[Danceiny]

One bounded repair retry after a schema-shaped rejection

hotel-be#33640: a real UAT turn failed with PLANNER_PROVIDER_RESPONSE_INVALID after schemaRejectedCallCount=1, schemaRepairedValid=false. The provider emitted a tool call whose arguments missed the declared schema and then stopped; the planner treated that as terminal and surfaced a user-visible alert (~1/5 turns).

Change

• Wrap scanDshToolDecisionEvents in the attempt loop.
• When this run produced at least one schema-rejection event and the scan error is schema-shaped (isSchemaShapeError), consume one of the existing three attempts to retry on the same session with a repair prompt:

  Your previous booking capability tool call was rejected because its arguments did not match the declared parameter schema. Emit exactly one corrected booking capability tool call...

• Safety errors and unproven rejections keep failing closed (isPlannerSafetyError / non-schema errors rethrow unchanged). No unbounded loop: at most one repair retry per turn; the third attempt still surfaces the typed provider error.
• Metrics are unchanged and now capture the repair: schemaRejectedCallCount accumulates per run, schemaRepairedValid is true when a decision is accepted after a rejection.

Tests

• Added proof case: first run returns a schema-rejected booking_search_hotels call, second run returns the repaired call → decision accepted, schemaRepairRuns=2.
• Updated the old anti-laundering case: a schema-invalid call now gets exactly one repair run (invalidCrossRunRuns=2); a still-invalid repaired payload still rejects (test now expects planner_booking_intent_required), so a schema error still cannot be laundered into a valid action without a valid repaired payload.
• npx tsx scripts/booking-copilot-dsh-planner-proof-tests.ts → BOOKING COPILOT DSH PLANNER PROOF ... OK.
• booking-copilot-gateway-chat-adapter-tests.ts → OK.
• Two adjacent suites (runtime, dsh-core) fail in this clean worktree because child processes cannot resolve ts/node_modules/tsx/dist/cli.mjs (pnpm layout), not from this change.

Residual

• This only takes effect after the gotry release is rebuilt/installed on UAT; acceptance remains 5/5 visible-plan success or ≤5% invalid on the same prompt, with schemaRejectedCallCount in the metric.
• The fallback channel's schema obedience still needs the model-plane sample; this PR makes the planner resilient, it does not change the routed model.