test(server): require settled outcomes for approved Test-tab calls

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/idle-approved-tool-recovery.md

@@ -88,3 +88,9 @@ pre-dispatch validation, and outcome persistence now have separate error
 boundaries. Both persistent and one-shot result-write failures retain the claim
 for quarantine without repeating the call. The complete 123-test selection and
 92 gateway acceptance cases pass after the repair, as do typecheck and build.
+
+The existing tool-access service regression now expects a completed Test-tab
+request to be executed and verifies exactly one provider call before asking for
+a new approval. Its full 469-test suite passes. The initial local command skipped
+its database cases; the suite now honors its supplied disposable database through
+the standard test-database guard independently of embedded Postgres support.

doc/plans/2026-10-24-recurring-server-sleep-stack.md

@@ -18,7 +18,7 @@ Do not mark an item done from a timer removal or a green check alone.
 | 04 | Decision retention and notifications | Retention deadlines and notification delivery are separate reasons | Pending |
 | 05 | Decision expiry and interrupted effects | Expiry, effect recovery, continuation recovery | Pending |
 | 06 | Tool connection health | Configuration/use activation and defined proactive health deadlines | Pending |
-| 07 | Secret proposals, tool reviews, gateway tokens | Separate expiry/scrub/recovery owners | Secret proposals: [#17446](https://github.com/paperclipai/paperclip/pull/17446), checks passed at `d41590ac0e`; gateway credentials: [#17450](https://github.com/paperclipai/paperclip/pull/17450), Greptile 5/5 at `c5c53fc43f`, fresh CI running; pending tool-review expiry: [#17453](https://github.com/paperclipai/paperclip/pull/17453), local verification passed and CI/review running; other review duties pending |
+| 07 | Secret proposals, tool reviews, gateway tokens | Separate expiry/scrub/recovery owners | Secret proposals: [#17446](https://github.com/paperclipai/paperclip/pull/17446), checks passed at `d41590ac0e`; gateway credentials: [#17450](https://github.com/paperclipai/paperclip/pull/17450), all checks passed, Greptile 5/5 at `c5c53fc43f`; pending tool-review expiry: [#17453](https://github.com/paperclipai/paperclip/pull/17453), all checks passed, Greptile 5/5 at `ce6a260a83`; approved recovery: [#17454](https://github.com/paperclipai/paperclip/pull/17454), review repair pushed; other review duties pending |
 | 08 | GitHub connection events and continuity | Event discovery/replay and credential continuity separately | Pending |
 | 09 | Merged-PR confirmations | Candidate writes, webhook activation where supported, outstanding-candidate fallback | Pending |
 | 10 | External-object refresh | Configuration changes, refresh deadlines, source events | Pending |
@@ -190,3 +190,11 @@ tests, workspace typecheck and build. Fresh CI/review remains required.
 reproduction for #17453 was missing the fake-provider binary: its durable state
 showed ENOENT hidden by close failure. After building the fixture all seven
 cases pass; one CI retry is running.
+
+#17453 now has passing checks after its single Runner retry. #17454's initial
+server shard found an old expected approved state for a completed Test-tab call;
+the updated regression requires executed and one provider call. All 469
+tool-access service tests pass after enabling the existing external database
+path independently of embedded support. Its initial browser shard failed during
+unrelated plan-task fixture company deletion with a concurrent activity-log FK
+violation. Inspect fresh-head CI before deciding whether that needs a repair.

server/src/__tests__/tool-access-service.test.ts

@@ -1,3 +1,4 @@
+import { resolveExternalTestDatabaseUrl } from "./helpers/external-test-database.js";
 import * as fs from "node:fs/promises";
 import { createHash, generateKeyPairSync, randomUUID } from "node:crypto";
 import { createServer } from "node:http";
@@ -97,8 +98,8 @@ import { HttpError } from "../errors.js";
 import type { VercelConnectClient } from "../services/vercel-connect.js";
 import { invalidatePaperclipCloudConnectorCapabilities, PaperclipCloudConnectorError, type PaperclipCloudConnector } from "../services/paperclip-cloud-connector.js";
 
-const externalDatabaseUrl = process.env.PAPERCLIP_TOOL_ACCESS_TEST_DATABASE_URL?.trim();
-const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const externalDatabaseUrl = resolveExternalTestDatabaseUrl("PAPERCLIP_TOOL_ACCESS_TEST_DATABASE_URL");
+const embeddedPostgresSupport = externalDatabaseUrl ? { supported: true } : await getEmbeddedPostgresTestSupport();
 const describeEmbeddedPostgres = embeddedPostgresSupport.supported
   ? describe
   : describe.skip;
@@ -4111,8 +4112,9 @@ describeEmbeddedPostgres("tool access service", () => {
       .from(toolActionRequests)
       .where(eq(toolActionRequests.companyId, company.id));
     expect(requests).toHaveLength(2);
+    expect(globalThis.fetch).toHaveBeenCalledTimes(1);
     expect(requests.map((row) => row.status).sort()).toEqual([
-      "approved",
+      "executed",
       "pending",
     ]);
   });