pnpm writes allowBuilds placeholders for blocked dependency scripts only when it can prompt, so a managed run that always captures output left pendingBuilds empty and the approval flow could not offer anything. The failed run's own report is the surviving record: the profile policy now records those names, which keeps approval, persistence, and the wildcard and decision guards unchanged.