@stigmer/runner 3.15.3-dev.20260914121148 → 3.16.0

package/src/activities/execute-cursor/__tests__/hermetic/tool-error.test.ts

@@ -0,0 +1,138 @@
+/**
+ * Hermetic golden: an UNGATED tool call that FAILS — a `read` the SDK streams
+ * as `running` and then `error` with the failure text as its result — through
+ * the whole `ExecuteCursor` activity.
+ *
+ * Invariant pinned: the error event folds onto the same row
+ * (the builder's `tool_error` upsert) as FAILED, with the failure text
+ * in `error` and `result` EMPTY, `completedAt` stamped, no approval fields (a
+ * read-only built-in is not gated, and the text is not Cursor's hook-block
+ * copy, so the boundary's #205 pass leaves it alone), and the turn still ends
+ * COMPLETED: a failed read is the model's problem to route around, not the
+ * turn's.
+ *
+ * Moved 2026-09-14 (#1097), one line: until then the accumulator
+ * wrote the failure text to BOTH `error` and `result`. Native writes `error`
+ * alone, as do this harness's own sub-agent rows, and every reader shows
+ * `error || result`; the duplicate's one behavioral reader was the twin
+ * collapse's `carriesOwnChange`, which took a hook-denied shell for a row
+ * carrying its own output. `startedAt` was already
+ * present because the `running` event came first.
+ *
+ * Why this net exists: the one FAILED row among the seventeen Cursor goldens
+ * is the gate's own case (`unattributed-hook-block`); the ordinary tool
+ * failure — the fold #1097 rewrote — had no end-to-end net.
+ *
+ * Regenerate ONLY after a deliberate behavior change:
+ *   npx vitest run src/activities/execute-cursor/__tests__/hermetic -u
+ */
+
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { toJson } from "@bufbuild/protobuf";
+import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+vi.mock("@cursor/sdk", async () =>
+  (await import("../../__test-utils__/scripted-sdk.js")).scriptedCursorSdkModule(),
+);
+vi.mock("../../../../client/stigmer-client.js", async () =>
+  (await import("../../../../__test-utils__/hermetic-activity.js")).hermeticStigmerClientModule(),
+);
+
+import {
+  ScriptedClock,
+  createHermeticEnvironment,
+  type HermeticEnvironment,
+} from "../../../../__test-utils__/hermetic-activity.js";
+import { ScriptedCursorAgent, sdkEvents, step } from "../../__test-utils__/scripted-agent.js";
+import {
+  FIXTURE,
+  SDK_CATALOG,
+  beginCursorScenario,
+  cursorExecutionRecord,
+  runCursorTurn,
+} from "../../__test-utils__/hermetic-cursor.js";
+import { stubRegistryFetch } from "../../../../__test-utils__/model-registry-fixture.js";
+
+const AGENT_ID = "agent-hermetic-toolerror-0001";
+const RUN_ID = "run-hermetic-toolerror-0001";
+const CALL_ID = "call-hermetic-toolerror-read-0001";
+const USER_MESSAGE = "What is in MISSING.md?";
+const TEXT_BEFORE = "Let me read it.";
+const READ_ARGS = { path: "MISSING.md" };
+const READ_ERROR = "ENOENT: no such file or directory, open 'MISSING.md'";
+const TEXT_AFTER = "There is no MISSING.md in this workspace.";
+
