disabledTools can remove attempt_completion, leaving the task loop unable to complete

[DaubnerF]

Problem

attempt_completion is the tool the task loop uses to finish a task. There is no plain-text completion fallback in the task state machine, so a task can only complete through this tool. It is user-disable-able like an ordinary capability: one entry in the disabledTools setting removes the only completion path.

Observed on main at commit ba46d1f34 (2026-09-13, Zoo Code v3.82.1).

Evidence

• attempt_completion is listed in ALWAYS_AVAILABLE_TOOLS (src/shared/tools.ts:320), which marks it as not an ordinary optional capability.
• The prompt/definition filter treats every name alike: the disabledTools removal has no exemption branch, so any listed tool is deleted from the allowed set (src/core/prompts/tools/filter-tools-for-mode.ts).
• Runtime validation does the same. Its own comment states the precedence: "explicit disabling takes priority over everything, including ALWAYS_AVAILABLE_TOOLS" (src/core/tools/validateToolUse.ts:133-135). The requirements check (lines 136-146) runs before the ALWAYS_AVAILABLE_TOOLS allow (line 149), so a disabled attempt_completion is rejected at execution time.
• No exemption path protects attempt_completion from disabledTools: neither the prompt filter nor the runtime validation layer exempts the completion tool, so the ordinary disabling rule applies to it exactly as to any other tool.
• The setting's own documentation promises exactly this behavior: "Tools in this list will be excluded from prompt generation and rejected at execution time" (packages/types/src/global-settings.ts:288, declaring disabledTools at line 290).

Consequence

Adding "attempt_completion" to disabledTools removes the tool from the API tool declarations and makes validation reject it. Start a task in that state: the model's only completion route is closed, every completion attempt fails, and the task can never finish cleanly.

Desired behavior

attempt_completion should be exempt from user and configuration disabling. This is new behavior: no such exemption exists on main in either the prompt filter or the runtime validation layer, and deciding to instead support removing the tool entirely would require plain-text completion fallbacks in the task state machine, not only prompt changes.

Acceptance criteria

• Listing attempt_completion (or any other protocol tool) in disabledTools cannot disable it: the entry is rejected or ignored with a visible notice, and the tool remains in the prompt, the declarations, and validation.
• Prompt and validation agree by construction: the policy can never advertise a completion tool that the runtime rejects.
• Tests: a disabledTools entry naming attempt_completion is rejected/ignored with a visible notice; under an otherwise maximally restricted configuration, attempt_completion is provably callable and a task can complete.