@gajae-code/agent-core 0.13.2 → 0.14.0

package/src/agent-loop.ts

@@ -14,6 +14,7 @@ import {
 	EventStream,
 	isZodSchema,
 	streamSimple,
+	type ToolChoice,
 	type ToolResultMessage,
 	type TSchema,
 	transportFailureFacts,
@@ -31,7 +32,7 @@ import {
 	neutralizeReservedControlTokens,
 	stripUnusableReasoningItems,
 } from "@gajae-code/ai/utils";
-import { sanitizeText } from "@gajae-code/utils";
+import { logger, sanitizeText } from "@gajae-code/utils";
 import type { AttemptScope } from "./attempt-scope";
 import {
 	createHarmonyAuditEvent,
@@ -62,6 +63,11 @@ import {
 	startExecuteToolSpan,
 	startInvokeAgentSpan,
 } from "./telemetry";
+import {
+	activeToolForCallName,
+	bindDispatchedToolIdentity,
+	markNonDispatchedToolEvent,
+} from "./tool-dispatch-identity";
 import type {
 	AgentContext,
 	AgentEvent,
@@ -75,6 +81,11 @@ import type {
 	StreamFn,
 } from "./types";
 
+// Capture the intrinsic before any tool/hook can replace `Reflect.apply`. Calling this
+// local binding performs no user-controlled property lookup between publishing a dispatch
+// start and entering the selected execute function.
+const intrinsicReflectApply = Reflect.apply;
+
 /** Sentinel returned by the abort race in `streamAssistantResponse`. */
 /**
  * Defensive caps for a provisional managed attempt. These are intentionally
@@ -84,15 +95,45 @@ import type {
 export const MANAGED_ATTEMPT_MAX_STAGED_EVENTS = 10_000;
 export const MANAGED_ATTEMPT_MAX_STAGED_BYTES = 16 * 1024 * 1024;
 
+/**
+ * Closed set of local-failure sites. A bounded diagnostic may name only these
+ * literals: the log is shape-only, so no caller-supplied or provider-derived
+ * string may ever reach it.
+ */
+const MANAGED_LOCAL_FAILURE_STAGES = [
+	"shell.role",
+	"shell.content",
+	"event.snapshot",
+	"event.contentIndex",
+	"event.delta",
+	"event.content",
+	"event.toolcall",
+	"event.done.reason",
+	"event.error.reason",
+	"event.unknownType",
+	"staging.losslessSnapshot",
+	"staging.measure",
+	"staging.sanitize",
+	"staging.preMeasure",
+	"staging.overflow",
+	"overflow.preMeasure",
+	"overflow.staged",
+] as const;
+type ManagedLocalFailureStage = (typeof MANAGED_LOCAL_FAILURE_STAGES)[number];
+const MANAGED_LOCAL_FAILURE_STAGE_SET: ReadonlySet<string> = new Set(MANAGED_LOCAL_FAILURE_STAGES);
+
 /**
  * Local staging failure: the provisional buffer limit was exceeded. Carries
  * NO transport facts or status by design — only original typed provider
  * transport facts may authorize provider fallback, so local buffer machinery
  * must never masquerade as provider evidence or consume the fallback chain.
- * It is therefore non-retryable and surfaces as an explicit local error.
+ * The typed `local_buffer_overflow` kind lets session retry policy surface it
+ * immediately without any retry: re-streaming the same request reproduces the
+ * same oversized response, so an automatic re-issue only burns tokens.
  */
 class ManagedAttemptBufferOverflowError extends Error {
-	constructor() {
+	readonly errorKind = "local_buffer_overflow" as const;
+	constructor(readonly stage: ManagedLocalFailureStage) {
 		super("Managed fallback attempt exceeded the provisional event buffer limit");
 		this.name = "ManagedAttemptBufferOverflowError";
 	}
@@ -101,10 +142,14 @@ class ManagedAttemptBufferOverflowError extends Error {
 /**
  * Local snapshot-machinery failure. Deliberately carries no transport facts
  * or status, so managed fallback classification never treats it as a provider
- * retry trigger — it fails fast instead of burning the fallback chain.
+ * retry trigger — it never burns the fallback chain, advances models, or
+ * mutates credentials. The typed `local_snapshot_failure` kind lets session
+ * policy surface the producer-boundary diagnostic immediately instead of
+ * amplifying one deterministic local defect across identical retries.
  */
 class ManagedAttemptSnapshotError extends Error {
-	constructor() {
+	readonly errorKind = "local_snapshot_failure" as const;
+	constructor(readonly stage: ManagedLocalFailureStage) {
 		super(
 			"Managed fallback attempt could not produce a serializable event snapshot (local snapshot bug, not a provider failure)",
 		);
@@ -134,6 +179,29 @@ const standaloneOwnershipStates = new WeakMap<StandaloneRunOwnership, Standalone
  */
 const MAX_CONSECUTIVE_MALFORMED_TURNS = 5;
 
+/**
+ * How many times a single turn may be re-requested because its tool arguments
+ * arrived as `\uXXXX` escapes instead of literal UTF-8.
+ *
+ * The defect is a wire-format accident that resampling clears, so a small
+ * budget recovers the overwhelming majority of turns; past it the terminal
+ * per-call rejection takes over rather than spending the run on retries.
+ */
+const MAX_ESCAPED_NONASCII_RESAMPLES = 2;
+
+/** Whether any tool call in the turn carried `\uXXXX`-escaped arguments. */
+function hasEscapedNonAsciiToolCall(message: AssistantMessage): boolean {
+	return message.content.some(block => block.type === "toolCall" && block.escapedNonAsciiArguments === true);
+}
+
+/** Remove only the exact assistant response committed by its streaming attempt. */
+function removeCommittedAssistantMessage(messages: AgentMessage[], message: AssistantMessage): boolean {
+	const index = messages.lastIndexOf(message);
+	if (index < 0) return false;
+	messages.splice(index, 1);
+	return true;
+}
+
 function isComposerBashPolicyBlockedToolResult(result: ToolResultMessage): boolean {
 	return (
 		result.isError &&
@@ -266,6 +334,7 @@ function managedContextOverflowOutcome(message: AssistantMessage, scope?: Attemp
 function managedFailureMessage(error: unknown, config: AgentLoopConfig): AssistantMessage {
 	const errorMessage = managedProperty(error, "message");
 	const transportFailure = managedTransportFailure(error);
+	const errorKind = managedProperty(error, "errorKind");
 	let fallbackMessage = "Managed fallback attempt failed";
 	if (typeof errorMessage === "string") fallbackMessage = errorMessage;
 	else {
@@ -292,6 +361,7 @@ function managedFailureMessage(error: unknown, config: AgentLoopConfig): Assista
 		stopReason: "error",
 		errorMessage: fallbackMessage,
 		...(transportFailure ? { transportFailure } : {}),
+		...(errorKind === "local_snapshot_failure" || errorKind === "local_buffer_overflow" ? { errorKind } : {}),
 		timestamp: Date.now(),
 	};
 }
@@ -583,6 +653,19 @@ function publishAgentEnd(
  */
 export const MANAGED_SNAPSHOT_MAX_NODES = 100_000;
 