+describe("ExecuteCursor hermetic — an ungated tool call that fails", () => {
+  let env: HermeticEnvironment;
+  let registry: ReturnType<typeof stubRegistryFetch>;
+  const clock = new ScriptedClock();
+
+  beforeAll(() => {
+    env = createHermeticEnvironment();
+    registry = stubRegistryFetch();
+    clock.install();
+  });
+
+  afterAll(() => {
+    clock.uninstall();
+    registry.restore();
+    env.dispose();
+  });
+
+  it("folds running -> error into one FAILED row carrying the failure text and completes", async () => {
+    // ── Arrange ──────────────────────────────────────────────────────────────
+    const ev = sdkEvents(AGENT_ID, RUN_ID);
+    const agent = new ScriptedCursorAgent({
+      agentId: AGENT_ID,
+      runIds: [RUN_ID],
+      observeStep: () => clock.tick(),
+      turns: [
+        [
+          step.event(ev.init()),
+          step.event(ev.assistant(TEXT_BEFORE)),
+          step.event(ev.toolCall(CALL_ID, "read", "running", READ_ARGS)),
+          step.event(ev.toolCall(CALL_ID, "read", "error", READ_ARGS, READ_ERROR)),
+          step.event(ev.assistant(TEXT_AFTER)),
+          step.turnEnded({ inputTokens: 1_900, outputTokens: 70, cacheReadTokens: 0, cacheWriteTokens: 0 }),
+          step.finished({ result: TEXT_AFTER, model: { id: FIXTURE.model, params: [] } }),
+        ],
+      ],
+    });
+    const record = cursorExecutionRecord({ message: USER_MESSAGE });
+    const scenario = beginCursorScenario({
+      env,
+      clock,
+      record,
+      sdk: { agents: [agent], catalog: SDK_CATALOG },
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runCursorTurn(scenario);
+
+    // ── Assert: a failed read does not fail the turn ─────────────────────────
+    expect(invocation.outcome.kind).toBe("returned");
+    expect((invocation.outcome as { value: Record<string, unknown> }).value.phase).toBe("EXECUTION_COMPLETED");
+    expect(record.persistedPhases.at(-1)).toBe(ExecutionPhase.EXECUTION_COMPLETED);
+
+    // ── Assert: the one FAILED row ───────────────────────────────────────────
+    const rows = record.toolCalls();
+    expect(rows, "running + error fold into ONE row").toHaveLength(1);
+    const row = rows[0];
+    expect(row.id).toBe(CALL_ID);
+    expect(row.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+    expect(row.error, "the failure text is the error").toBe(READ_ERROR);
+    expect(row.result, "and only the error").toBe("");
+    expect(row.requiresApproval, "an ordinary failure is not an approval gate").toBe(false);
+    expect(row.approvalRequestedAt).toBe("");
+    expect(row.startedAt < row.completedAt).toBe(true);
+
+    // ── Assert: hermeticity ──────────────────────────────────────────────────
+    expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
+
+    // ── Assert: the golden ───────────────────────────────────────────────────
+    const final = record.lastFullStatus!;
+    const json = JSON.stringify(toJson(AgentExecutionStatusSchema, final), null, 2) + "\n";
+    await expect(json).toMatchFileSnapshot("./goldens/tool-error.status.json");
+  });
+});

