@pheem49/mint 1.15.0 → 1.17.0

package/crates/mint-core/src/orchestration/mod.rs

@@ -11,6 +11,26 @@ use std::sync::Arc;
 use std::time::Instant;
 use thiserror::Error;
 
+pub mod approvals;
+#[cfg(test)]
+mod image_regressions;
+mod mcp_review;
+#[cfg(test)]
+mod mod_authoring_regressions;
+mod progress_clock;
+pub mod reliability;
+pub use reliability::{ExecutionEvidence, ExecutionState};
+pub mod diagnostics;
+pub mod loop_guard;
+pub mod trajectory_schema;
+pub mod truncation;
+pub use trajectory_schema::{StandardTrajectoryRun, StandardTrajectoryStep, StepTokens};
+mod repeated_failures;
+#[cfg(all(test, unix))]
+mod review_regressions;
+pub(crate) mod run_control;
+use repeated_failures::RepeatedFailures;
+
 use crate::chat::{
     ChatMessage, ChatRole, ChatStreamEvent, ContentBlock, send_chat_with_fallback,
     stream_chat_events_with_fallback, stream_chat_with_fallback,
@@ -24,7 +44,6 @@ use crate::knowledge::KnowledgeStore;
 use crate::plugins::execute_native_plugin;
 use crate::prompts::tool_catalog::tool_catalog;
 use crate::semantic::{index_semantic_code, search_semantic_code};
-use crate::shell::run_shell_command;
 use crate::symbols::build_symbol_index;
 use crate::{
     Capability, ChatError, ChatRequest, ChatResponse, DEFAULT_CONVERSATION_ID, MemoryError,
@@ -76,6 +95,7 @@ where
 /// Owns one persisted turn, including its cross-process queue lease. Dropping a
 /// cancelled task marks its prompt interrupted instead of leaving it running.
 struct TurnLease {
+    chat_id: String,
     memory: MemoryStore,
     id: i64,
     heartbeat: tokio::task::JoinHandle<()>,
@@ -86,6 +106,8 @@ struct TurnLease {
 impl TurnLease {
     async fn start(memory: &MemoryStore, chat_id: &str, text: &str) -> Result<Self, MemoryError> {
         let id = memory.start_turn(chat_id, text)?;
+        crate::tts::playback::cancel_chat(memory, chat_id);
+        crate::companion::queued(chat_id, id, text);
         let _ = TURN_START_LISTENER.try_with(|listener| {
             if listener.chat_id == chat_id {
                 (listener.callback)(id);
@@ -101,6 +123,7 @@ impl TurnLease {
             }
         });
         let mut lease = Self {
+            chat_id: chat_id.to_owned(),
             memory: memory.clone(),
             id,
             heartbeat,
@@ -109,7 +132,15 @@ impl TurnLease {
         };
         loop {
             match memory.claim_turn(chat_id, id) {
-                Ok(true) => return Ok(lease),
+                Ok(true) => {
+                    crate::companion::update(
+                        chat_id,
+                        id,
+                        mint_companion_protocol::Status::Thinking,
+                        None,
+                    );
+                    return Ok(lease);
+                }
                 Ok(false) => tokio::time::sleep(std::time::Duration::from_millis(250)).await,
                 Err(error) => {
                     lease.fail();
@@ -143,6 +174,12 @@ impl TurnLease {
         self.memory
             .finish_turn(self.id, summary, provider, model, fallback_provider)?;
         self.finished = true;
+        crate::companion::update(
+            &self.chat_id,
+            self.id,
+            mint_companion_protocol::Status::Completed,
+            Some(summary.to_owned()),
+        );
         Ok(())
     }
 
@@ -158,6 +195,24 @@ impl TurnLease {
     fn fail(&mut self) {
         self.persist_activity();
         let _ = self.memory.end_turn(self.id, "failed");
+        crate::companion::update(
+            &self.chat_id,
+            self.id,
+            mint_companion_protocol::Status::Failed,
+            None,
+        );
+        self.finished = true;
+    }
+
+    fn interrupt(&mut self) {
+        self.persist_activity();
+        let _ = self.memory.end_turn(self.id, "interrupted");
+        crate::companion::update(
+            &self.chat_id,
+            self.id,
+            mint_companion_protocol::Status::Interrupted,
+            None,
+        );
         self.finished = true;
     }
 }
@@ -168,6 +223,12 @@ impl Drop for TurnLease {
         if !self.finished {
             self.persist_activity();
             let _ = self.memory.end_turn(self.id, "interrupted");
+            crate::companion::update(
+                &self.chat_id,
+                self.id,
+                mint_companion_protocol::Status::Interrupted,
+                None,
+            );
         }
     }
 }
@@ -237,6 +298,13 @@ pub async fn orchestrate_chat(
     request: &ChatRequest,
 ) -> Result<ChatResponse, OrchestrationError> {
     let memory = MemoryStore::open_default()?;
+    if let Some(workspace) = request
+        .workspace_path
+        .as_deref()
+        .filter(|path| !path.trim().is_empty())
+    {
+        memory.set_chat_session_workspace(&request_chat_id(request), Some(workspace.trim()))?;
+    }
     let mut turn = TurnLease::start(&memory, &request_chat_id(request), &request.message).await?;
     let mut resolved_request = request.clone();
     resolved_request.message = resolve_github_links(&request.message, config).await;
@@ -249,11 +317,6 @@ pub async fn orchestrate_chat(
         }
     };
     turn.complete(&response)?;
-    if let Some(ref ws) = request.workspace_path {
-        if !ws.trim().is_empty() {
