d8f40d4176
The live suite previously called appendMidTurnUserMessage directly, leaving redirectPrompt's appendAfterActiveReply guard — the production decision of WHERE a correction lands — outside the harness. Both hooks now mount together sharing one state map, exactly as the desktop wires them, so a regression in the caller (not just the insert) goes red. Verified by mutation: disabling the guard fails 2/4. Also covers the rejected-redirect path: a not_running response discards the optimistic bubble instead of stranding a correction the model never saw. The hydration fixture now carries the durable row shape the client actually receives (row_id, reasoning, provider call_id/response_item_id on tool_calls) instead of a hand-simplified echo, so the 'mirrors real state.db rows' claim is honest. The fake-timer steer id counter is gone with the local insert — ids come from redirectPrompt itself.