package/src/activities/execute-cursor/__tests__/hermetic/tool-only-step.test.ts

@@ -0,0 +1,130 @@
+/**
+ * Hermetic golden: a turn whose FIRST event after `init` is a tool call — no
+ * assistant text proposed it — through the whole `ExecuteCursor` activity.
+ *
+ * Invariant pinned: a tool call with no AI message before it in
+ * its scope gets an EMPTY AI message created to carry its row
+ * (the builder's AI-message boundary), and the assistant text
+ * that follows the tool opens a new message. So: AI(`""` + the read row),
+ * AI(A1). This is the same shape the native builder produces for a model turn
+ * that proposes tools without text (`ensureAiMessageForToolCall`), which is
+ * why the canonical builder can serve both.
+ *
+ * Predicted for the swap to the shared builder (2026-09-14): NO move.
+ * The boundary rule ("the scope's current AI message, lazily created empty when
+ * the scope's latest model run had no text") produces exactly this transcript.
+ *
+ * Why this net exists: `tool-call.status.json` pins text→tool→text; nothing
+ * pinned a tool with no proposing text before this net.
+ *
+ * Regenerate ONLY after a deliberate behavior change:
+ *   npx vitest run src/activities/execute-cursor/__tests__/hermetic -u
+ */
+
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { toJson } from "@bufbuild/protobuf";
+import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase, MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+vi.mock("@cursor/sdk", async () =>
+  (await import("../../__test-utils__/scripted-sdk.js")).scriptedCursorSdkModule(),
+);
+vi.mock("../../../../client/stigmer-client.js", async () =>
+  (await import("../../../../__test-utils__/hermetic-activity.js")).hermeticStigmerClientModule(),
+);
+
+import {
+  ScriptedClock,
+  createHermeticEnvironment,
+  type HermeticEnvironment,
+} from "../../../../__test-utils__/hermetic-activity.js";
+import { ScriptedCursorAgent, sdkEvents, step } from "../../__test-utils__/scripted-agent.js";
+import {
+  FIXTURE,
+  SDK_CATALOG,
+  beginCursorScenario,
+  cursorExecutionRecord,
+  runCursorTurn,
+} from "../../__test-utils__/hermetic-cursor.js";
+import { stubRegistryFetch } from "../../../../__test-utils__/model-registry-fixture.js";
+
+const AGENT_ID = "agent-hermetic-toolonly-0001";
+const RUN_ID = "run-hermetic-toolonly-0001";
+const CALL_ID = "call-hermetic-toolonly-read-0001";
+const USER_MESSAGE = "What is in README.md?";
+const READ_ARGS = { path: "README.md" };
+const READ_RESULT = "# Hermetic\n\nA fixture readme.\n";
+const ASSISTANT_TEXT = "README.md holds a one-line fixture description.";
+
+describe("ExecuteCursor hermetic — a tool call with no proposing text", () => {
+  let env: HermeticEnvironment;
+  let registry: ReturnType<typeof stubRegistryFetch>;
+  const clock = new ScriptedClock();
+
+  beforeAll(() => {
+    env = createHermeticEnvironment();
+    registry = stubRegistryFetch();
+    clock.install();
+  });
+
+  afterAll(() => {
+    clock.uninstall();
+    registry.restore();
+    env.dispose();
+  });
+
+  it("creates an empty AI message for the row and a new one for the text that follows", async () => {
+    // ── Arrange ──────────────────────────────────────────────────────────────
+    const ev = sdkEvents(AGENT_ID, RUN_ID);
+    const agent = new ScriptedCursorAgent({
+      agentId: AGENT_ID,
+      runIds: [RUN_ID],
+      observeStep: () => clock.tick(),
+      turns: [
+        [
+          step.event(ev.init()),
+          step.event(ev.toolCall(CALL_ID, "read", "running", READ_ARGS)),
+          step.event(ev.toolCall(CALL_ID, "read", "completed", READ_ARGS, READ_RESULT)),
+          step.event(ev.assistant(ASSISTANT_TEXT)),
+          step.turnEnded({ inputTokens: 1_800, outputTokens: 60, cacheReadTokens: 0, cacheWriteTokens: 0 }),
+          step.finished({ result: ASSISTANT_TEXT, model: { id: FIXTURE.model, params: [] } }),
+        ],
+      ],
+    });
+    const record = cursorExecutionRecord({ message: USER_MESSAGE });
+    const scenario = beginCursorScenario({
+      env,
+      clock,
+      record,
+      sdk: { agents: [agent], catalog: SDK_CATALOG },
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runCursorTurn(scenario);
+
+    // ── Assert: outcome ──────────────────────────────────────────────────────
+    expect(invocation.outcome.kind).toBe("returned");
+    expect((invocation.outcome as { value: Record<string, unknown> }).value.phase).toBe("EXECUTION_COMPLETED");
+    expect(record.persistedPhases.at(-1)).toBe(ExecutionPhase.EXECUTION_COMPLETED);
+
+    // ── Assert: the transcript ───────────────────────────────────────────────
+    const final = record.lastFullStatus!;
+    expect(
+      final.messages.map((m) => [m.type, m.content, m.toolCalls.map((tc) => tc.id)]),
+      "an empty AI message carries the row; the text after the tool is a new message",
+    ).toEqual([
+      [MessageType.MESSAGE_AI, "", [CALL_ID]],
+      [MessageType.MESSAGE_AI, ASSISTANT_TEXT, []],
+    ]);
+    const row = record.toolCalls()[0];
+    expect(row.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(row.result).toBe(READ_RESULT);
+
+    // ── Assert: hermeticity ──────────────────────────────────────────────────
+    expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
+
+    // ── Assert: the golden ───────────────────────────────────────────────────
+    const json = JSON.stringify(toJson(AgentExecutionStatusSchema, final), null, 2) + "\n";
+    await expect(json).toMatchFileSnapshot("./goldens/tool-only-step.status.json");
+  });
+});

package/src/activities/execute-cursor/__tests__/hermetic/unattributed-hook-block.test.ts