-            let _ = memory.set_chat_session_workspace(&request_chat_id(request), Some(ws.trim()));
-        }
-    }
     spawn_auto_memory_update(
         config.clone(),
         request.message.clone(),
@@ -279,11 +342,28 @@ where
     F: FnMut(String),
 {
     let memory = MemoryStore::open_default()?;
+    if let Some(workspace) = request
+        .workspace_path
+        .as_deref()
+        .filter(|path| !path.trim().is_empty())
+    {
+        memory.set_chat_session_workspace(&request_chat_id(request), Some(workspace.trim()))?;
+    }
     let mut turn = TurnLease::start(&memory, &request_chat_id(request), &request.message).await?;
     let mut resolved_request = request.clone();
     resolved_request.message = resolve_github_links(&request.message, config).await;
     let enriched = enrich_request(config, &memory, &resolved_request)?;
-    let response = match stream_chat(config, &enriched, on_chunk).await {
+    let response = match {
+        let mut on_chunk = on_chunk;
+        let chat = turn.chat_id.clone();
+        let id = turn.id;
+        stream_chat(config, &enriched, move |chunk: String| {
+            crate::companion::chunk(&chat, id, &chunk);
+            on_chunk(chunk);
+        })
+    }
+    .await
+    {
         Ok(response) => response,
         Err(error) => {
             turn.fail();
@@ -291,11 +371,6 @@ where
         }
     };
     turn.complete(&response)?;
-    if let Some(ref ws) = request.workspace_path {
-        if !ws.trim().is_empty() {
-            let _ = memory.set_chat_session_workspace(&request_chat_id(request), Some(ws.trim()));
-        }
-    }
     spawn_auto_memory_update(
         config.clone(),
         request.message.clone(),
@@ -317,6 +392,13 @@ pub async fn orchestrate_chat_with_fallback(
     request: &ChatRequest,
 ) -> Result<(ChatResponse, Option<String>), OrchestrationError> {
     let memory = MemoryStore::open_default()?;
+    if let Some(workspace) = request
+        .workspace_path
+        .as_deref()
+        .filter(|path| !path.trim().is_empty())
+    {
+        memory.set_chat_session_workspace(&request_chat_id(request), Some(workspace.trim()))?;
+    }
     let mut turn = TurnLease::start(&memory, &request_chat_id(request), &request.message).await?;
     let mut resolved_request = request.clone();
     resolved_request.message = resolve_github_links(&request.message, config).await;
@@ -354,11 +436,28 @@ where
     F: FnMut(String),
 {
     let memory = MemoryStore::open_default()?;
+    if let Some(workspace) = request
+        .workspace_path
+        .as_deref()
+        .filter(|path| !path.trim().is_empty())
+    {
+        memory.set_chat_session_workspace(&request_chat_id(request), Some(workspace.trim()))?;
+    }
     let mut turn = TurnLease::start(&memory, &request_chat_id(request), &request.message).await?;
     let mut resolved_request = request.clone();
     resolved_request.message = resolve_github_links(&request.message, config).await;
     let enriched = enrich_request(config, &memory, &resolved_request)?;
-    let (response, fallback) = match stream_chat_with_fallback(config, &enriched, on_chunk).await {
+    let (response, fallback) = match {
+        let mut on_chunk = on_chunk;
+        let chat = turn.chat_id.clone();
+        let id = turn.id;
+        stream_chat_with_fallback(config, &enriched, move |chunk: String| {
+            crate::companion::chunk(&chat, id, &chunk);
+            on_chunk(chunk);
+        })
+    }
+    .await
+    {
         Ok(result) => result,
         Err(error) => {
             turn.fail();
@@ -366,11 +465,6 @@ where
         }
     };
     turn.complete(&response)?;
-    if let Some(ref ws) = request.workspace_path {
-        if !ws.trim().is_empty() {
-            let _ = memory.set_chat_session_workspace(&request_chat_id(request), Some(ws.trim()));
-        }
-    }
     spawn_auto_memory_update(
         config.clone(),
         request.message.clone(),
@@ -387,10 +481,36 @@ where
     Ok((response, fallback))
 }
 
+// Full skill reads must reach the model exactly; other tools keep bounded output.
+fn model_tool_result(action: &str, result: &str) -> String {
+    if action.starts_with("browser_")
+        || (action == "read_file" && result.starts_with("[Loaded skill: "))
+    {
+        result.to_owned()
+    } else {
+        truncation::head_tail_truncate(result, truncation::TruncationConfig::default())
+    }
+}
+
+fn tool_progress_input(root: &Path, decision: &AgentDecision) -> Value {
+    let mut input = serde_json::to_value(&decision.input).unwrap_or(Value::Null);
+    if matches!(decision.action.as_str(), "browser_type" | "browser_fill") {
+        input["text"] = "[redacted input]".into();
+        input["query"] = "[redacted input]".into();
+    }
+    if decision.action == "read_file"
+        && let Some(skill) = crate::skills::skill_for_read_path(root, &decision.input.path)
+        && let Some(object) = input.as_object_mut()
+    {
+        object.insert("skill_name".into(), Value::String(skill.name));
+    }
+    input
+}
+
 /// Truncates `text` to at most `max_chars` characters (not bytes, so this
 /// never splits a multi-byte UTF-8 character) for injection into a "recent
 /// context" summary. Cheap no-op for the common case of a short message.
