Schema-valid tool calls need semantic-role containment, while explicit-end guards can safely contain false positives
A schema-valid model decision can still be unsafe when argument roles are semantically wrong. Runtime containment should be tested per action family: a narrow explicit-ending guard can reject courtesy-only end proposals, but lexical/current-turn checks may still admit a state as …