@@ -21,6 +21,18 @@
  * Engine disposition on this arm, today: the handle is `close()`d, not parked
  * (index.ts `enterUnattributedHookBlockFailure`).
  *
+ * Moved 2026-09-14 (#1097), one line: the FAILED row — built from
+ * a single `status: "error"` event with no `running` before it — carries
+ * `startedAt`, equal to its `completedAt`: the instant the runner first
+ * learned of the call. Until then a completed-only event left the field unset,
+ * the one field the canonical builder stamps at every row's creation. This
+ * is the only Cursor golden that scripts a completed-only event (the three
+ * moves predicted for that rule were all this one).
+ *
+ * Moved again the same day (#1097), one line: the FAILED row's
+ * `result` no longer duplicates its `error` — the hook-block text lives in
+ * `error` alone, which is the field the #205 detector reads.
+ *
  * Parent phase rows exercised beyond the earlier scenarios: the gate install's
  * foreign-hook detection (`workspace-setup.ts` `mergeHooks`); the FAILED
  * tool-call row built from a single `status: "error"` event; the boundary's
@@ -83,7 +95,7 @@ const USER_HOOKS_JSON =
   JSON.stringify({ version: 1, hooks: { preToolUse: [{ command: FOREIGN_HOOK_COMMAND }] } }, null, 2) + "\n";
 /**
  * The error text Cursor stamps on a hook-blocked tool call
- * (`message-translator.ts` HOOK_BLOCK_ERROR_MARKERS). The SDK has no structured
+ * (`boundary-rows.ts` HOOK_BLOCK_ERROR_MARKERS). The SDK has no structured
  * "denied by hook" signal; this text is the only stream-side trace.
  */
 const HOOK_BLOCK_ERROR = "blocked by a hook";

package/src/activities/execute-cursor/__tests__/hermetic/workspace-lock-timeout.test.ts

@@ -13,9 +13,9 @@
  * `Agent.create`, no `harness_state_id` bind, nothing streamed.
  *
  * Why this is the one terminal arm WITHOUT a file golden (owner ruling,
- * 2026-09-11, entry 20260911.03 M0): the wire copy embeds the absolute
+ * 2026-09-11, #1070): the wire copy embeds the absolute
  * workspace path, which is a per-run temp directory and differs between macOS
- * and CI. The S0 driver's rule is to control a volatile source at its origin
+ * and CI. The hermetic driver's rule (#1048) is to control a volatile source at its origin
  * or escalate — never redact — so this scenario pins every byte the path does
  * not touch with explicit assertions and builds the expected message with the
  * SAME error class over the real resolved path.

package/src/activities/execute-cursor/__tests__/hitl-ledger.test.ts

@@ -1,5 +1,9 @@
 /**
- * @regression file-hitl-phase0 — pins file-edit HITL fixes #1, #2, #3, #5 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ * @regression file-hitl-phase0 — pins four rules of the file-edit gate: one
+ * approval gate per turn (a distinct co-pending sibling defers to SKIPPED);
+ * decisions bind to the active turn's ledger, never a stale one; the executed
+ * capture supersedes the model's proposal; the hook-captured input is
+ * authoritative over the streamed snapshot.
  *
  * Unit tests for the Cursor-harness HITL denial-ledger flow.
  *
@@ -61,11 +65,12 @@ import {
   reconcileDeniedToolCalls,
   clearProvisionalPostDenialNarration,
   collapseRedundantToolCallTwins,
-  toolCallIdentityToken,
   detectUnattributedHookBlocks,
   stampUnattendedSkippedToolCalls,
   HOOK_BLOCK_ERROR_MARKERS,
-} from "../message-translator.js";
+} from "../boundary-rows.js";
+import { builderOver } from "../__test-utils__/fold.js";
+import { toolCallIdentityToken } from "../approval-state.js";
 import { mockWorkspaceBackend } from "../../../__test-utils__/mock-workspace.js";
 import type { WorkspaceBackend } from "../../../shared/workspace/types.js";
 import { generateHookScript } from "../hook-script.js";
@@ -240,7 +245,7 @@ describe("reconcileDeniedToolCalls", () => {
     });
     const messages = [aiMessageWith([tc])];
 
-    const reconciled = await reconcileDeniedToolCalls(messages, [
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Write", token: grantToken("write", "gated.txt") },
     ]);
 
@@ -279,7 +284,7 @@ describe("reconcileDeniedToolCalls", () => {
     ]);
 
     // MCP tools are keyed name-only (their name is consistent across layers).
-    await reconcileDeniedToolCalls(messages, [
+    await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "apply_x", token: grantToken("apply_x", "") },
     ], policies);
 