-fn truncate_for_context(text: &str, max_chars: usize) -> String {
+pub(super) fn truncate_for_context(text: &str, max_chars: usize) -> String {
     if text.chars().count() <= max_chars {
         return text.to_owned();
     }
@@ -520,8 +640,9 @@ use workspace_helpers::*;
 /// whole accumulated conversation, so total tokens for one task scale
 /// roughly with step count. Was lowered from 32 to 24 to cap runaway/looping
 /// tasks earlier, but 24 turned out too tight for legitimate multi-file
-/// work, cutting it off mid-task — raised to 40 as a middle ground.
-const MAX_STEPS: usize = 40;
+/// work, cutting it off mid-task — now configurable via `MintConfig::agent_max_steps` (default 40).
+// A tool gets its own correction budget, renewed after successful execution.
+const MAX_TOOL_ARGUMENT_RETRIES: usize = 5;
 const MAX_OBSERVATION_BYTES: usize = 16_000;
 /// Compact `native_messages` once a step's reported token usage crosses this
 /// fraction of `MintConfig::context_window_tokens`. Every step resends the whole
@@ -534,6 +655,13 @@ const COMPACTION_TRIGGER_RATIO: f64 = 0.75;
 /// Number of most-recent Assistant/Tool step-pairs kept verbatim (uncompacted)
 /// in `native_messages`.
 const COMPACTION_KEEP_RECENT_STEPS: usize = 3;
+/// Number of most-recent Tool step-pairs that retain full `ContentBlock::Image` pixels.
+/// Older tool turns have image blocks pruned to reduce prompt cache and token usage.
+const MAX_RETAINED_IMAGE_STEPS: usize = 2;
+/// Adaptive token threshold to compact context in long-running agent tasks (>= 20 steps),
+/// preventing cumulative prompt cache and token bloat before hitting the full window ratio.
+const ADAPTIVE_COMPACTION_TOKEN_CEILING: u32 = 40_000;
+const ADAPTIVE_COMPACTION_MIN_STEPS: usize = 20;
 /// How many times a step retries after every configured provider comes back
 /// `ChatError::NetworkUnavailable` before finally giving up — swapping
 /// providers is pointless when the network itself is down, so this waits and
@@ -554,6 +682,12 @@ pub struct AskUserOption {
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub enum AgentApproval {
+    /// Persistent agent instructions need a decision for each concrete diff.
+    SkillWrite {
+        path: String,
+        content: String,
+        diff: String,
+    },
     WriteFile {
         path: String,
         content: String,
@@ -621,6 +755,36 @@ pub const MCP_ALLOW_ALL_SENTINEL: &str = "__mcp_allow_all__";
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "type", content = "data")]
 pub enum AgentProgress {
+    ToolDiscovery {
+        server: String,
+        tool: String,
+        message: String,
+    },
+    DeviceState {
+        #[serde(rename = "callId")]
+        call_id: String,
+        server: String,
+        tool: String,
+        update: crate::mcp::device::DeviceUpdate,
+    },
+    ToolProgress {
+        #[serde(rename = "callId")]
+        call_id: String,
+        server: String,
+        tool: String,
+        update: crate::mcp::McpProgress,
+    },
+    ToolArtifacts {
+        #[serde(rename = "callId")]
+        call_id: String,
+        artifacts: Vec<crate::integrations::mcp_result::McpArtifact>,
+        warnings: Vec<String>,
+    },
+    ExecutionUpdate {
+        #[serde(rename = "callId")]
+        call_id: String,
+        executions: Vec<reliability::ExecutionEvidence>,
+    },
     Thinking {
         elapsed_secs: u64,
         #[serde(skip_serializing_if = "Option::is_none")]
@@ -685,6 +849,13 @@ pub enum AgentProgress {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         elapsed_ms: Option<u64>,
     },
+    /// Lifecycle of native context summarization, including actionable failures.
+    ContextCompaction {
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        subagent: Option<String>,
+        status: String,
+        message: String,
+    },
     /// Emitted while retrying a step after every configured provider was
     /// unreachable (`ChatError::NetworkUnavailable`) — distinct from
     /// `Thinking` because there's nothing to wait *on* here except the
@@ -694,6 +865,8 @@ pub enum AgentProgress {
         max_attempts: usize,
     },
     ToolStart {
+        #[serde(default, rename = "callId", skip_serializing_if = "Option::is_none")]
+        call_id: Option<String>,
         action: String,
         input: Value,
         /// Name of the subagent this tool call happened inside, if any —
@@ -706,6 +879,12 @@ pub enum AgentProgress {
         subagent: Option<String>,
     },
     ToolEnd {
+        #[serde(default, alias = "elapsedMs", skip_serializing_if = "Option::is_none")]
+        elapsed_ms: Option<u64>,
+        #[serde(default, rename = "callId", skip_serializing_if = "Option::is_none")]
+        call_id: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        status: Option<crate::integrations::mcp_result::ToolStatus>,
         action: String,
         input: Value,
         result: String,
@@ -718,6 +897,50 @@ pub enum AgentProgress {
     RunCompleted {
         summary: RunTelemetrySummary,
     },
+    SubagentStarted {
+        subagent: String,
+        profile: String,
+        task: String,
+    },
+    SubagentFinished {
+        subagent: String,
+        status: String,
+        #[serde(default, alias = "elapsed_ms", rename = "elapsedMs")]
+        elapsed_ms: u64,
+        steps: u32,
+        #[serde(default, alias = "summary_preview", rename = "summaryPreview")]
+        summary_preview: String,
+    },
+}
+
+impl From<crate::swarm::SwarmEvent> for AgentProgress {
+    fn from(event: crate::swarm::SwarmEvent) -> Self {
+        match event {
+            crate::swarm::SwarmEvent::Started {
+                label,
+                profile,
+                task,
+            } => AgentProgress::SubagentStarted {
+                subagent: label,
+                profile,
+                task,
+            },
+            crate::swarm::SwarmEvent::Progress(p) => p,
+            crate::swarm::SwarmEvent::Finished {
+                label,
+                status,
+                elapsed_ms,
+                steps,
+                summary_preview,
+            } => AgentProgress::SubagentFinished {
+                subagent: label,
+                status: status.as_str().to_string(),
+                elapsed_ms,
+                steps,
+                summary_preview,
+            },
+        }
+    }
 }
 
 /// Determines whether a thought string represents long-form / internal chain-of-thought
@@ -762,7 +985,32 @@ pub fn compact_agent_progress(progress: &[AgentProgress]) -> Vec<AgentProgress>
     let mut interrupted: std::collections::HashMap<String, (String, Option<u64>)> =
         std::collections::HashMap::new();
 
-    for event in progress {
+    let latest_progress: std::collections::HashMap<(u8, &str), usize> = progress
+        .iter()
+        .enumerate()
+        .filter_map(|(i, event)| match event {
+            AgentProgress::ToolProgress { call_id, .. } => Some(((0, call_id.as_str()), i)),
+            AgentProgress::DeviceState {
+                call_id, update, ..
