fix(mcp,hotkeys): harden v1.14–v1.18 surface before reelee-web wiring

[thorwhalen]

Why

Pre-wiring adversarial review of the v1.14–v1.18 consumer surface (MCP resources + getState, hotkeys keymap customization, the HITL confirmation-gate pattern) before it's wired into the named consumer reelee-web. A 6-dimension multi-agent review found 20 candidate issues → 15 confirmed after adversarial verification (4 refuted) → 12 unique defects after dedup. All fixed here; each has a regression test where testable.

acture-mcp-server (patch)

• Errors-as-data is no longer broken by a thrown JSON.stringify. callGetState, readResource, and formatToolResponse serialize app-supplied values through a guarded safeStringify. A BigInt / circular reference / throwing toJSON in a view value or command result previously threw a TypeError past the tool-call handler (a JSON-RPC protocol crash, not an isError result). Now returns an unserializable_state payload; an err(...) with unserializable details still delivers its code/message.
• ok(undefined) no longer emits a malformed text: undefined (which drops on the wire and fails a strict client's CallToolResult schema); it serializes as "null".
• createMcpServer({ getStateTool }) fails fast on a name collision. A command that sanitizes to the getState tool name (app.getState → app_getState) would emit a duplicate tool (strict hosts reject the entire tools/list) and silently shadow the command on tools/call. Construction now throws a clear error.

acture-hotkeys (patch)

• Spacebar is bindable — tokenFromEvent emitted ' ', stripped by tinykeys' chord parser to an unmatchable empty key; now emits 'Space' (matched via event.code).
• A throwing when-clause no longer crashes the key handler and swallows fallback candidates — the fire loop treats a throw as not-applicable and tries the next command (fail-closed, matching registry.dispatch).
• Shadow-DOM inputs respected — DEFAULT_IGNORE resolves the real target via event.composedPath()[0].
• No phantom self-conflicts — resolveKeys de-duplicates, so an add override restating a command's own key no longer double-binds or makes detectConflicts report the command against itself.
• useHotkeys no longer freezes stale callbacks — onDispatched/shouldIgnoreEvent routed through refs.

docs — confirmation-gate pattern (not published; copy-paste reference)

• The channel label is the trust boundary. The gate only fires for ctx.channel === 'assistant', but the doc's recommended backend example (toAITools/createMcpServer) never set it → destructive dispatch ran ungated (fail-open), and the doc was internally inconsistent (frontend example set it, backend didn't). Added a load-bearing wiring warning + a fail-closed hardening note, fixed the examples, and removed the false "caller-independent … regardless of surface" claim (also corrected in the acture-ai-assistant skill).
• Middleware wrapper forwards dispatch's 4th options arg (internalToken), which the 3-arity aliases dropped — breaking @internal dispatch once the gate is installed.
• preview() computed defensively so a throw can't break errors-as-data.
• Removed a stray NUL byte that made the doc binary to git (GitHub couldn't render its diff/blame).

Verification

• Full monorepo typecheck green (27 packages) and tests green (mcp 38, hotkeys 28; +19 new tests). Both packages build.
• The 4 adversarially-refuted findings are documented as correctly dropped (e.g. getRisk is typed total, so map.get undefined is a TS compile error, not a runtime footgun).

⚠ Separately flagged — NOT changed (out of scope)

packages/core/src/when.ts uses a load-bearing NUL byte as the regex pattern|flags separator (join at line 180, split at line 348). It's self-consistent (tests pass) but makes the file binary to git and is fragile — one reserialization from breaking. A naive NUL→space swap would break regex patterns containing spaces (/foo bar/), so the correct fix is a structured regex token, which belongs in its own change. Happy to file/fix separately.

https://claude.ai/code/session_01A1PykLHv2BjQRQhspjvPWy