+/**
+ * The sanitizer's closed set of placeholder strings. A degraded snapshot can
+ * never distinguish these from provider-sent strings by value alone, so
+ * downstream shape checks treat a sentinel-valued field as "original value was
+ * non-cloneable", never as benign provider variance.
+ */
+const SANITIZER_SENTINELS: ReadonlySet<string> = new Set([
+	"[unserializable]",
+	"[accessor]",
+	"[truncated]",
+	"[Circular]",
+]);
+
 /**
  * Cycle-aware deep clone that always returns a detached, JSON-serializable
  * value. Used whenever a detached snapshot cannot be safely obtained or
@@ -717,12 +800,33 @@ export function sanitizedDetachedClone<T>(value: T, maxNodes: number = MANAGED_S
  * (e.g. a live `Headers` inside a provider error's `transportFailure` from a
  * legacy payload), and a thrown `DataCloneError` here would mask the real
  * provider outcome and burn the whole fallback chain.
+ *
+ * `structuredClone` success is not sufficient: it can erase a custom
+ * prototype `toJSON()` while retaining an own bigint field. The live value is
+ * JSON-safe, but the detached clone is not. Validate and measure the DETACHED
+ * value with the exact serialization operation used by staging; sanitize the
+ * detached clone when that validation fails so every accepted snapshot is
+ * both isolated and JSON-serializable.
  */
-function managedAttemptSnapshotDetailed<T>(value: T): { snapshot: T; degraded: boolean } {
+function managedSnapshotJsonBytes(value: unknown): number | undefined {
 	try {
-		return { snapshot: structuredClone(value), degraded: false };
+		const serialized = JSON.stringify(value);
+		return serialized === undefined ? undefined : managedAttemptTextEncoder.encode(serialized).byteLength;
 	} catch {
-		return { snapshot: sanitizedDetachedClone(value), degraded: true };
+		return undefined;
+	}
+}
+
+function managedAttemptSnapshotDetailed<T>(value: T): { snapshot: T; jsonBytes?: number } {
+	try {
+		const snapshot = structuredClone(value);
+		const jsonBytes = managedSnapshotJsonBytes(snapshot);
+		if (jsonBytes !== undefined) return { snapshot, jsonBytes };
+		const sanitized = sanitizedDetachedClone(snapshot);
+		return { snapshot: sanitized, jsonBytes: managedSnapshotJsonBytes(sanitized) };
+	} catch {
+		const snapshot = sanitizedDetachedClone(value);
+		return { snapshot, jsonBytes: managedSnapshotJsonBytes(snapshot) };
 	}
 }
 
@@ -730,6 +834,93 @@ function managedAttemptSnapshot<T>(value: T): T {
 	return managedAttemptSnapshotDetailed(value).snapshot;
 }
 
+const LOSSLESS_SNAPSHOT_KEYS = [
+	"role",
+	"content",
+	"api",
+	"provider",
+	"model",
+	"responseId",
+	"usage",
+	"stopReason",
+	"errorMessage",
+	"errorKind",
+	"errorStatus",
+	"transportFailure",
+	"disabledFeatures",
+	"providerPayload",
+	"timestamp",
+	"duration",
+	"ttft",
+	"type",
+	"contentIndex",
+	"delta",
+	"partial",
+	"toolCall",
+	"reason",
+	"message",
+	"error",
+] as const;
+
+/**
+ * Detach unmanaged provider metadata without normalizing the cloneable parts.
+ * A failed subtree is removed at its own property boundary; siblings retain
+ * their exact structured-clone representation. The bounded recursive path is
+ * used only after cloning the complete value fails.
+ */
+function losslessDetachedClone<T>(value: T): T {
+	try {
+		const snapshot = structuredClone(value);
+		// `structuredClone()` preserves own bigint fields while removing a
+		// payload class's prototype `toJSON()`. The live event may therefore
+		// serialize successfully while its detached clone cannot be staged.
+		// Lossless staging still preserves every JSON-safe clone verbatim; only
+		// the non-serializable detached form is sanitized.
+		return managedSnapshotJsonBytes(snapshot) !== undefined ? snapshot : sanitizedDetachedClone(snapshot);
+	} catch {
+		// The managed sanitizer is explicitly bounded and total. Use it only to
+		// identify which top-level assistant metadata surfaces are cloneable; the
+		// cloneable surfaces themselves still come from structuredClone and remain
+		// lossless. This avoids recursive/unbounded traversal of hostile provider
+		// metadata while stripping only the failed top-level surface.
+		if (!isManagedPlainRecord(value)) return sanitizedDetachedClone(value);
+		const output: Record<string, unknown> = {};
+		let remaining = MANAGED_SNAPSHOT_MAX_NODES;
+		for (const key of LOSSLESS_SNAPSHOT_KEYS) {
+			if (remaining-- <= 0) break;
+			const descriptor = Object.getOwnPropertyDescriptor(value, key);
+			if (!descriptor || !("value" in descriptor)) continue;
+			try {
+				output[key] = structuredClone(descriptor.value);
+			} catch {
+				if (key === "transportFailure" && isManagedPlainRecord(descriptor.value)) {
+					const transport: Record<string, unknown> = {};
+					for (const transportKey of [
+						"kind",
+						"status",
+						"code",
+						"providerCode",
+						"openaiErrorCode",
+						"anthropicErrorType",
+						"retryAfterMs",
+						"headers",
+					] as const) {
+						const transportDescriptor = Object.getOwnPropertyDescriptor(descriptor.value, transportKey);
+						if (!transportDescriptor || !("value" in transportDescriptor)) continue;
+						try {
+							transport[transportKey] = structuredClone(transportDescriptor.value);
+						} catch {
+							// Strip only this non-cloneable transport fact.
+						}
+					}
+					output[key] = transport;
+				}
+			}
+		}
+		return managedSnapshotJsonBytes(output) !== undefined ? (output as T) : sanitizedDetachedClone(output as T);
+	}
+}
+
 /**
  * Recover the required assistant-message shell when a managed snapshot degrades
  * at its root (notably for Proxy-wrapped provider messages). Only known fields
@@ -738,14 +929,39 @@ function managedAttemptSnapshot<T>(value: T): T {
  */
 function managedAssistantShell(value: unknown, model: AgentLoopConfig["model"]): AssistantMessage {
 	const detailed = managedAttemptSnapshotDetailed(value);
-	const source = isManagedPlainRecord(detailed.snapshot) ? detailed.snapshot : value;
-	if (managedProperty(source, "role") !== "assistant") throw new ManagedAttemptSnapshotError();
+	const snapshotRecord = isManagedPlainRecord(detailed.snapshot) ? detailed.snapshot : undefined;
+	// Two benign root degradations are repaired by reading through the
+	// original object — the provider's own view — with every read guarded so
+	// a hostile trap can only degrade to undefined, never escape
+	// (`managedProperty` is exactly that guarded read):
+	// - a root that could not be snapshotted into a plain record is a live
+	//   Proxy (the sanitizer collapses proxies to a placeholder);
+	// - a plain-record snapshot that lost `role: "assistant"` came from a
+	//   payload class whose fields live on its prototype: `structuredClone`
+	//   copies only own enumerable properties, so the caller's live
+	//   `message.role === "assistant"` check passes while the detached
+	//   snapshot retains none of the message identity.
+	const source =
+		snapshotRecord !== undefined && managedProperty(snapshotRecord, "role") === "assistant" ? snapshotRecord : value;
+	if (managedProperty(source, "role") !== "assistant") throw new ManagedAttemptSnapshotError("shell.role");
 	const rawContent = managedAttemptSnapshot(managedProperty(source, "content"));
-	if (!Array.isArray(rawContent)) throw new ManagedAttemptSnapshotError();
-	const content = rawContent.flatMap(block => {
-		const normalized = managedAssistantContent(block);
-		return normalized ? [normalized] : [];
-	});
+	// Benign providers occasionally deliver a string or missing content value.
+	// Degrade those to an empty content array — an empty assistant turn —
+	// instead of failing the whole managed run: the staged shell must stay
+	// schema-valid, and empty content is the neutral, side-effect-free
+	// degradation. A string is benign ONLY when the provider actually sent a
+	// string: when the whole-message snapshot degraded, the sanitizer replaces
+	// a non-cloneable content value (proxy, function, accessor) with one of
+	// its own sentinel strings, and mistaking that sentinel for provider
+	// variance would silently drop real content (tool calls) behind a
+	// successful empty turn. Sentinel-string content therefore stays
+	// fail-closed, as does every other non-array shape, so the named-site
+	// diagnostic can report shell.content.
+	const rawArray = Array.isArray(rawContent) ? rawContent : undefined;
+	const benignContent =
+		rawContent === undefined || (typeof rawContent === "string" && !SANITIZER_SENTINELS.has(rawContent));
+	if (rawArray === undefined && !benignContent) throw new ManagedAttemptSnapshotError("shell.content");
+	const content = rawArray === undefined ? [] : rawArray.flatMap(managedContentBlock);
 	const usage = managedAssistantUsage(managedAttemptSnapshot(managedProperty(source, "usage")));
 	const api = managedProperty(source, "api");
 	const provider = managedProperty(source, "provider");
@@ -785,6 +1001,11 @@ function managedAssistantShell(value: unknown, model: AgentLoopConfig["model"]):
 	};
 }
 