+            } if !matches!(update.state, crate::mcp::device::DevicePhase::Accepted) => {
+                Some(((1, call_id.as_str()), i))
+            }
+            _ => None,
+        })
+        .collect();
+    for (index, event) in progress.iter().enumerate() {
+        let key = match event {
+            AgentProgress::ToolProgress { call_id, .. } => Some((0, call_id.as_str())),
+            AgentProgress::DeviceState {
+                call_id, update, ..
+            } if !matches!(update.state, crate::mcp::device::DevicePhase::Accepted) => {
+                Some((1, call_id.as_str()))
+            }
+            _ => None,
+        };
+        if key.is_some_and(|key| latest_progress.get(&key) != Some(&index)) {
+            continue;
+        }
         match event {
             AgentProgress::ThinkingDelta {
                 id,
@@ -825,6 +1073,8 @@ pub struct RunTelemetrySummary {
     pub duration_secs: f64,
     pub tool_timeline: Vec<ToolExecutionRecord>,
     pub retries_count: usize,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub trajectory: Option<trajectory_schema::StandardTrajectoryRun>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -849,6 +1099,8 @@ pub struct AgentResult {
     pub model: String,
     pub summary: String,
     pub verification: String,
+    #[serde(default)]
+    pub completion_status: String,
     pub fallback: Option<String>,
     #[serde(default)]
     pub fallback_reason: Option<String>,
@@ -884,11 +1136,36 @@ struct AgentDecision {
     input: AgentInput,
 }
 
+#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SwarmTaskInput {
+    #[serde(default)]
+    pub role: Option<String>,
+    #[serde(default)]
+    pub base: Option<String>,
+    #[serde(default)]
+    pub instruction: String,
+}
+
+impl From<SwarmTaskInput> for crate::swarm::SwarmTask {
+    fn from(input: SwarmTaskInput) -> Self {
+        Self {
+            role: input.role,
+            base: input.base,
+            instruction: input.instruction,
+        }
+    }
+}
+
 #[derive(Debug, Default, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct AgentInput {
+    #[serde(default)]
+    tasks: Vec<SwarmTaskInput>,
     #[serde(default)]
     path: String,
+    #[serde(default)]
+    artifact_id: String,
     #[serde(
         default,
         alias = "q",
@@ -912,10 +1189,20 @@ struct AgentInput {
     city: String,
     #[serde(default, alias = "expr", alias = "math")]
     expression: String,
-    #[serde(default, alias = "cmd")]
+    #[serde(
+        default,
+        alias = "cmd",
+        alias = "script",
+        alias = "exec",
+        alias = "code",
+        alias = "bash",
+        alias = "sh"
+    )]
     command: String,
     #[serde(default)]
     background: bool,
+    #[serde(default, alias = "retryReason")]
+    retry_reason: String,
     #[serde(default, alias = "job_id")]
     job_id: String,
     #[serde(default)]
@@ -929,6 +1216,8 @@ struct AgentInput {
     #[serde(default)]
     verification: String,
     #[serde(default)]
+    completion_status: String,
+    #[serde(default)]
     plan: String,
     #[serde(default)]
     reason: String,
@@ -983,6 +1272,8 @@ struct AgentInput {
     #[serde(default)]
     operation: String,
     #[serde(default)]
+    mode: String,
+    #[serde(default)]
     condition: String,
     #[serde(default)]
     value: String,
@@ -1092,7 +1383,147 @@ fn deserialize_agent_input<'de, D>(deserializer: D) -> Result<AgentInput, D::Err
 where
     D: serde::Deserializer<'de>,
 {
-    Ok(Option::<AgentInput>::deserialize(deserializer)?.unwrap_or_default())
+    let value = Option::<Value>::deserialize(deserializer)?;
+    value
+        .map(decode_agent_input)
+        .transpose()
+        .map_err(serde::de::Error::custom)
+        .map(|input| input.unwrap_or_default())
+}
+
+/// Returns true if a string is an AI dummy placeholder such as `"null"`, `"undefined"`, `"none"`, etc.
