fix: restore issue-2402 v2 gate resume and action alias consistency

[serrrfirat]

Summary

• add a staging regression for auth/external gate resumes that proved v2 could lose ActionResult call pairing when pending.call_id was empty or stale, then fix the resume branches to resolve or synthesize the correct correlator before resuming the thread
• add a staging regression for hyphen/underscore action aliases in the real structured executor path, then make granted-action matching consistent so lease preflight, policy, and consumption agree on aliased action names
• validate the fixes with targeted staging regressions, adjacent router/capability tests, and cargo check -p ironclaw_engine -p ironclaw

Validation

• cargo test -p ironclaw_engine alias_normalization_stays_consistent_between_preflight_and_consume
• cargo test -p ironclaw covers_action
• cargo test -p ironclaw resolve_gate_repairs_call_id_for_resume_output_auth_resume
• cargo test -p ironclaw resolved_call_id_
• cargo test -p ironclaw handle_with_engine_reemits_approval_status_for_pending_gate
• cargo check -p ironclaw_engine -p ironclaw

[gemini-code-assist]

Code Review

This pull request introduces normalization for action name aliases, allowing both hyphens and underscores to be used interchangeably when checking granted actions. It also refactors the resolution of call IDs for pending gates into a shared helper function, ensuring that historical call IDs are correctly recovered or synthesized when resuming threads. This fix prevents correlation issues for the LLM when processing action results after a gate resolution. New tests were added to verify alias normalization and call ID repair logic. I have no feedback to provide.

[henrypark133]

Review: Gate resume + action alias consistency (Risk: Medium)

Clean fix that correctly addresses the gate resume call_id corruption and action name alias inconsistency.

Positives:

• action_name_matches() provides clean bidirectional hyphen/underscore normalization
• GrantedActions::covers() updated with same normalization — transitively fixes find_and_consume
• resolved_or_synthetic_call_id_for_pending_action fixes both resume_output paths in resolve_gate
• Comprehensive test suite: 4 new tests including full install→auth→aliased-follow-up integration test
• aliased_action_name_still_triggers_policy_approval verifies policy enforcement isn't bypassed

Convention notes:

• The new helper loads the thread from store for call_id resolution — minor extra DB read but necessary since the resume_output paths don't have the thread pre-loaded
• Test structure follows the "test through the caller" pattern well

[standardtoaster]

One question on resolved_call_id_for_pending_action (router.rs:189-197): the resolved_ids set is built from thread.messages, but in production the orchestrator writes ActionResult messages to thread.internal_messages via sync_runtime_state. The test uses thread.add_message() which goes to messages, so it passes, but the production resolved_ids set may always be empty.

This probably doesn't matter in practice since new gates always have call_id set (line 185 short-circuits), but if the legacy fallback path is meant to work, it should scan internal_messages instead of messages. Is this a known limitation?

[serrrfirat]

Good catch @standardtoaster — you're right. resolved_call_id_for_pending_action was only scanning thread.messages, but in production the orchestrator writes ActionResult (and assistant-with-actions) messages to thread.internal_messages via sync_runtime_state. The resolved_ids set was always empty and the fallback never matched, silently falling through to a synthetic id.

Fixed in 893e319: the function now chains both messages and internal_messages iterators. Added a regression test (resolved_call_id_legacy_fallback_scans_internal_messages) that puts messages in internal_messages only — this test would have failed before the fix.

[henrypark133]

Review: Gate resume + action alias consistency

No verified findings in the current diff. I rechecked the prior internal_messages concern and the fix now scans both visible and internal transcripts before synthesizing a fallback call id. The added engine-v2 coverage also exercises the auth-resume plus aliased follow-up path that previously risked hanging.

[standardtoaster]

LGTM. I'll move persist_v2_tool_calls into the Completed match arm on #2452 so it doesn't fire during GatePaused.