+function managedContentBlock(block: unknown): AssistantMessage["content"] {
+	const normalized = managedAssistantContent(block);
+	return normalized ? [normalized] : [];
+}
+
 function managedAssistantContent(value: unknown): AssistantMessage["content"][number] | undefined {
 	if (!isManagedPlainRecord(value)) return undefined;
 	const type = managedProperty(value, "type");
@@ -809,6 +1030,8 @@ function managedAssistantContent(value: unknown): AssistantMessage["content"][nu
 	const intent = managedProperty(value, "intent");
 	const customWireName = managedProperty(value, "customWireName");
 	const incompleteArguments = managedProperty(value, "incompleteArguments");
+	const incompleteArgumentsReason = managedProperty(value, "incompleteArgumentsReason");
+	const escapedNonAsciiArguments = managedProperty(value, "escapedNonAsciiArguments");
 	return {
 		type,
 		id,
@@ -818,6 +1041,16 @@ function managedAssistantContent(value: unknown): AssistantMessage["content"][nu
 		...(typeof intent === "string" ? { intent } : {}),
 		...(typeof customWireName === "string" ? { customWireName } : {}),
 		...(typeof incompleteArguments === "boolean" ? { incompleteArguments } : {}),
+		...(typeof incompleteArgumentsReason === "string"
+			? {
+					incompleteArgumentsReason: incompleteArgumentsReason as
+						| "truncated"
+						| "malformed"
+						| "conflicting"
+						| "ambiguous",
+				}
+			: {}),
+		...(typeof escapedNonAsciiArguments === "boolean" ? { escapedNonAsciiArguments } : {}),
 	};
 }
 
@@ -847,13 +1080,30 @@ function managedAssistantUsage(value: unknown): AssistantMessage["usage"] {
 	};
 }
 
-function managedAssistantEventSnapshot(event: AssistantMessageEvent, message: AssistantMessage): AssistantMessageEvent {
-	const snapshot = managedAttemptSnapshot(event);
-	if (!isManagedPlainRecord(snapshot)) throw new ManagedAttemptSnapshotError();
-	const type = managedProperty(snapshot, "type");
-	const contentIndex = managedProperty(snapshot, "contentIndex");
+export function managedAssistantEventSnapshot(
+	event: AssistantMessageEvent,
+	message: AssistantMessage,
+): AssistantMessageEvent {
+	const detached = managedAttemptSnapshot(event);
+	const record = isManagedPlainRecord(detached) ? detached : undefined;
+	// Root repair, mirroring the shell: two benign degradations are re-read
+	// through the original event with guarded reads (`managedProperty`) —
+	// - a proxy root (structuredClone rejects proxies; the sanitizer collapses
+	//   them to a placeholder) whose gets are readable, and
+	// - a payload class whose event fields live on prototype getters
+	//   (`structuredClone` copies only own enumerable properties).
+	// A hostile trap or throwing getter can only degrade a field to undefined,
+	// which keeps the named fail-fast diagnostics below; a root that is
+	// neither snapshottable nor readable as an event keeps the dedicated root
+	// diagnostic.
+	const source: unknown = record !== undefined && typeof managedProperty(record, "type") === "string" ? record : event;
+	const type = managedProperty(source, "type");
+	if (record === undefined && typeof type !== "string") throw new ManagedAttemptSnapshotError("event.snapshot");
+	const contentIndex = managedProperty(source, "contentIndex");
 	const indexed = () => {
-		if (!Number.isInteger(contentIndex) || (contentIndex as number) < 0) throw new ManagedAttemptSnapshotError();
+		if (!Number.isInteger(contentIndex) || (contentIndex as number) < 0) {
+			throw new ManagedAttemptSnapshotError("event.contentIndex");
+		}
 		return contentIndex as number;
 	};
 	if (type === "start") return { type, partial: message };
@@ -870,31 +1120,36 @@ function managedAssistantEventSnapshot(event: AssistantMessageEvent, message: As
 		type === "reasoning_summary_delta" ||
 		type === "toolcall_delta"
 	) {
-		const delta = managedProperty(snapshot, "delta");
-		if (typeof delta !== "string") throw new ManagedAttemptSnapshotError();
+		const delta = managedProperty(source, "delta");
+		if (typeof delta !== "string") throw new ManagedAttemptSnapshotError("event.delta");
 		return { type, contentIndex: indexed(), delta, partial: message };
 	}
 	if (type === "text_end" || type === "thinking_end" || type === "reasoning_summary_end") {
-		const content = managedProperty(snapshot, "content");
-		if (typeof content !== "string") throw new ManagedAttemptSnapshotError();
+		const content = managedProperty(source, "content");
+		if (typeof content !== "string") throw new ManagedAttemptSnapshotError("event.content");
 		return { type, contentIndex: indexed(), content, partial: message };
 	}
 	if (type === "toolcall_end") {
-		const toolCall = managedAssistantContent(managedProperty(snapshot, "toolCall"));
-		if (toolCall?.type !== "toolCall") throw new ManagedAttemptSnapshotError();
+		const toolCall = managedAssistantContent(managedAttemptSnapshot(managedProperty(source, "toolCall")));
+		if (toolCall?.type !== "toolCall") throw new ManagedAttemptSnapshotError("event.toolcall");
 		return { type, contentIndex: indexed(), toolCall, partial: message };
 	}
 	if (type === "done") {
-		const reason = managedProperty(snapshot, "reason");
-		if (reason !== "stop" && reason !== "length" && reason !== "toolUse") throw new ManagedAttemptSnapshotError();
-		return { type, reason, message };
+		const reason = managedProperty(source, "reason");
+		// Degrade out-of-vocabulary done reasons to "stop", matching the closed
+		// StopReason vocabulary already normalized by managedAssistantShell.
+		const normalized = reason === "stop" || reason === "length" || reason === "toolUse" ? reason : "stop";
+		return { type, reason: normalized, message };
 	}
 	if (type === "error") {
-		const reason = managedProperty(snapshot, "reason");
-		if (reason !== "aborted" && reason !== "error") throw new ManagedAttemptSnapshotError();
-		return { type, reason, error: message };
+		const reason = managedProperty(source, "reason");
+		const normalized = reason === "aborted" || reason === "error" ? reason : "error";
+		return { type, reason: normalized, error: message };
 	}
-	throw new ManagedAttemptSnapshotError();
+	// An unknown string event type degrades to a terminal done/stop; a
+	// non-string type is malformed provider output that must fail fast.
+	if (typeof type === "string") return { type: "done", reason: "stop", message } as AssistantMessageEvent;
+	throw new ManagedAttemptSnapshotError("event.unknownType");
 }
 
 function isManagedPlainRecord(value: unknown): value is Record<string, unknown> {
@@ -902,17 +1157,62 @@ function isManagedPlainRecord(value: unknown): value is Record<string, unknown>
 }
 
