit any accumulated tool_calls after the stream loop ends, so they
  are not silently dropped when a gateway omits finish_reason on the
  final tool-call chunk

loop_engine fallback warning (issue #12)
- _resolve_loop_engine() now logs a warning when the requested engine
  id (session-level or agent-default) is not registered, making
  silent "UI shows Raptor, runs native" situations observable in logs

loop_engine persistence deduplication (issue #13)
- Extract repeated loop_engine persistence blocks into
  _persist_loop_engine_if_changed(); both message routes call it

Co-authored-by: Cursor <cursoragent@cursor.com>