fix(convex): stop researcher flicker, stream delegation sub-threads, gate on approval

[larryro]

Summary

Three related bugs that surface when the researcher agent runs a research plan (reported from demo.tale.dev, reproduced locally by creating a todo plan and starting research):

1. Crash / flicker loop (console TypeError: …reading 'filter')

getThreadMessagesStreaming's unauthenticated / no-access fallbacks returned streams: { value: null } — a shape the @convex-dev/agent client can't read. useDeltaStreams does streamList.streams.messages.filter(...), so .messages being undefined threw "Cannot read properties of undefined (reading 'filter')", crash-looping the chat-input error boundary (the blank↔visible flicker).

Fix: return a payload matching the requested streamArgs.kind via a new emptyStreamsResult helper ({ kind: 'list', messages: [] } / { kind: 'deltas', deltas: [] } / undefined).

2. Deterministic root cause of the flicker — sub-threads aren't accessible

The chat UI streams a delegate's sub-thread to render the nested delegation timeline (message-segments.tsx → useThreadMessages(subThreadId)). But delegated sub-threads are created through the Agent SDK component with no threadMetadata row (get_or_create_sub_thread.ts), so canAccessThread denied them on every tick → fallback fired deterministically (network-independent, hence reproducible locally).

Fix: add canAccessThreadOrSubThread, which authorizes a sub-thread via the parent thread it was spawned from (bounded walk up summary.parentThreadId), used only on the streaming read path so ordinary RLS is untouched. This restores the live timeline instead of merely not crashing.

3. Approval gate bypassed — researcher starts before the user confirms

request_human_input only tells the model to stop; the chat agent loop had no stopWhen, so with maxSteps: 40 the researcher barrelled past its "确认研究计划 / Proceed?" card straight into web searches.

Fix: add stopWhen: [stepCountIs(maxSteps), hasToolCall('request_human_input')] at the streamText/generateText call sites, scoped to agents that actually expose the tool, making the gate a hard stop. (Setting stopWhen makes the SDK ignore the config's maxSteps, so the step cap is folded back in via stepCountIs.)

Blast radius

• (1) is a pure defensive correctness fix on the streaming query return shape.
• (2) adds a new helper used only by the streaming query; hot RLS paths still call canAccessThread.
• (3) only changes loop behaviour for agents that expose request_human_input (researcher and any future agent that asks for input).

Tests

• can_access_thread.test.ts: sub-thread parent-resolution access — grant via owned parent, deny via inaccessible parent, deny orphan (no metadata + no parent), nested delegation walks to an accessible ancestor.
• get_thread_messages_streaming.test.ts: emptyStreamsResult shape for list / deltas / undefined.
• Full tsc --noEmit clean; oxlint --type-aware clean on changed files.

Verification notes

Not yet manually verified against a running researcher run end-to-end — recommend a quick /verify (start a deep-research plan, confirm: no flicker, the nested timeline renders live, and research does NOT begin until the plan-confirmation card is answered).