 /**
- * Holds managed-attempt assistant output above the public event stream. A
- * cancelled provider attempt is therefore unobservable to sessions and their
- * side-effect consumers. Non-managed streams bypass this object entirely.
+ * Emit ONE bounded, shape-only diagnostic for a local managed-attempt failure
+ * (snapshot machinery or staging buffer). Names only the envelope shape — the
+ * failure stage, model identity, snapshot mode, staged counters, and (for
+ * content stages only) the content block count — never raw text, thinking,
+ * tool arguments, or any provider payload content. Emitted only for the
+ * module-private local error identities, so a foreign error cannot self-label
+ * into the log. Scoped to this stream invocation: not latched across
+ * invocations, matching the #4443 precedent.
+ */
+function warnManagedSnapshotFailure(
+	error: unknown,
+	config: AgentLoopConfig,
+	transaction: ManagedAttemptTransaction | undefined,
+): void {
+	// Identity, never self-labeling: only the module-private local error classes
+	// may produce this diagnostic. A foreign error that sets a matching
+	// `errorKind` (and could smuggle provider or prompt text in `stage`) is
+	// ignored here, so nothing outside this module can reach the log.
+	if (!(error instanceof ManagedAttemptSnapshotError) && !(error instanceof ManagedAttemptBufferOverflowError)) {
+		return;
+	}
+	// Defense in depth: even an in-module regression cannot widen the log past
+	// the closed stage vocabulary.
+	const stage = MANAGED_LOCAL_FAILURE_STAGE_SET.has(error.stage) ? error.stage : "unknown";
+	const diagnostic: Record<string, unknown> = {
+		stage,
+		errorKind: error.errorKind,
+		model: config.model.id,
+		provider: config.model.provider,
+		snapshotMode: transaction?.snapshotMode ?? "none",
+	};
+	const staged = transaction?.stagedShape() ?? { stagedEventCount: 0, stagedBytes: 0, contentBlockCount: 0 };
+	diagnostic.stagedEventCount = staged.stagedEventCount;
+	diagnostic.stagedBytes = staged.stagedBytes;
+	if (stage === "shell.content") {
+		diagnostic.contentBlockCount = staged.contentBlockCount;
+	}
+	logger.warn("agent: managed fallback attempt rejected a local snapshot", diagnostic);
+}
+
+/**
+ * Holds provisional assistant output above the public event stream. Managed
+ * fallback keeps the whole attempt atomic; non-managed escaped-argument
+ * detection uses lossless snapshots until visible output or the staging cap
+ * commits the transaction.
  */
+type ManagedAttemptBatchItem =
+	| { type: "event"; event: AgentEvent }
+	| { type: "assistant_event"; message: AssistantMessage; event: AssistantMessageEvent };
+
 class ManagedAttemptTransaction {
-	#batch: Array<
-		| { type: "event"; event: AgentEvent }
-		| { type: "assistant_event"; message: AssistantMessage; event: AssistantMessageEvent }
-	> = [];
+	#batch: ManagedAttemptBatchItem[] = [];
 	#stagedEventCount = 0;
 	#stagedBytes = 0;
+	/** Shape snapshot retained across discard() for bounded failure diagnostics. */
+	#lastStagedShape: { stagedEventCount: number; stagedBytes: number; contentBlockCount: number } | undefined;
 	#discarded = false;
 	#committed = false;
 
@@ -923,10 +1223,15 @@ class ManagedAttemptTransaction {
 			| undefined,
 		private readonly model: AgentLoopConfig["model"],
 		readonly scope?: AttemptScope,
+		readonly snapshotMode: "managed" | "lossless" = "managed",
 	) {}
 
 	push(event: AgentEvent): void {
 		if (this.#committed) {
+			if (event.type === "message_end" || event.type === "turn_end") {
+				this.#batch.push({ type: "event", event });
+				return;
+			}
 			this.stream.push(event);
 			return;
 		}
@@ -938,16 +1243,20 @@ class ManagedAttemptTransaction {
 	}
 
 	stageAssistantMessageEvent(message: AssistantMessage, event: AssistantMessageEvent): void {
-		const partial = managedAssistantShell(message, this.model);
+		const partial = this.#assistantSnapshot(message);
+		if (this.#committed) {
+			this.onAssistantMessageEvent?.(partial, this.#assistantEventSnapshot(event, partial));
+			return;
+		}
 		this.#batch.push({
 			type: "assistant_event",
 			message: partial,
-			event: managedAssistantEventSnapshot(event, partial),
+			event: this.#assistantEventSnapshot(event, partial),
 		});
 	}
 
 	flush(): void {
-		if (this.#discarded || this.#committed) return;
+		if (this.#discarded) return;
 		for (const item of this.#batch) {
 			if (item.type === "assistant_event") {
 				this.onAssistantMessageEvent?.(item.message, item.event);
@@ -961,13 +1270,98 @@ class ManagedAttemptTransaction {
 		this.#committed = true;
 	}
 
+	flushNonTerminal(): void {
+		if (this.#discarded || this.#committed) return;
+		const retained: ManagedAttemptBatchItem[] = [];
+		for (const item of this.#batch) {
+			if (this.#isTerminalItem(item)) {
+				retained.push(item);
+			} else if (item.type === "assistant_event") {
+				this.onAssistantMessageEvent?.(item.message, item.event);
+			} else {
+				this.stream.push(item.event);
+			}
+		}
+		this.#batch = retained;
+	}
+
+	commitCallbacksAndUpdates(): void {
+		if (this.#discarded || this.#committed) return;
+		for (const item of this.#batch) {
+			if (item.type === "assistant_event") {
+				this.onAssistantMessageEvent?.(item.message, item.event);
+			} else if (item.event.type !== "message_end" && item.event.type !== "turn_end") {
+				this.stream.push(item.event);
+			}
+		}
+		this.#batch = this.#batch.filter(
+			item => item.type === "event" && (item.event.type === "message_end" || item.event.type === "turn_end"),
+		);
+		this.#committed = true;
+	}
+
+	replacePendingAssistantMessage(message: AssistantMessage): void {
+		this.#batch = this.#batch.map(item => {
+			if (item.type === "assistant_event") {
+				return { ...item, message, event: this.#assistantEventSnapshot(item.event, message) };
+			}
+			if (item.event.type === "message_end") return { ...item, event: { ...item.event, message } };
+			if (item.event.type === "turn_end") return { ...item, event: { ...item.event, message } };
+			return item;
+		});
+	}
+
+	get committed(): boolean {
+		return this.#committed;
+	}
+
+	acceptedAssistantSnapshot(message: AssistantMessage): AssistantMessage {
+		return this.#assistantSnapshot(message);
+	}
+
 	discard(): void {
+		if (!this.#discarded) {
+			this.#lastStagedShape = {
+				stagedEventCount: this.#stagedEventCount,
+				stagedBytes: this.#stagedBytes,
+				contentBlockCount: this.#stagedContentBlockCount(),
+			};
+		}
 		this.#batch = [];
 		this.#stagedBytes = 0;
 		this.#stagedEventCount = 0;
 		this.#discarded = true;
 	}
 
+	/**
+	 * Shape-only view of what was staged when the attempt failed; never carries
+	 * content. Reports the retained pre-discard shape when the failing path
+	 * discarded the batch, and the live counters when it threw before discard.
+	 */
+	stagedShape(): { stagedEventCount: number; stagedBytes: number; contentBlockCount: number } {
+		return (
+			this.#lastStagedShape ?? {
+				stagedEventCount: this.#stagedEventCount,
+				stagedBytes: this.#stagedBytes,
+				contentBlockCount: this.#stagedContentBlockCount(),
+			}
+		);
+	}
+
+	#stagedContentBlockCount(): number {
+		for (let i = this.#batch.length - 1; i >= 0; i--) {
+			const item = this.#batch[i];
+			const message =
+				item.type === "assistant_event"
+					? item.message
+					: "message" in item.event
+						? (item.event.message as unknown)
+						: undefined;
+			const content = managedProperty(message, "content");
+			if (Array.isArray(content)) return content.length;
+		}
+		return 0;
+	}
 	#wouldOverflow(bytes: number): boolean {
 		return (
 			this.#stagedEventCount + 1 > MANAGED_ATTEMPT_MAX_STAGED_EVENTS ||
@@ -976,6 +1370,43 @@ class ManagedAttemptTransaction {
 	}
 
