fix(code-runtime-python): remove NUL bytes and sync the Agent Note metering claim

- Replace four raw U+0000 bytes in protocol.spec.ts string literals with the
  \0 escape so the source stays plain text (a bare NUL makes text tools treat
  the file as binary); the runtime value is unchanged, so the bytes:8 NUL-escape
  assertion still holds.
- Sync the Agent Note (both languages) with the corrected checkDoneValue
  contract: the walk bounds only the incremental allocation it would add, not
  the frame width, which is already parsed and capped upstream by the host's
  fd-3 receive buffer. Drop the "prevents a hundreds-of-MB allocation" overclaim
  that the code JSDoc already retracted. Re-record the note i18n pairing.

.agents/notes/implemented/architecture/2026-07-31-code-runtime-python-fd3-protocol.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-31-code-runtime-python-fd3-protocol.md
-2026-07-31-code-runtime-python-fd3-protocol.md: 32cc80278af6b5f894c8d972854dae8c92ac63b7
-2026-07-31-code-runtime-python-fd3-protocol.zh.md: 24bb9dbb7b8df03c5c82c551449f49b4d306f248
+2026-07-31-code-runtime-python-fd3-protocol.md: 142f6aaf8093ec3e76249fecb40a6fbb13d80500
+2026-07-31-code-runtime-python-fd3-protocol.zh.md: 5a371240bb816379d50cc6331f0c6971cf37209a

.agents/notes/implemented/architecture/2026-07-31-code-runtime-python-fd3-protocol.md

@@ -15,7 +15,7 @@ This layer of the stack delivers only that protocol, so the large `PythonCodeRun
 `src/protocol.ts` is the host side of the wire vocabulary and its hostile-frame codec:
 
 - **`validateChildFrame`** shape-validates and REBUILDS every inbound frame. The compile-time union means nothing on fd 3 — a forged frame can carry `null`, poisoned fields, or omit required ones — so each accepted frame is reconstructed field by field: forged extras never ride along, a non-finite call id can never be echoed into a reply, and junk returns `undefined` to be dropped rather than throwing in the host's message handler.
-- **`encodeJsonPlain` / `checkDoneValue` / `hasUnsafeIntegerToken` / `hasNonLosslessNumber`** are the lossless-JSON codec and meters. They traverse iteratively (an explicit stack, not recursion) so a deep value below the byte budget crosses intact; `checkDoneValue` folds byte-metering and number-losslessness into one bounded walk that rejects an over-budget payload BEFORE enqueuing its children, keeping a forged below-frame-ceiling value from forcing a hundreds-of-megabytes host allocation. Beyond-safe-range integral doubles serialize through `BigInt` digits so the exact integer crosses, not `String()`'s rounded form.
+- **`encodeJsonPlain` / `checkDoneValue` / `hasUnsafeIntegerToken` / `hasNonLosslessNumber`** are the lossless-JSON codec and meters. They traverse iteratively (an explicit stack, not recursion) so a deep value below the byte budget crosses intact; `checkDoneValue` folds byte-metering and number-losslessness into one walk that rejects an over-budget payload before the INCREMENTAL work it would otherwise add — the escaped-string copy, the enqueued children, the per-key `JSON.stringify`. It does not re-bound the frame's own width: `done.value` is already `JSON.parse`'d when the check runs, so the payload's size is paid upstream and capped there by the host's fixed fd-3 receive buffer (a later stack layer), not here. Beyond-safe-range integral doubles serialize through `BigInt` digits so the exact integer crosses, not `String()`'s rounded form.
 - **`logTruncationMarker`** produces the in-band marker text a log ledger emits when it exhausts its byte budget.
 
 `py/protocol.py` mirrors the message shapes as `TypedDict`s and re-declares the two surfaces both sides EXECUTE against — `PROTOCOL_FD = 3` and `log_truncation_marker` — with byte-identical text.