@@ -302,7 +307,7 @@ describe("reconcileDeniedToolCalls", () => {
     });
     const messages = [aiMessageWith([denied, allowed])];
 
-    const reconciled = await reconcileDeniedToolCalls(messages, [
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Write", token: grantToken("write", "gated.txt") },
     ]);
 
@@ -323,7 +328,7 @@ describe("reconcileDeniedToolCalls", () => {
     const second = toolCall({ id: "c2", name: "edit", args: { path: "gated.txt" } });
     const messages = [aiMessageWith([first, second])];
 
-    const reconciled = await reconcileDeniedToolCalls(messages, [
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Write", token: grantToken("write", "gated.txt") },
     ]);
 
@@ -344,7 +349,7 @@ describe("reconcileDeniedToolCalls", () => {
   it("synthesizes a WAITING_APPROVAL tool call when a denial produced no stream event", async () => {
     const messages = [aiMessageWith([])];
 
-    const reconciled = await reconcileDeniedToolCalls(messages, [
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Shell", token: grantToken("shell", "rm -rf build") },
     ]);
 
@@ -363,7 +368,7 @@ describe("reconcileDeniedToolCalls", () => {
   it("is a no-op when the ledger is empty", async () => {
     const tc = toolCall({ id: "c1", status: ToolCallStatus.TOOL_CALL_COMPLETED });
     const messages = [aiMessageWith([tc])];
-    expect(await reconcileDeniedToolCalls(messages, [])).toEqual([]);
+    expect(await reconcileDeniedToolCalls(messages, builderOver(messages), [])).toEqual([]);
     expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
   });
 });
@@ -391,8 +396,7 @@ describe("reconcileDeniedToolCalls — duplicate denial-twin collapse", () => {
     });
     const messages = [aiMessageWith([gate, twin])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "notes.md") }],
       undefined,
       rootBackend(),
@@ -432,8 +436,7 @@ describe("reconcileDeniedToolCalls — duplicate denial-twin collapse", () => {
     });
     const messages = [aiMessageWith([gate, twin])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Shell", token: grantToken("shell", "rm -rf build") }],
       undefined,
       rootBackend(),
@@ -470,8 +473,7 @@ describe("reconcileDeniedToolCalls — duplicate denial-twin collapse", () => {
     });
     const messages = [aiMessageWith([gateA, gateB])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         // The hook records the content-exact token for an edit (its primary token).
         { toolName: "Write", token: toolCallIdentityToken(gateA) },
@@ -508,8 +510,7 @@ describe("reconcileDeniedToolCalls — duplicate denial-twin collapse", () => {
     });
     const messages = [aiMessageWith([gate, twin])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "notes.md") }],
       undefined,
       rootBackend(),
@@ -552,8 +553,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([edit, shell])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "Write", token: grantToken("write", "notes.md") },
         { toolName: "Shell", token: grantToken("shell", "cat > notes.md") },
@@ -595,8 +595,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([edit]), aiMessageWith([shell])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "Write", token: grantToken("write", "notes.md") },
         { toolName: "Shell", token: grantToken("shell", "cat > notes.md") },
@@ -631,8 +630,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([shell, edit])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "Shell", token: toolCallIdentityToken(shell) },
         { toolName: "Write", token: toolCallIdentityToken(edit) },
@@ -666,8 +664,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([mcp, edit])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "fetch", token: toolCallIdentityToken(mcp) },
         { toolName: "Write", token: toolCallIdentityToken(edit) },
@@ -692,8 +689,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([edit])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "notes.md") }],
       undefined,
       rootBackend(),
@@ -725,8 +721,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([edit, shell])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "Write", token: grantToken("write", "notes.md") },
         { toolName: "Shell", token: grantToken("shell", "cat > notes.md") },
@@ -801,8 +796,7 @@ describe("reconcileDeniedToolCalls — interrupted non-terminal rows (raced work
     ];
 