+pub fn is_dummy_value(s: &str) -> bool {
+    let lower = s.trim().to_ascii_lowercase();
+    matches!(
+        lower.as_str(),
+        "null" | "undefined" | "none" | "nil" | "(null)" | "\"\"" | "''"
+    )
+}
+
+fn prune_null_values(value: &mut Value) {
+    if let Value::Object(map) = value {
+        map.retain(|k, v| {
+            if v.is_null() && k != "path" {
+                return false;
+            }
+            if let Value::String(s) = v {
+                if is_dummy_value(s) {
+                    return false;
+                }
+            }
+            true
+        });
+        for v in map.values_mut() {
+            prune_null_values(v);
+        }
+    } else if let Value::Array(arr) = value {
+        for v in arr.iter_mut() {
+            prune_null_values(v);
+        }
+    }
+}
+
+// Some providers encode the structured patch twice or double-wrap arguments.
+// Decode those fields, prune nulls for robust serde defaults, and retain strict
+// typing for all other arguments.
+fn decode_agent_input(mut value: Value) -> Result<AgentInput, String> {
+    // 1. If value is a string, check if it's an encoded JSON object
+    if let Value::String(s) = &value {
+        let trimmed = s.trim();
+        if trimmed.starts_with('{') && trimmed.ends_with('}') {
+            if let Ok(parsed) = serde_json::from_str::<Value>(trimmed) {
+                if parsed.is_object() {
+                    value = parsed;
+                }
+            }
+        }
+    }
+
+    // 2. Prune null fields so serde default values apply for missing keys
+    prune_null_values(&mut value);
+
+    // 3. Unpack nested "arguments" if top-level command is missing
+    if let Value::Object(map) = &mut value {
+        let has_command = map
+            .get("command")
+            .or_else(|| map.get("cmd"))
+            .or_else(|| map.get("script"))
+            .or_else(|| map.get("exec"))
+            .or_else(|| map.get("code"))
+            .or_else(|| map.get("bash"))
+            .or_else(|| map.get("sh"))
+            .and_then(Value::as_str)
+            .is_some_and(|s| !s.trim().is_empty());
+
+        if !has_command {
+            if let Some(args_val) = map.get("arguments").cloned() {
+                let inner_obj = match args_val {
+                    Value::Object(inner_map) => Some(inner_map),
+                    Value::String(inner_str) => serde_json::from_str::<Value>(&inner_str)
+                        .ok()
+                        .and_then(|v| match v {
+                            Value::Object(m) => Some(m),
+                            _ => None,
+                        }),
+                    _ => None,
+                };
+                if let Some(inner) = inner_obj {
+                    let mut wrapped = Value::Object(inner);
+                    prune_null_values(&mut wrapped);
+                    if let Value::Object(cleaned) = wrapped {
+                        for (k, v) in cleaned {
+                            if !map.contains_key(&k) && !v.is_null() {
+                                map.insert(k, v);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    let outer_path = value.get("path").and_then(Value::as_str).map(str::to_owned);
+    if let Some(patch) = value.get_mut("patch").filter(|patch| !patch.is_null()) {
+        if let Value::String(encoded) = patch {
+            *patch = serde_json::from_str(encoded).map_err(|_| {
+                "patch must contain a valid JSON object with path and hunks".to_owned()
+            })?;
+        }
+        let object = patch
+            .as_object_mut()
+            .ok_or_else(|| "patch must be an object with path and hunks".to_owned())?;
+        if !object.contains_key("path") {
+            if let Some(path) = &outer_path {
+                object.insert("path".into(), Value::String(path.clone()));
+            }
+        }
+        let path = object
+            .get("path")
+            .and_then(Value::as_str)
+            .filter(|path| !path.trim().is_empty())
+            .ok_or_else(|| {
+                "patch.path is required; supply the target file explicitly".to_owned()
+            })?;
+        if outer_path
+            .as_deref()
+            .is_some_and(|outer| !outer.is_empty() && outer != path)
+        {
+            return Err("path and patch.path must name the same target file".into());
+        }
+        serde_json::from_value::<AgentPatch>(patch.clone())
+            .map_err(|_| "patch requires a string path and hunks containing string oldText/newText and optional boolean replaceAll".to_owned())?;
+    }
+    serde_json::from_value(value).map_err(|error| {
+        let message = error.to_string();
+        if message.chars().count() > 400 {
+            format!(
+                "{}… (argument value omitted)",
+                message.chars().take(400).collect::<String>()
+            )
+        } else {
+            message
+        }
+    })
 }
 
 fn resolve_agent_config(
@@ -1248,6 +1679,7 @@ async fn stream_chat_with_network_retry(
             Ok((response, fallback)) => {
                 if !stream_json_prompt
                     && allow_final_stream
+                    && !provider_truncated_response(response.stop_reason.as_deref())
                     && response
                         .tool_calls
                         .as_ref()
@@ -1456,38 +1888,83 @@ where
     Progress: FnMut(AgentProgress) + Send + 'a,
     Chunk: FnMut(String) + Send + 'a,
 {
-    Box::pin(async move {
-        let started_at = Instant::now();
-        let root = root.canonicalize().map_err(|e| {
-            OrchestrationError::Agent(format!(
-                "unable to resolve workspace root {}: {}",
-                root.display(),
-                e
-            ))
-        })?;
-        let chat_id = chat_id
+    Box::pin(run_control::scope(
+        chat_id
             .map(str::trim)
-            .filter(|chat_id| !chat_id.is_empty())
-            .unwrap_or(DEFAULT_CONVERSATION_ID);
-        // `root` is always resolved to a real, canonicalized directory above
-        // (never optional here, unlike the plain-chat path's `ChatRequest.