 	#stage(event: AgentEvent): void {
+		if (this.snapshotMode === "lossless") {
+			const snapshot = this.#repairAssistantEvent(event);
+			let rawBytes: number | undefined;
+			try {
+				rawBytes = managedAttemptTextEncoder.encode(JSON.stringify(snapshot)).byteLength;
+			} catch {
+				rawBytes = undefined;
+			}
+			if (rawBytes !== undefined && this.#wouldOverflow(rawBytes)) {
+				this.flush();
+				this.push(event);
+				return;
+			}
+			let detached: AgentEvent;
+			try {
+				detached = this.#losslessAgentEventSnapshot(snapshot);
+			} catch {
+				this.discard();
+				throw new ManagedAttemptSnapshotError("staging.losslessSnapshot");
+			}
+			let detachedBytes: number;
+			try {
+				detachedBytes = managedAttemptTextEncoder.encode(JSON.stringify(detached)).byteLength;
+			} catch {
+				this.discard();
+				throw new ManagedAttemptSnapshotError("staging.measure");
+			}
+			if (this.#wouldOverflow(detachedBytes)) {
+				this.flush();
+				this.push(detached);
+				return;
+			}
+			this.#batch.push({ type: "event", event: detached });
+			this.#stagedEventCount++;
+			this.#stagedBytes += detachedBytes;
+			return;
+		}
 		// Measure the raw event FIRST so an oversized payload is rejected
 		// before the snapshot duplicates it — the staged-byte cap exists to
 		// bound memory, so cloning ahead of the check would defeat it.
@@ -990,37 +1421,28 @@ class ManagedAttemptTransaction {
 		}
 		if (bytes !== undefined && this.#wouldOverflow(bytes)) {
 			this.discard();
-			throw new ManagedAttemptBufferOverflowError();
+			throw new ManagedAttemptBufferOverflowError("overflow.preMeasure");
 		}
-		const detailed = managedAttemptSnapshotDetailed(this.#repairAssistantEvent(event));
-		let snapshot = detailed.snapshot;
-		if (bytes === undefined || detailed.degraded) {
-			// Account the bytes of what is actually retained: a degraded
-			// snapshot replaces non-JSON leaves with placeholders, so the raw
-			// pre-measure (which omits e.g. function-valued properties) can
-			// undercount the staged form.
-			try {
-				bytes = managedAttemptTextEncoder.encode(JSON.stringify(snapshot)).byteLength;
-			} catch {
-				try {
-					snapshot = sanitizedDetachedClone(snapshot);
-					bytes = managedAttemptTextEncoder.encode(JSON.stringify(snapshot)).byteLength;
-				} catch {
-					bytes = undefined;
-				}
-			}
-			if (bytes === undefined) {
-				// The sanitizer's output is total (detached, JSON-safe), so this
-				// is unreachable unless the sanitizer itself regresses. Fail as a
-				// dedicated local error: it carries no transport facts, so it is
-				// non-retryable and can never be misattributed to the provider.
-				this.discard();
-				throw new ManagedAttemptSnapshotError();
-			}
-			if (this.#wouldOverflow(bytes)) {
-				this.discard();
-				throw new ManagedAttemptBufferOverflowError();
-			}
+		const repaired = this.#repairAssistantEvent(event);
+		const detailed = managedAttemptSnapshotDetailed(repaired);
+		const snapshot = detailed.snapshot;
+		// Always account the exact detached value. A live custom class can use
+		// prototype `toJSON()` to serialize compactly while structuredClone
+		// removes that serializer and exposes a larger or JSON-hostile own value.
+		// Reusing the live pre-measure would therefore accept an unserializable
+		// snapshot or undercount the retained bytes.
+		bytes = detailed.jsonBytes;
+		if (bytes === undefined) {
+			// The sanitizer's output is total (detached, JSON-safe), so this is
+			// unreachable unless the sanitizer itself regresses. Fail as a
+			// dedicated local error: it carries no transport facts, so it is
+			// non-retryable and can never be misattributed to the provider.
+			this.discard();
+			throw new ManagedAttemptSnapshotError("staging.sanitize");
+		}
+		if (this.#wouldOverflow(bytes)) {
+			this.discard();
+			throw new ManagedAttemptBufferOverflowError("overflow.staged");
 		}
 		this.#batch.push({ type: "event", event: snapshot });
 		this.#stagedEventCount += 1;
@@ -1029,6 +1451,7 @@ class ManagedAttemptTransaction {
 	}
 
 	#repairAssistantEvent(event: AgentEvent): AgentEvent {
+		if (this.snapshotMode === "lossless") return event;
 		if (event.type === "message_start" || event.type === "message_end" || event.type === "turn_end") {
 			return event.message.role === "assistant"
 				? { ...event, message: managedAssistantShell(event.message, this.model) }
@@ -1052,6 +1475,52 @@ class ManagedAttemptTransaction {
 		}
 		return event;
 	}
+
+	#losslessSnapshot<T>(value: T): T {
+		return losslessDetachedClone(value);
+	}
+
+	#losslessAgentEventSnapshot(event: AgentEvent): AgentEvent {
+		switch (event.type) {
+			case "message_start":
+			case "message_end":
+				return { ...event, message: this.#losslessSnapshot(event.message) };
+			case "message_update": {
+				const message = this.#losslessSnapshot(event.message);
+				if (message.role !== "assistant") return { ...event, message };
+				const assistantMessageEvent = this.#assistantEventSnapshot(event.assistantMessageEvent, message);
+				return { ...event, message, assistantMessageEvent };
+			}
+			case "turn_end":
+				return {
+					...event,
+					message: this.#losslessSnapshot(event.message),
+					toolResults: this.#losslessSnapshot(event.toolResults),
+				};
+			default:
+				return this.#losslessSnapshot(event);
+		}
+	}
+
+	#assistantSnapshot(message: AssistantMessage): AssistantMessage {
+		return this.snapshotMode === "lossless"
+			? this.#losslessSnapshot(message)
+			: managedAssistantShell(message, this.model);
+	}
+
+	#assistantEventSnapshot(event: AssistantMessageEvent, message: AssistantMessage): AssistantMessageEvent {
+		if (this.snapshotMode === "managed") return managedAssistantEventSnapshot(event, message);
+		const snapshot = this.#losslessSnapshot(event);
+		if (snapshot.type === "done") return { ...snapshot, message };
+		if (snapshot.type === "error") return { ...snapshot, error: message };
+		if (snapshot.type === "toolChoiceIncapability") return snapshot;
+		return { ...snapshot, partial: message };
+	}
+
+	#isTerminalItem(item: ManagedAttemptBatchItem): boolean {
+		if (item.type === "assistant_event") return item.event.type === "done" || item.event.type === "error";
+		return item.event.type === "message_end" || item.event.type === "turn_end";
+	}
 }
 