     // Only the anchor's denial is in the ledger — the workaround's raced it.
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Shell", token: toolCallIdentityToken(anchor) }],
       undefined,
       rootBackend(),
@@ -848,8 +842,7 @@ describe("reconcileDeniedToolCalls — interrupted non-terminal rows (raced work
       create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, content: "trailing reaction" }),
     ];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Shell", token: toolCallIdentityToken(anchor) }],
       undefined,
       rootBackend(),
@@ -1066,8 +1059,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Write",
         token: grantToken("write", "src/new.ts"),
@@ -1097,8 +1089,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Write",
         token: grantToken("write", ".env"),
@@ -1122,8 +1113,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "StrReplace",
         token: grantToken("write", "src/app.ts"),
@@ -1147,8 +1137,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "EditNotebook",
         token: grantToken("write", "nb.ipynb"),
@@ -1170,8 +1159,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Shell",
         token: grantToken("shell", "rm -rf build"),
@@ -1190,8 +1178,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     // proposed content from the captured input, not a bare {path}.
     const messages = [aiMessageWith([])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Write",
         token: grantToken("write", "ghost.md"),
@@ -1217,8 +1204,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Write",
         token: grantToken("write", "big.ts"),
@@ -1259,8 +1245,7 @@ describe("reconcileDeniedToolCalls — normalized-path fallback (abs/rel drift)"
     });
     const messages = [aiMessageWith([streamed])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "/root/notes.md") }],
       undefined,
       rootBackend(),
@@ -1288,8 +1273,7 @@ describe("reconcileDeniedToolCalls — normalized-path fallback (abs/rel drift)"
     });
     const messages = [aiMessageWith([streamed])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "/root/src/app.ts") }],
       undefined,
       rootBackend(),
@@ -1304,8 +1288,7 @@ describe("reconcileDeniedToolCalls — normalized-path fallback (abs/rel drift)"
     // The genuine no-stream-event denial (rare) must still surface a gate.
     const messages = [aiMessageWith([])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "/root/ghost.md") }],
       undefined,
       rootBackend(),
@@ -1327,8 +1310,7 @@ describe("reconcileDeniedToolCalls — normalized-path fallback (abs/rel drift)"
     });
     const messages = [aiMessageWith([streamed])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "/root/notes.md") }],
       undefined,
       rootBackend(),
@@ -1566,7 +1548,7 @@ describe("first-denial stop contract", () => {
     expect(messages.some((m) => m.content.includes("try the shell"))).toBe(false);
 
     // Phase 12 reconcile + redact on the stopped transcript yields the clean shape.
-    const denied = await reconcileDeniedToolCalls(messages, await readDenialLedger(ws));
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), await readDenialLedger(ws));
     expect(denied).toHaveLength(1);
     expect(edit.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
     const redacted = clearProvisionalPostDenialNarration(messages, denied);
@@ -1610,7 +1592,8 @@ describe("first-denial stop contract", () => {
     expect(cancelled).toBe(false);
     expect(consumed).toBe(3); // the whole turn is consumed
     // And the boundary reconcile manufactures no gate from it either.
-    const denied = await reconcileDeniedToolCalls([], await readDenialLedger(ws));
+    const messages: AgentMessage[] = [];
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), await readDenialLedger(ws));
     expect(denied).toEqual([]);
   });
 
@@ -1641,7 +1624,7 @@ describe("first-denial stop contract", () => {
 
     // Phase 12 on the stopped transcript: the anchor gates, and the one raced
     // reaction message is blanked by the trim backstop.
-    const denied = await reconcileDeniedToolCalls(messages, await readDenialLedger(ws), undefined, rootBackend());
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), await readDenialLedger(ws), undefined, rootBackend());
     expect(denied).toHaveLength(1);
     expect(shell.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
     const redacted = clearProvisionalPostDenialNarration(messages, denied);
@@ -1812,7 +1795,7 @@ describe("reconcileDeniedToolCalls — non-approval kinds never gate", () => {
       error: "blocked by a hook", args: { path: ".env" },
     });
     const messages = [aiMessageWith([secretRow])];
-    const denied = await reconcileDeniedToolCalls(messages, [
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret" },
       { toolName: "Write", token: grantToken("write", "app.log"), kind: "capture-error" },
       { toolName: "Shell", token: grantToken("shell", "make"), kind: "fail-closed" },
@@ -1834,7 +1817,7 @@ describe("reconcileDeniedToolCalls — non-approval kinds never gate", () => {
       error: "blocked by a hook", args: { path: ".env" },
     });
     const messages = [aiMessageWith([gated, secretRow])];
-    const denied = await reconcileDeniedToolCalls(messages, [
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       // Ledger order puts the secret FIRST: the anchor must still be the first
       // APPROVAL entry, never a non-approval kind.
       { toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret" },