-        // workspace_path`), so an agent-mode conversation is always scoped to
-        // *some* workspace — it just never falls back to the plain global
-        // "cli" bucket the way plain chat can. Idempotent on chat ids that
-        // are already scoped or aren't "cli" at all (see `scoped_chat_id`).
-        let chat_id = crate::agent::memory::scoped_chat_id(chat_id, Some(&root.to_string_lossy()));
-        let chat_id = chat_id.as_str();
-        let memory = MemoryStore::open_default()?;
-        let mut turn = TurnLease::start(&memory, chat_id, task).await?;
-        let record_activity = Arc::clone(&turn.activity);
-        let mut progress = move |event: AgentProgress| {
-            if let Ok(mut lock) = record_activity.lock() {
-                lock.push(event.clone());
-            }
-            progress(event);
-        };
-        let resolved_task = resolve_github_links(task, config).await;
-        let agent_result = crate::browser::run_session(async {
+            .filter(|id| !id.is_empty())
+            .unwrap_or(DEFAULT_CONVERSATION_ID),
+        async move {
+            run_control::check()?;
+            let started_at = Instant::now();
+            let root = root.canonicalize().map_err(|e| {
+                OrchestrationError::Agent(format!(
+                    "unable to resolve workspace root {}: {}",
+                    root.display(),
+                    e
+                ))
+            })?;
+            let chat_id = chat_id
+                .map(str::trim)
+                .filter(|chat_id| !chat_id.is_empty())
+                .unwrap_or(DEFAULT_CONVERSATION_ID);
+            // `root` is always resolved to a real, canonicalized directory above
+            // (never optional here, unlike the plain-chat path's `ChatRequest.
+            // workspace_path`), so an agent-mode conversation is always scoped to
+            // *some* workspace — it just never falls back to the plain global
+            // "cli" bucket the way plain chat can. Idempotent on chat ids that
+            // are already scoped or aren't "cli" at all (see `scoped_chat_id`).
+            let chat_id =
+                crate::agent::memory::scoped_chat_id(chat_id, Some(&root.to_string_lossy()));
+            let chat_id = chat_id.as_str();
+            let memory = MemoryStore::open_default()?;
+            // Agent requests use a real workspace even when the provider fails.
+            // Persist it before the first turn so all session lists group it correctly.
+            memory.set_chat_session_workspace(chat_id, Some(root.to_string_lossy().as_ref()))?;
+            let mut turn = run_control::run(TurnLease::start(&memory, chat_id, task)).await?;
+            let record_activity = Arc::clone(&turn.activity);
+            let progress_chat_id = turn.chat_id.clone();
+            let companion_turn_id = turn.id;
+            let chunk_chat_id = turn.chat_id.clone();
+            let mut on_chunk = move |chunk: String| {
+                crate::companion::chunk(&chunk_chat_id, companion_turn_id, &chunk);
+                on_chunk(chunk);
+            };
+            let approval_chat_id = turn.chat_id.clone();
+            let mut approve = move |request: &AgentApproval| {
+                crate::companion::update(
+                    &approval_chat_id,
+                    companion_turn_id,
+                    mint_companion_protocol::Status::Waiting,
+                    None,
+                );
+                let result = approve(request);
+                crate::companion::update(
+                    &approval_chat_id,
+                    companion_turn_id,
+                    mint_companion_protocol::Status::Thinking,
+                    None,
+                );
+                result
+            };
+            let mut progress_clock = progress_clock::ProgressClock::default();
+            let mut progress = move |mut event: AgentProgress| {
+                progress_clock.stamp(&mut event, Instant::now());
+                crate::companion::progress(&progress_chat_id, companion_turn_id, &event);
+                if let Ok(mut lock) = record_activity.lock() {
+                    lock.push(event.clone());
+                }
+                progress(event);
+            };
+            let _ = crate::mods::event(
+                &root,
+                chat_id,
+                "turn_start",
+                serde_json::json!({"turnId":companion_turn_id}),
+                None,
+            );
+            let mut mod_usage = crate::mods::UsageTracker::new(&root, chat_id, companion_turn_id);
+            let resolved_task = resolve_github_links(task, config).await;
+            let agent_result = reliability::scope(Box::pin(crate::browser::run_session(async {
         // Subagent runs use a synthetic `{parent_chat_id}::subagent::{name}` chat id
         // (see the `dispatch_subagent` arm in `execute_tool`) so their own memory
         // interaction doesn't leak into the parent conversation's history. That
@@ -1497,7 +1974,7 @@ where
         let allow_subagent_dispatch = !chat_id.contains("::subagent::");
         let skills =
             crate::skills::learned_skills_context(Some(&root), Some(chat_id)).unwrap_or_default();
-        let mut observation = initial_observation(&resolved_task, &root, &skills);
+        let mut observation = initial_observation(&resolved_task, &root, "See the current skill catalog in system instructions.");
         let mut pending_image = image_data_uri;
         let mut pending_audio = audio_data_uri;
         let mut pending_video = video_data_uri;
@@ -1555,19 +2032,20 @@ where
         let mut final_fallback = None;
         let mut final_fallback_reason = None;
         let mut action_counts = BTreeMap::<String, usize>::new();
+        let mut invalid_tool_calls = ToolArgumentRetries::default();
+        let mut repeated_failures = RepeatedFailures::default();
         let mut streamed_finish_summary = String::new();
         let mut streamed_direct_text = String::new();
-        // Track the most recent step (if any) that successfully modified a file
-        // (`apply_patch`/`write_file`) and the most recent step that ran `verify`,
-        // so `finish` can be rejected when code was changed but never checked —
-        // see the gate right before the `finish` handling block below.
