PreRunE Validate was skipped by direct RunE / proxy calls. Run both hooks in one wrapper (Validate first), add pat chmod Validate, let Sheet outer guards call ContractValidate first, and assert declare user_required leaves expose Validate, required flags, or CallTool-defer confirm. Co-authored-by: Cursor <cursoragent@cursor.com>