 /**
@@ -1469,6 +1938,15 @@ async function runLoopBody(
 	// Fires at most one repaired resend per run for the reasoning-content replay
 	// breaker below (DeepSeek "reasoning_content ... must be passed back").
 	let reasoningContentRepairAttempted = false;
+	// Consecutive resamples spent on the current turn because its tool arguments
+	// arrived `\uXXXX`-escaped. Reset once a turn gets past the check, so every
+	// turn is judged on its own wire bytes.
+	let escapedNonAsciiResampleAttempt = 0;
+	// A queue-backed dynamic tool choice belongs to the logical turn, not to one
+	// wire attempt. Capture it once and replay it across escaped-argument
+	// resamples; reset only after a response is accepted for normal processing.
+	let escapedNonAsciiToolChoiceCaptured = false;
+	let escapedNonAsciiToolChoice: ToolChoice | undefined;
 	let previousMalformedToolSignatures = new Set<string>();
 	type SyntheticRecoveryKind = "malformed-tool-call" | "composer-bash-policy" | "provider";
 	let pendingRecovery:
@@ -1498,11 +1976,15 @@ async function runLoopBody(
 			const scope =
 				initialScope ?? (firstTurn ? config.initialScope : undefined) ?? config.attemptMinter?.mint("main");
 			initialScope = undefined;
-			const transaction =
+			const managedTransaction =
 				initialTransaction ??
 				(config.fallbackManaged
 					? new ManagedAttemptTransaction(stream, config.onAssistantMessageEvent, config.model, scope)
 					: undefined);
+			const escapedToolTransaction = config.fallbackManaged
+				? undefined
+				: new ManagedAttemptTransaction(stream, config.onAssistantMessageEvent, config.model, scope, "lossless");
+			const transaction = managedTransaction ?? escapedToolTransaction;
 			initialTransaction = undefined;
 			const attemptScope = transaction?.scope ?? scope;
 			lastAttemptScope = attemptScope;
@@ -1580,10 +2062,16 @@ async function runLoopBody(
 			// Stream assistant response
 			let recovered: HarmonyRecoveredToolCall | undefined;
 			let message: AssistantMessage;
-			const attemptTransaction = transaction;
+			const attemptTransaction = managedTransaction;
 			const recoveryAttempt = pendingRecovery;
 			const wasMalformedToolRecoveryAttempt = recoveryAttempt?.kind === "malformed-tool-call";
 			try {
+				const getLogicalTurnToolChoice = (): ToolChoice | undefined => {
+					if (escapedNonAsciiToolChoiceCaptured) return escapedNonAsciiToolChoice;
+					escapedNonAsciiToolChoice = config.getToolChoice?.();
+					escapedNonAsciiToolChoiceCaptured = true;
+					return escapedNonAsciiToolChoice;
+				};
 				const attemptConfig = attemptTransaction
 					? {
 							...config,
@@ -1612,7 +2100,7 @@ async function runLoopBody(
 					currentContext,
 					attemptConfig,
 					loopSignal,
-					attemptTransaction ? (attemptTransaction as unknown as EventStream<AgentEvent, AgentMessage[]>) : stream,
+					transaction ? (transaction as unknown as EventStream<AgentEvent, AgentMessage[]>) : stream,
 					telemetry,
 					invokeAgentSpan,
 					stepCounter,
@@ -1626,6 +2114,8 @@ async function runLoopBody(
 								forceAutoToolChoice: !wasMalformedToolRecoveryAttempt,
 							}
 						: undefined,
+					escapedToolTransaction,
+					recoveryAttempt ? undefined : { value: getLogicalTurnToolChoice() },
 				);
 				const detection = detectHarmonyLeakInAssistantMessage(message);
 				if (detection && shouldMitigateHarmonyLeak(config.model, detection)) {
@@ -1638,6 +2128,7 @@ async function runLoopBody(
 			} catch (err) {
 				if (!(err instanceof HarmonyLeakInterruption)) {
 					const failureMessage = managedFailureMessage(err, config);
+					if (config.fallbackManaged) warnManagedSnapshotFailure(err, config, transaction);
 					if (config.fallbackManaged && transaction && managedContextOverflow(failureMessage, config)) {
 						transaction.discard();
 						currentContext.messages.splice(contextMessageCount);
@@ -1683,6 +2174,18 @@ async function runLoopBody(
 					}
 					await emitHarmonyAudit(config, err, "truncate_resume", harmonyRetryAttempt);
 				} else {
+					if (escapedToolTransaction?.committed) {
+						const contaminated = currentContext.messages.at(-1);
+						if (contaminated?.role !== "assistant") throw err;
+						const sanitized = escapedToolTransaction.acceptedAssistantSnapshot({
+							...contaminated,
+							content: [],
+							stopReason: "aborted",
+							providerPayload: undefined,
+						});
+						escapedToolTransaction.replacePendingAssistantMessage(sanitized);
+						escapedToolTransaction.flush();
+					}
 					if (harmonyRetryAttempt >= 2) {
 						await emitHarmonyAudit(config, err, "escalated", harmonyRetryAttempt);
 						throw new Error(
@@ -1773,6 +2276,59 @@ async function runLoopBody(
 				}
 			}
 
+			// Escaped-non-ASCII tool arguments: bounded turn resample.
+			//
+			// Arguments that spell a printable non-ASCII character as `\uXXXX`
+			// instead of literal UTF-8 are a wire-format defect, not a decision the
+			// model needs to be told about. The payload parses cleanly, but one
+			// mistyped nibble decodes to a different, equally valid character, so it
+			// can never be verified or repaired after the fact. Reporting it as a
+			// tool error spends the whole turn and writes the literal escape syntax
+			// back into the context the model samples from next. Drop the defective
+			// turn and re-request instead; the per-call rejection in
+			// `executeToolCalls` stays as the terminal answer once this budget is
+			// spent. Managed fallback reports the discarded attempt through the
+			// typed `escaped_arguments_discarded` outcome so the session policy
+			// owns a bounded same-model retry; the defect is never treated as
+			// provider evidence, so the fallback chain never advances on it.
+			if (
+				message.stopReason !== "error" &&
+				message.stopReason !== "aborted" &&
+				escapedNonAsciiResampleAttempt < MAX_ESCAPED_NONASCII_RESAMPLES &&
+				!escapedToolTransaction?.committed &&
+				hasEscapedNonAsciiToolCall(message)
+			) {
+				escapedNonAsciiResampleAttempt++;
+				escapedToolTransaction?.discard();
+				// The defective turn was already committed to the context by the
+				// streaming path. Remove that exact object rather than assuming it is
+				// still the tail: callbacks may append user/system history while the
+				// response settles, and none of that history belongs to this retry.
+				removeCommittedAssistantMessage(currentContext.messages, message);
+				// A managed invocation ends the run here and reports the discarded
+				// attempt to the session's fallback policy through the typed
+				// outcome below; the policy owns the same-model bounded retry and
+				// only falls back once it declines. The wire defect is not provider
+				// evidence, so the outcome deliberately carries no transport facts
+				// and the fallback chain never advances on it.
+				if (config.fallbackManaged) {
+					transaction?.discard();
+					currentContext.messages.splice(contextMessageCount);
+					newMessages.splice(newMessageCount);
+					await config.onManagedAttemptOutcome?.({
+						type: "escaped_arguments_discarded",
+						message,
+						scope: transaction?.scope,
+					});
+					stream.end(newMessages);
+					return;
+				}
+				continue;
+			}
+			escapedNonAsciiResampleAttempt = 0;
+			escapedNonAsciiToolChoiceCaptured = false;
+			escapedNonAsciiToolChoice = undefined;
+
 			const overflow = managedContextOverflow(message, config);
 			if (config.fallbackManaged && overflow) {
 				transaction?.discard();
@@ -1826,7 +2382,28 @@ async function runLoopBody(
 			}
 
 			// One provider invocation is committed before any tool can run.
-			transaction?.flush();
+			if (escapedToolTransaction) {
+				const acceptedMessage = escapedToolTransaction.acceptedAssistantSnapshot(message);
+				const contextIndex = currentContext.messages.lastIndexOf(message);
+				if (contextIndex >= 0) currentContext.messages[contextIndex] = acceptedMessage;
+				const producedIndex = newMessages.lastIndexOf(message);
+				if (producedIndex >= 0) newMessages[producedIndex] = acceptedMessage;
+				message = acceptedMessage;
+				escapedToolTransaction.flushNonTerminal();
+				// Tool-call updates are staged so an escaped turn can disappear
+				// atomically. Once accepted, drain every published update through the
+				// Agent/AgentSession consumers before dispatch: streaming edit guards
+				// can then abort the run before any tool execute() is entered.
+				if (message.stopReason !== "aborted" && message.stopReason !== "error") {
+					if (loopSignal.aborted) message.stopReason = "aborted";
+					if (stream.hasActiveConsumer) await stream.waitForConsumerDrain(new AbortController().signal);
+					if (loopSignal.aborted) message.stopReason = "aborted";
+				}
+				escapedToolTransaction.replacePendingAssistantMessage(message);
+				escapedToolTransaction.flush();
+			} else {
+				transaction?.flush();
+			}
 			if (config.fallbackManaged && message.stopReason !== "error" && message.stopReason !== "aborted") {
 				await config.onManagedAttemptAccepted?.();
 			}
@@ -2072,6 +2649,8 @@ async function streamAssistantResponse(
 		disableTools?: boolean;
 		forceAutoToolChoice?: boolean;
 	},
+	provisionalToolTransaction?: ManagedAttemptTransaction,
+	toolChoiceOverride?: { value: ToolChoice | undefined },
 ): Promise<AssistantMessage> {
 	// Apply context transform if configured (AgentMessage[] → AgentMessage[])
 	let messages = context.messages;
@@ -2134,7 +2713,11 @@ async function streamAssistantResponse(
 
