Why: the direct chat path still executes model-emitted calls that are not in the profile allow-list, while squad keeps the unknown-tool error when the fallback is unset. Evidence: go test ./runtime/ passed, including TestLoopUnknownToolFallsThrough and the existing unknown-tool cases. Impact: Config.UnknownTool is optional. Nil preserves today's registry error. Refs: feature/agent-harness-p1 Co-authored-by: Cursor <cursoragent@cursor.com>