fix: pre-dispatch rejection of unloggable args, mutation-proof event copies, proto-safe bindings (Codex round 1)

Three findings from the PR-4 convergence round:

(A) A root-undefined binding argument passed normalization untouched, so
the sub-call DISPATCHED and only then failed the tool/code-dispatch append
(Session.append rejects undefined event data) — a sub-call executed with
no log record, violating the nothing-executes-unlogged contract. And the
tool received the SAME object later handed to the append, so a tool
mutating its args desynced the logged record from what was dispatched (or
re-poisoned the append). jsonNormalizeArgs now rejects undefined up front
with a model-correctable message and returns TWO independent parses of the
canonical JSON text: the tool gets one, the event logs the sibling —
identical by construction, mutation-proof.

(B) The bridge built its bindings record with plain-object assignment, so
a registered tool named __proto__ hit the prototype setter and silently
vanished (the runtime host resolves binding names as own properties). The
record is now null-prototype with defineProperty, mirroring the
worker-side namespace build.

(B) The header-pin sanity assertions ran only inside NON-pinning
scenarios, so a class consisting solely of its pinning scenario (the two
Code Mode classes) would accept a re-recorded pin carrying several headers
or a header-delta. A fixtures meta-test now asserts every pinning fixture
directly.

packages/core/tools/tests/code-mode.spec.ts

@@ -431,17 +431,18 @@ describe('the run_code dispatch bridge', () => {
     expect(dispatch.resultSummary.endsWith('…')).toBe(true)
   })
 
-  it('rejects undefined, JSON-throwing, and JSON-unrepresentable binding arguments', async () => {
+  it('rejects undefined, JSON-throwing, and JSON-unrepresentable binding arguments BEFORE dispatch', async () => {
     const { ctx, runtime } = await setup({ mode: 'code' })
-    registerEcho(ctx)
+    const calls = registerEcho(ctx)
+    const { agent, events } = fakeAgent()
     runtime.behavior = async (request) => {
       const echo = request.bindings[0]!.functions.echo!
       const catchMessage = (promise: Promise<unknown>) => promise.then(() => 'resolved', (error: unknown) => error instanceof Error ? error.message : String(error))
       return {
         logs: [],
         value: [
-          // undefined passes normalization untouched; the tool's own schema
-          // validation rejects it with its usual feedback.
+          // Root undefined must reject up front: the event log rejects it as
+          // data, and nothing may execute unlogged.
           await catchMessage(echo(undefined)),
           // A toJSON that throws a NON-Error propagates out of JSON.stringify.
           await catchMessage(echo({ toJSON() { throw 'raw-throw' } })),
@@ -450,11 +451,55 @@ describe('the run_code dispatch bridge', () => {
         ].join(' | '),
       }
     }
-    const result = await runCode(ctx, 'program')
+    const result = await runCode(ctx, 'program', { agent })
     const text = (result.content[0] as { text: string }).text
-    expect(text).toContain('must be an object')
+    expect(text).toContain('call the tool with an arguments object')
     expect(text).toContain('JSON-serializable: raw-throw')
     expect(text).toContain('a value JSON cannot represent')
+    // None of the three dispatched, none logged.
+    expect(calls).toEqual([])
+    expect(events.filter(event => event.type === 'tool/code-dispatch')).toEqual([])
+  })
+
+  it('logs the value the tool RECEIVED even when the tool mutates its arguments', async () => {
+    const { ctx, runtime } = await setup({ mode: 'code' })
+    const { agent, events } = fakeAgent()
+    ctx.tools.register(defineTool({
+      name: 'mutator',
+      description: 'Mutates its own args object.',
+      parameters: { list: { type: 'array', required: true } },
+      execute(args) {
+        args.list.push('injected-by-tool')
+        return Promise.resolve([{ type: 'text' as const, text: 'mutated' }])
+      },
+    }))
+    runtime.behavior = async (request) => {
+      await request.bindings[0]!.functions.mutator!({ list: ['original'] })
+      return { logs: [] }
+    }
+    const result = await runCode(ctx, 'program', { agent })
+    expect(result.isError).toBe(false)
+    const dispatch = events.find(event => event.type === 'tool/code-dispatch')?.data as SessionEventMap['tool/code-dispatch']
+    expect(dispatch.arguments).toEqual({ list: ['original'] })
+  })
+
+  it('exposes a tool named __proto__ as an ordinary own binding', async () => {
+    const { ctx, runtime } = await setup({ mode: 'code' })
+    ctx.tools.register(defineTool({
+      name: '__proto__',
+      description: 'A prototype-colliding tool name.',
+      parameters: {},
+      execute() { return Promise.resolve([{ type: 'text' as const, text: 'proto-tool-ok' }]) },
+    }))
+    runtime.behavior = async (request) => {
+      const functions = request.bindings[0]!.functions
+      expect(Object.getPrototypeOf(functions)).toBeNull()
+      const value = await functions['__proto__']!({})
+      return { logs: [], value }
+    }
+    const result = await runCode(ctx, 'program')
+    expect(result.isError).toBe(false)
+    expect(result.content[0]).toEqual({ type: 'text', text: 'proto-tool-ok' })
   })
 
   it('renders a non-string completion value inspect-style', async () => {