-        let mut last_modify_step: Option<usize> = None;
-        let mut last_verify_step: Option<usize> = None;
-        // Whether the most recent `verify` call actually passed — separate from
-        // `last_verify_step`, which only records that one *ran*. Lets `finish` be
-        // rejected when the agent ignores a real failure and claims success anyway;
-        // see `unacknowledged_verify_failure` right before the `finish` handling block.
+        // Used only for retry telemetry; finish validation uses the typed ledger.
         let mut last_verify_failed: Option<bool> = None;
+        let run_id = format!("run-{}", chrono::Local::now().format("%Y%m%d%H%M%S"));
+        let mut trajectory_run = trajectory_schema::StandardTrajectoryRun::new(
+            &run_id,
+            chat_id,
+            &resolved_task,
+            config.active_model(),
+            &config.ai_provider,
+        );
         let mut trajectory: Vec<String> = Vec::new();
         // Structured history for native tool-calling providers, maintained alongside
         // `trajectory`/`observation` (which remain the source of truth for the
@@ -1604,12 +2082,20 @@ where
         let mut last_input_tokens: u64 = 0;
         let mut turn_generated_tokens: u64 = 0;
         let mut executed_tools: Vec<ToolExecutionRecord> = Vec::new();
+        let mut mod_truncation_retries = 0;
+        let mut mcp_review = mcp_review::McpReview::default();
         let mut files_modified: std::collections::BTreeSet<String> =
             std::collections::BTreeSet::new();
         let mut files_created: std::collections::BTreeSet<String> =
             std::collections::BTreeSet::new();
-
-        'steps: for step in 1..=MAX_STEPS {
+        let mut repetition_guard = loop_guard::RepetitionGuard::default();
+        let max_steps = config.resolved_agent_max_steps();
+        let warning_threshold = max_steps.saturating_sub(5);
+
+        'steps: for step in 1..=max_steps {
+            crate::mods::set_turn_policy(&root, chat_id, plan_mode, pinned_mcp_server);
+            let _ = execute_mod_requests(&root, chat_id, config, plan_mode, &mut approve, &mut progress, None).await;
+            if run_control::cancelled() { turn.interrupt(); return Err(OrchestrationError::Agent("Agent turn canceled by user".into())); }
             let thought_id = if let Some(name) = chat_id.split("::subagent::").nth(1) {
                 format!("subagent-{name}-step-{step}")
             } else {
@@ -1631,6 +2117,16 @@ where
             });
 
             let mut active_system_prompt = system_prompt.clone();
+            let mcp_context = mcp_review.context();
+            if !mcp_context.is_empty() { active_system_prompt.push_str(&format!("\n\n{mcp_context}")); }
+            // Pin the catalog and only successfully read, unchanged skill bodies
+            // to every request, including after JSON history rebuilds/compaction.
+            let visible_history = if active_config.tool_calling_mode() == ToolCallingMode::Native { render_messages_as_text(&native_messages) } else { observation.clone() };
+            let skill_context = crate::skills::learned_skills_context_with_history(Some(&root), Some(chat_id), &visible_history)
+                .unwrap_or_default();
+            if !skill_context.is_empty() {
+                active_system_prompt.push_str(&format!("\n\n[Available skills and retained instructions]\n{skill_context}"));
+            }
             if let Some(ref model_name) = active_model_name {
                 active_system_prompt.push_str(&format!(
                     "\n\n[Active Environment Context]\n\
@@ -1646,13 +2142,32 @@ where
                 ));
             }
 
+            if step >= warning_threshold {
+                let remaining = max_steps.saturating_sub(step);
+                if remaining == 0 {
+                    active_system_prompt.push_str(&format!(
+                        "\n\n[CRITICAL STEP LIMIT REACHED - FINAL STEP]\n\
+                         You are at step {step} of {max_steps} (the absolute final step). \
+                         Do NOT execute any new tool calls or start new exploration. \
+                         You MUST call 'finish' right now, synthesize all findings, results, and links discovered so far, \
+                         and provide a complete, clear, and comprehensive answer to the user."
+                    ));
+                } else {
+                    active_system_prompt.push_str(&format!(
+                        "\n\n[STEP BUDGET WARNING]\n\
+                         You are at step {step} of {max_steps} ({remaining} step{} remaining). \
+                         Do not initiate new broad exploratory tasks or repeat failed attempts. \
+                         Consolidate your findings and call 'finish' with your final report before the budget is exhausted.",
+                        if remaining == 1 { "" } else { "s" }
+                    ));
+                }
+            }
+
             let tool_mode = active_config.tool_calling_mode();
             // A finish can still be rejected after the provider finishes
             // streaming when edited files have not been verified. Don't show
             // that provisional summary to the user as if the run were done.
-            let allow_final_stream =
-                !unverified_modification(last_modify_step, last_verify_step, "")
-                    && last_verify_failed != Some(true);
+            let allow_final_stream = reliability::completion("verified", "").is_ok();
 
             if tool_mode == ToolCallingMode::JsonPrompt
                 && active_config.ai_provider == "ollama"
@@ -1718,7 +2233,7 @@ where
                             on_chunk(delta);
                         }
                     };
-                    stream_chat_with_network_retry(
+                    run_control::run(stream_chat_with_network_retry(
                         &active_config,
                         &ChatRequest {
                             message: String::new(),
@@ -1749,7 +2264,7 @@ where
                         false,
                         allow_final_stream,
                         &mut emit_stream_chunk,
-                    )
+                    ))
                     .await?
