[datlechin]

Summary

• New suite in apple/TableProTests/Core/WritePolicy/ runs every write path against every policy and checks one expected-outcome table: refused, or runs after a given list of prompts.
• MCP rows: every tools:write tool, plus execute_query, explain_query (analyze) and export_data (query), each through tools/call with a saved connection and a recording driver. Cells: token tier x External Clients x AI policy x the six Safe Mode levels.
• Agent mode rows: execute_query, confirm_destructive_operation and an outside MCP server tool, as a full turn (AI policy, card, tool, Safe Mode). Cells: AI policy x Safe Mode x External Clients x Always Allow.
• A refused cell checks the driver received nothing. Every prompting cell runs again with the first prompt declined.
• The suite fails when a tools:write tool, a tool taking a SQL query, or a writing chat tool has no row.
• MCPAuthPolicy takes its execution gate by injection, so a test can state the Safe Mode level and answer its dialogs.
• Fix: create_database, run_maintenance and stop_server_session ran at Safe Mode Silent with no prompt for a client that does not elicit. developers/mcp-tools.mdx says each asks the user whatever Safe Mode says. Forced consent now also asks the Safe Mode dialog (.confirmsWrites). Nothing is widened: an admin token's elicited answer still stands in for the dialog, as documented.

Test plan

• On main, GlobalStateSuites/MCPWritePolicyMatrixTests fails for stop_server_session at Silent: no prompt, and a declined run still sends SELECT pg_cancel_backend(4242). Passes here.
• verify.sh test: both matrix suites plus MCPAuthPolicyTests, MCPStatementGate*, MCPStatementConsentGuardTests, MCPToolConsentTests, ExecuteQueryToolTests, MCPScriptResultTests, ChatToolTargetTests, ExecutionGateTests, ToolsCallHandlerTests, ConfirmDestructiveOperationToolTests, MCPToolRegistryGuardTests, MCPConnectionApprovalTests, MCPEnumeratedArgumentTests, InsertRowsToolTests, FocusQueryTab*: PASS. verify.sh lint: PASS.

Fixes #3663