 	// Synthetic recovery requests choose their tool mode explicitly below and
 	// must never consume a queued dynamic choice intended for an ordinary turn.
-	const dynamicToolChoice = recoveryMode ? undefined : config.getToolChoice?.();
+	const dynamicToolChoice = recoveryMode
+		? undefined
+		: toolChoiceOverride
+			? toolChoiceOverride.value
+			: config.getToolChoice?.();
 	const dynamicReasoning = config.getReasoning?.();
 	const harmonyMitigationEnabled = isHarmonyLeakMitigationTarget(config.model);
 	const harmonyAbortController = harmonyMitigationEnabled ? new AbortController() : undefined;
@@ -2397,6 +2980,9 @@ async function streamAssistantResponse(
 								: event.partial;
 							context.messages.push(partialMessage);
 							addedPartial = true;
+							if (provisionalToolTransaction) {
+								config.onProvisionalAssistantMessageEvent?.(partialMessage, event);
+							}
 							stream.push({ type: "message_start", message: { ...partialMessage }, scope });
 							break;
 
@@ -2420,9 +3006,23 @@ async function streamAssistantResponse(
 								partialMessage = config.fallbackManaged
 									? managedAssistantShell(event.partial, config.model)
 									: event.partial;
-								const partialEvent = config.fallbackManaged ? { ...event, partial: partialMessage } : event;
+								// Normalize through the managed event snapshot instead of a
+								// naive `{ ...event }` spread: spreading copies only own
+								// enumerable properties, so a payload-class event carrying its
+								// fields on prototype getters would lose `type`/`delta` here and
+								// deterministically fail the whole run as `event.unknownType`
+								// downstream. The snapshot repairs benign class/prototype shapes
+								// and keeps the named fail-fast diagnostics for hostile ones.
+								const partialEvent = config.fallbackManaged
+									? managedAssistantEventSnapshot(event, partialMessage)
+									: event;
 								context.messages[context.messages.length - 1] = partialMessage;
-								config.onAssistantMessageEvent?.(partialMessage, partialEvent);
+								if (provisionalToolTransaction) {
+									config.onProvisionalAssistantMessageEvent?.(partialMessage, partialEvent);
+									provisionalToolTransaction.stageAssistantMessageEvent(partialMessage, partialEvent);
+								} else {
+									config.onAssistantMessageEvent?.(partialMessage, partialEvent);
+								}
 								if (signal?.aborted) continue;
 								stream.push({
 									type: "message_update",
@@ -2430,6 +3030,13 @@ async function streamAssistantResponse(
 									message: { ...partialMessage },
 									scope,
 								});
+								// Preserve ordinary text streaming. Once visible text is
+								// published, this response can no longer be silently resampled;
+								// a later escaped tool call therefore falls through to the
+								// existing terminal per-call rejection instead.
+								if (event.type === "text_start" || event.type === "text_delta" || event.type === "text_end") {
+									provisionalToolTransaction?.commitCallbacksAndUpdates();
+								}
 							}
 							break;
 
@@ -2531,19 +3138,16 @@ function toolCallNames(tool: { name: string; customWireName?: string }): string[
 const TOOL_DISCOVERY_NAME = "search_tool_bm25";
 
 /**
- * Active tool a call name dispatches to. Tools emitted via OpenAI's custom-tool
- * path (e.g. `apply_patch` on GPT-5) come back under their wire-level name,
- * which may differ from the harness-internal `name`. Match on either, preferring
- * `name` for determinism if both somehow collide.
+ * Active tool a call name dispatches to.
+ *
+ * The rule itself lives with the dispatch-identity binding so execution and the identity
+ * bound onto the emitted event can never diverge.
  */
 function findActiveTool<T extends { name: string; customWireName?: string }>(
 	tools: ReadonlyArray<T> | undefined,
 	callName: string,
 ): T | undefined {
-	return (
-		tools?.find(tool => tool.name === callName) ??
-		tools?.find(tool => tool.customWireName !== undefined && tool.customWireName === callName)
-	);
+	return activeToolForCallName(tools, callName);
 }
 
 /**
@@ -2605,6 +3209,7 @@ async function executeToolCalls(
 		toolCall,
 		tool: findActiveTool(tools, toolCall.name),
 		args: toolCall.arguments as Record<string, unknown>,
+		eventFields: undefined as { toolCallId: string; toolName: string; intent: string | undefined } | undefined,
 		started: false,
 		result: undefined as AgentToolResult<any> | undefined,
 		isError: false,
@@ -2638,29 +3243,44 @@ async function executeToolCalls(
 	const emitToolResult = (record: (typeof records)[number], result: AgentToolResult<any>, isError: boolean): void => {
 		if (record.resultEmitted) return;
 		const { toolCall } = record;
-		if (!record.started) {
-			stream.push({
+		const eventFields =
+			record.eventFields ?? ({ toolCallId: toolCall.id, toolName: toolCall.name, intent: toolCall.intent } as const);
+		// A call that was skipped or aborted before dispatch still owes the stream a
+		// start/end PAIR, because every consumer downstream is built around results
+		// arriving in pairs. Both halves are marked as what they are — pairing only — so a
+		// consumer that publishes "this tool is running" can leave them out while relays,
+		// history, and result handling keep seeing the same events they always did.
+		const dispatched = record.started;
+		if (!dispatched) {
+			// No dispatch provenance is bound here. `record.tool` is the object this call
+			// WOULD have run, and binding it would let a consumer resolve a canonical
+			// built-in label for a tool whose `execute` was never entered.
+			const startEvent: AgentEvent = {
 				type: "tool_execution_start",
-				toolCallId: toolCall.id,
-				toolName: toolCall.name,
+				toolCallId: eventFields.toolCallId,
+				toolName: eventFields.toolName,
 				args: record.args,
-				intent: toolCall.intent,
+				intent: eventFields.intent,
 				scope,
-			});
+			};
+			markNonDispatchedToolEvent(startEvent);
+			stream.push(startEvent);
 		}
-		stream.push({
+		const endEvent: AgentEvent = {
 			type: "tool_execution_end",
-			toolCallId: toolCall.id,
-			toolName: toolCall.name,
+			toolCallId: eventFields.toolCallId,
+			toolName: eventFields.toolName,
 			result,
 			isError,
 			scope,
-		});
+		};
+		if (!dispatched) markNonDispatchedToolEvent(endEvent);
+		stream.push(endEvent);
 
 		const toolResultMessage: ToolResultMessage = {
 			role: "toolResult",
-			toolCallId: toolCall.id,
-			toolName: toolCall.name,
+			toolCallId: eventFields.toolCallId,
+			toolName: eventFields.toolName,
 			content: result.content,
 			details: result.details,
 			isError,
@@ -2676,6 +3296,62 @@ async function executeToolCalls(
 		stream.push({ type: "message_end", message: toolResultMessage, scope });
 	};
 
