Risky behavior now covered

• Invalid tool-call recovery now unit-tests extractToolExecutionErrorMessage and shouldAddInvalidToolCallFormatReminder across PI, OpenAI Responses, Google, and Codex. Content-text wins over error/message; unknown XML/marker names (tool<read>, arg_key, tool_call) remind; a valid unknown name plus a generic not-found error does not; known tools remind only for empty args plus schema-looking errors.
• Constrained JSON Schema opt-in rejects optional/open objects, $ref/pattern/minimum, empty anyOf, non-object roots, nested array $ref, and cyclic graphs before attaching constrainedSampling.
• Provider-managed continuation enables OpenAI and Codex Responses only. Matching state sends the post-assistant delta (or current messages if that suffix is empty); stale/missing state uses allMessages; unsupported hosts keep the current messages. Blank responseId values are dropped.
• Persisted continuation schemas accept trimmed OpenAI/Codex/Google shapes and reject blank ids, bad timestamps, extras, and cross-provider fields. buildRequestFingerprint omits apiKey and signal.
• Cowork runtime bootstrap rejects non-ISO/impossible versions, invalid SHA-256 sidecars, and local archives with no checksum; network-disabled hosts with no install return null; renderCoworkRuntimeInstructions stays off until COWORK_RUNTIME_NODE_MODULES is present (case-insensitive).

Test files added/updated

• test/runtime.pi-invalid-tool-call.test.ts (new)
• test/runtime.constrained-sampling.test.ts (new)
• test/runtime.pi-step-state.test.ts (new)
• test/shared/provider-continuation-schema.test.ts (new)
• test/coworkRuntime.ensureReady.fail-closed.test.ts (new)

Why these tests materially reduce regression risk

These gates sit on shared turn/runtime paths: a wrong reminder heuristic either hides malformed tool XML or spams recovery; a loose schema visitor can attach constrained sampling to optional/defaulted tools; a continuation mismatch can replay the wrong history or persist a blank response id; a checksum skip can install an unsigned runtime archive. The tests are deterministic unit checks with no production behavior changes.

Skipped as already covered or low-signal: code-mode pipe close (9662ee32), lease/archive validation (fb997910), CI systemd expansion (267f926d), and the open #331 task/backup/import/workflow schema PR. Known production holes (startup {ready:true, error}, Codex absolute rollout paths, sync action() throw, accountId unused in continuationMatchesTarget) were not locked as intended.

Validation

• Targeted 30 new tests + test/platform-boundary.test.ts: pass
• biome check on touched files: clean
• bun run typecheck, bun run check, bun run docs:check: pass
• Full bun run test: new files that reached the runner passed in-suite. Host reproduced the known ipc-files rewritten-mtime reauth failure; not introduced here.