.agents/notes/implemented/architecture/2026-07-31-code-runtime-python-fd3-protocol.zh.md

@@ -15,7 +15,7 @@ CPython code-runtime 后端（`@deepseek-ai/dsh-code-runtime-python`，分多个
 `src/protocol.ts` 是 wire vocabulary 的 host 侧及其敌意帧编解码：
 
 - **`validateChildFrame`** 对每个入站帧做形状校验并重建。编译期 union 在 fd 3 上毫无意义——伪造帧可携带 `null`、被污染的字段，或省略必需字段——所以每个被接受的帧都逐字段重建：伪造的额外字段绝不随行，非有限的 call id 绝不会被回显进 reply，垃圾返回 `undefined` 被丢弃，而不是在 host 的 message handler 里抛错。
-- **`encodeJsonPlain` / `checkDoneValue` / `hasUnsafeIntegerToken` / `hasNonLosslessNumber`** 是 lossless-JSON 编解码器与计量器。它们迭代遍历（显式栈，非递归），使低于字节预算的深层值能完整穿越；`checkDoneValue` 把字节计量和数字无损性折进一次有界遍历，在把子节点入栈之前就拒绝超预算 payload，防止一个低于帧上限的伪造值迫使 host 分配数百 MB。超出安全范围的整数型 double 通过 `BigInt` 数字序列化，穿越的是精确整数而非 `String()` 的舍入形式。
+- **`encodeJsonPlain` / `checkDoneValue` / `hasUnsafeIntegerToken` / `hasNonLosslessNumber`** 是 lossless-JSON 编解码器与计量器。它们迭代遍历（显式栈，非递归），使低于字节预算的深层值能完整穿越；`checkDoneValue` 把字节计量和数字无损性折进一次遍历，在它本会新增的 INCREMENTAL 工作之前就拒绝超预算 payload——转义串副本、入栈子节点、逐 key 的 `JSON.stringify`。它不会重新约束帧自身的宽度：`done.value` 在检查运行时已被 `JSON.parse`，故 payload 的尺寸是上游代价，由 host 固定的 fd-3 接收缓冲（后续 stack 层）在那里封顶，而非本函数。超出安全范围的整数型 double 通过 `BigInt` 数字序列化，穿越的是精确整数而非 `String()` 的舍入形式。
 - **`logTruncationMarker`** 产出日志 ledger 耗尽字节预算时发出的带内标记文本。
 
 `py/protocol.py` 用 `TypedDict` 镜像消息形状，并重新声明两侧都会 EXECUTE 的两个面——`PROTOCOL_FD = 3` 与 `log_truncation_marker`——文本逐字节一致。

packages/code-runtime/code-runtime-python/tests/protocol.spec.ts

@@ -214,17 +214,19 @@ describe('checkDoneValue', () => {
   })
 
   it('rejects an over-budget string on its length before escaping it', () => {
-    // A control-heavy forged string escapes to ~6x its length; the walk must
-    // refuse it on the cheap `length + 2` lower bound so the escaped copy is
-    // never allocated. Observable through the boundary: a string whose LENGTH
-    // already exceeds the cap fails even though every character is 1 byte.
-    expect(checkDoneValue(''.repeat(4096), 1024)).toEqual({ ok: false, reason: 'over-budget' })
+    // A control-heavy forged string escapes to ~6x its length (each NUL becomes
+    // the 6-character `\u0000`); the walk must refuse it on the cheap
+    // `length + 2` lower bound so the escaped copy is never allocated. Observable
+    // through the boundary: a string whose LENGTH already exceeds the cap fails
+    // even though every source character is one UTF-16 code unit.
+    expect(checkDoneValue('\0'.repeat(4096), 1024)).toEqual({ ok: false, reason: 'over-budget' })
     // The bound is a lower bound, never a false rejection: a string that fits
-    // exactly still passes with its exact escaped size.
-    expect(checkDoneValue('', 8)).toEqual({ ok: true, bytes: 8 })
-    expect(checkDoneValue('', 7)).toEqual({ ok: false, reason: 'over-budget' })
+    // exactly still passes with its exact escaped size — one NUL serializes to
+    // `"\u0000"`, i.e. two quotes plus the 6-character escape = 8 bytes.
+    expect(checkDoneValue('\0', 8)).toEqual({ ok: true, bytes: 8 })
+    expect(checkDoneValue('\0', 7)).toEqual({ ok: false, reason: 'over-budget' })
     // Same lower bound for keys, checked before the key is escaped.
-    expect(checkDoneValue({ [''.repeat(4096)]: 1 }, 1024)).toEqual({ ok: false, reason: 'over-budget' })
+    expect(checkDoneValue({ ['\0'.repeat(4096)]: 1 }, 1024)).toEqual({ ok: false, reason: 'over-budget' })
   })
 
   it('meters only own enumerable keys', () => {