+	/**
+	 * Prepare every value needed to publish and invoke one dispatch before claiming that it
+	 * started. Once this returns, the path from a successful start publication to intrinsic
+	 * invocation contains only trusted local bindings and values.
+	 */
+	const prepareToolDispatch = (
+		record: (typeof records)[number],
+		startArgs: Record<string, unknown>,
+		executionArgs: Record<string, unknown>,
+		executionSignal: AbortSignal | undefined,
+		effectiveArgs: Record<string, unknown>,
+		toolContext: AgentToolContext | undefined,
+	): { startEvent: AgentEvent; invocationArguments: Parameters<AgentTool["execute"]> } => {
+		const eventFields = {
+			toolCallId: record.toolCall.id,
+			toolName: record.toolCall.name,
+			intent: record.toolCall.intent,
+		};
+		const startEvent: AgentEvent = {
+			type: "tool_execution_start",
+			toolCallId: eventFields.toolCallId,
+			toolName: eventFields.toolName,
+			args: startArgs,
+			intent: eventFields.intent,
+			scope,
+		};
+		// Retain the exact values the start/end/result pair must share. No later event in
+		// this dispatch needs to re-read a stateful ToolCall property.
+		record.eventFields = eventFields;
+		bindDispatchedToolIdentity(startEvent, record.tool);
+		const onUpdate: NonNullable<Parameters<AgentTool["execute"]>[3]> = partialResult => {
+			stream.push({
+				type: "tool_execution_update",
+				toolCallId: eventFields.toolCallId,
+				toolName: eventFields.toolName,
+				args: effectiveArgs,
+				partialResult: coerceToolResult(partialResult).result,
+				scope,
+			});
+		};
+		const invocationArguments = [
+			eventFields.toolCallId,
+			executionArgs,
+			executionSignal,
+			onUpdate,
+			toolContext,
+		] as Parameters<AgentTool["execute"]>;
+		return { startEvent, invocationArguments };
+	};
+
+	/** Mark dispatch only after the fully prepared start was successfully published. */
+	const publishToolDispatch = (record: (typeof records)[number], startEvent: AgentEvent): void => {
+		stream.push(startEvent);
+		record.started = true;
+	};
+
 	const runTool = async (record: (typeof records)[number], index: number): Promise<void> => {
 		if (interruptState.triggered) {
 			// Skip both span emission and the collector orphan record here. The
@@ -2704,15 +3380,6 @@ async function executeToolCalls(
 			}
 		}
 		record.args = argsForExecution;
-		record.started = true;
-		stream.push({
-			type: "tool_execution_start",
-			toolCallId: toolCall.id,
-			toolName: toolCall.name,
-			args: argsForExecution,
-			intent: toolCall.intent,
-			scope,
-		});
 
 		const toolSpan = startExecuteToolSpan(telemetry, {
 			tool,
@@ -2733,14 +3400,32 @@ async function executeToolCalls(
 			try {
 				if (toolCall.incompleteArguments) {
 					record.argumentValidationFailed = true;
-					// The provider flagged this call's argument JSON as truncated
-					// (the model hit its output-token limit mid-call). Executing the
-					// best-effort partial parse would run the tool on wrong input, so
-					// reject with a retryable, actionable error instead.
+					// The provider flagged this call's arguments as unsafe to execute.
+					// The typed reason selects accurate recovery guidance; callers that
+					// only read the boolean still get a safe, actionable rejection.
+					const reason = toolCall.incompleteArgumentsReason;
+					const detail =
+						reason === "malformed"
+							? `The terminal arguments for tool call "${toolCall.name}" did not decode to a valid JSON object. The arguments cannot be executed. Re-issue the call with valid, complete arguments.`
+							: reason === "conflicting"
+								? `The streamed and terminal arguments for tool call "${toolCall.name}" disagree. The arguments cannot be executed safely. Re-issue the call with consistent arguments.`
+								: reason === "ambiguous"
+									? `The identity of tool call "${toolCall.name}" was ambiguous on the wire (duplicate call id or id/call_id collision), so its arguments cannot be safely attributed. Re-issue the call.`
+									: `Tool call "${toolCall.name}" was cut off before its arguments finished streaming (the response hit its output token limit). The partial arguments cannot be executed. Re-issue the call with complete arguments, splitting the work into smaller steps if needed.`;
+					throw new Error(detail);
+				}
+				if (toolCall.escapedNonAsciiArguments) {
+					record.argumentValidationFailed = true;
+					// The arguments decoded cleanly, but they were spelled as `\uXXXX`
+					// escapes rather than literal UTF-8. Hand-written hex is where models
+					// mistype digits, and every mistyped nibble decodes to a different but
+					// equally valid character — the payload is unverifiable and cannot be
+					// repaired after parsing, so it is rejected rather than executed on
+					// silently corrupted text.
 					throw new Error(
-						`Tool call "${toolCall.name}" was cut off before its arguments finished streaming ` +
-							`(the response hit its output token limit). The partial arguments cannot be executed. ` +
-							`Re-issue the call with complete arguments, splitting the work into smaller steps if needed.`,
+						`Tool call "${toolCall.name}" spelled non-ASCII text as \\uXXXX escapes instead of literal UTF-8. ` +
+							`Escaped text cannot be verified — a single wrong hex digit silently becomes a different character — ` +
+							`so the call was not executed. Re-issue it writing every non-ASCII character literally.`,
 					);
 				}
 				if (!tool) {
@@ -2806,22 +3491,25 @@ async function executeToolCalls(
 				const toolContext = scope
 					? (Object.assign(baseToolContext ?? {}, { attemptScope: scope }) as AgentToolContext)
 					: baseToolContext;
-				const execution = tool.execute(
-					toolCall.id,
-					transformToolCallArguments ? transformToolCallArguments(effectiveArgs, toolCall.name) : effectiveArgs,
-					tool.nonAbortable ? undefined : toolSignal,
-					partialResult => {
-						stream.push({
-							type: "tool_execution_update",
-							toolCallId: toolCall.id,
-							toolName: toolCall.name,
-							args: effectiveArgs,
-							partialResult: coerceToolResult(partialResult).result,
-							scope,
-						});
-					},
+				const executionArgs = transformToolCallArguments
+					? transformToolCallArguments(effectiveArgs, toolCall.name)
+					: effectiveArgs;
+				const executionSignal = tool.nonAbortable ? undefined : toolSignal;
+				const execute = tool.execute;
+				if (typeof execute !== "function")
+					throw new Error(`Tool ${toolCall.name} has no executable implementation`);
+				const { startEvent, invocationArguments } = prepareToolDispatch(
+					record,
+					argsForExecution,
+					executionArgs,
+					executionSignal,
+					effectiveArgs,
 					toolContext,
 				);
+				// Preparation is complete. A successful publication is the only transition
+				// that marks this record dispatched; intrinsic invocation then consumes locals.
+				publishToolDispatch(record, startEvent);
+				const execution = intrinsicReflectApply(execute, tool, invocationArguments);
 				const rawResult = await execution;
 				const coerced = coerceToolResult(rawResult);
 				result = coerced.result;
@@ -3013,20 +3701,30 @@ function createAbortedToolResult(
 		details: {},
 	};
 
-	stream.push({
+	// Nothing was dispatched for this call: the turn errored or was aborted before any
+	// `Tool.execute` could be entered, and this pair exists only so the stream keeps
+	// delivering results in start/end PAIRS. Both halves say so, and neither binds the
+	// tool the call would have run, so a consumer that publishes "this tool is running"
+	// can leave them out while relays, history, and result handling see what they always
+	// did.
+	const startEvent: AgentEvent = {
 		type: "tool_execution_start",
 		toolCallId: toolCall.id,
 		toolName: toolCall.name,
 		args: toolCall.arguments,
 		intent: toolCall.intent,
-	});
-	stream.push({
+	};
+	markNonDispatchedToolEvent(startEvent);
+	stream.push(startEvent);
+	const endEvent: AgentEvent = {
 		type: "tool_execution_end",
 		toolCallId: toolCall.id,
 		toolName: toolCall.name,
 		result,
 		isError: true,
-	});
+	};
+	markNonDispatchedToolEvent(endEvent);
+	stream.push(endEvent);
 
 	const toolResultMessage: ToolResultMessage = {
 		role: "toolResult",