                 }
             } else {
@@ -1764,7 +2279,7 @@ where
                             on_chunk(delta);
                         }
                     };
-                    stream_chat_with_network_retry(
+                    run_control::run(stream_chat_with_network_retry(
                         &active_config,
                         &ChatRequest {
                             message: observation.clone(),
@@ -1790,7 +2305,7 @@ where
                         true,
                         allow_final_stream,
                         &mut emit_stream_chunk,
-                    )
+                    ))
                     .await?
                 }
             };
@@ -1798,6 +2313,8 @@ where
             final_provider = response.provider.clone();
             final_model = response.model.clone();
             turn_total_tokens += response.total_tokens.unwrap_or(0) as u64;
+            let usage_payload = mod_usage.record(&active_config, &response);
+            let _ = crate::mods::event(&root, chat_id, "usage_update", usage_payload, None);
             turn_generated_tokens += response.output_tokens.unwrap_or(0) as u64;
             if let Some(input) = response.input_tokens {
                 last_input_tokens = input as u64;
@@ -1824,35 +2341,67 @@ where
                 }
             }
 
+            // A provider-limited design draft is not a completed mod. Recover
+            // only after successful mod preparation, before publication, and
+            // within a per-turn budget. All subsequent tools keep their normal
+            // plan-mode, capability and approval checks.
+            if tool_mode == ToolCallingMode::Native
+                && !plan_mode
+                && !active_config.disabled_tools.iter().any(|tool| tool == "mod_publish")
+                && response.tool_calls.as_ref().is_none_or(|calls| calls.is_empty())
+                && provider_truncated_response(response.stop_reason.as_deref())
+                && mod_truncation_retries < 2
+                && executed_tools.iter().any(|tool| tool.success && matches!(tool.action.as_str(), "mod_help" | "mod_validate"))
+                && !executed_tools.iter().any(|tool| tool.success && tool.action == "mod_publish")
+            {
+                mod_truncation_retries += 1;
+                let instruction = "Your previous response reached the provider output-length limit before completing the request. Use the already loaded Mint Mods guide and choose reasonable defaults. If the user requested a mod, send the source through mod_validate and then mod_publish using their tool arguments, with at most one short progress sentence. Follow the existing permissions and approvals. If the request cannot be completed, call finish with a concise explanation. Otherwise answer the original question concisely. Avoid repeating the design discussion.";
+                native_messages.push(ChatMessage {
+                    role: ChatRole::User,
+                    content: vec![ContentBlock::Text { text: instruction.into() }],
+                });
+                trajectory.push(format_trajectory_step(step, "", "mod_authoring_recovery", instruction));
+                progress(AgentProgress::Thought {
+                    thought: "Mod preparation reached the provider output limit; continuing with the authoring tools.".into(),
+                });
+                continue 'steps;
+            }
+
             // `decisions` is normally a single `(call_id, AgentDecision)`, matching the
             // original one-action-per-step design. Native tool-calling can return
             // several tool calls in one model turn, in which case they're executed
             // sequentially and all their results are fed back before the next call —
             // `finish` never appears alongside real tool calls (see below), so this
             // never conflicts with the early-return finish handling.
+            let mut step_tool_results: Vec<ToolResultEntry> = Vec::new();
             let decisions: Vec<(String, AgentDecision)> = if tool_mode == ToolCallingMode::Native {
                 match response.tool_calls.clone() {
-                    Some(calls) if !calls.is_empty() => calls
-                        .into_iter()
-                        .enumerate()
-                        .map(|(index, call)| {
-                            let thought = if index == 0 {
-                                response.text.trim().to_string()
-                            } else {
-                                String::new()
-                            };
-                            let input: AgentInput =
-                                serde_json::from_value(call.input).unwrap_or_default();
-                            (
-                                call.id,
-                                AgentDecision {
-                                    thought,
-                                    action: call.name,
-                                    input,
+                    Some(calls) if !calls.is_empty() => {
+                        let (decisions, errors) = prepare_native_tool_calls(
+                            calls, response.text.trim(), &mut invalid_tool_calls,
+                        )?;
+                        for ToolResultEntry{action,input,text:error,..} in &errors {
+                            progress(AgentProgress::ToolStart { call_id: None, action: action.clone(), input: input.clone(), subagent: None });
+                            progress(AgentProgress::ToolEnd { elapsed_ms: None, call_id: None, status: None, action: action.clone(), input: input.clone(), result: error.clone(), subagent: None });
+                            trajectory.push(format_trajectory_step(step, "", action, error));
+                            trajectory_run.record_step(StandardTrajectoryStep {
+                                step,
+                                timestamp: chrono::Utc::now().to_rfc3339(),
+                                thought: String::new(),
+                                action: action.clone(),
+                                input: input.clone(),
+                                observation: error.clone(),
+                                status: "failed".to_string(),
+                                duration_ms: thought_started.elapsed().as_millis() as u64,
+                                tokens: StepTokens {
+                                    input_tokens: last_input_tokens,
+                                    generated_tokens: response.output_tokens.unwrap_or(0) as u64,
                                 },
-                            )
-                        })
-                        .collect(),
+                            });
+                        }
+                        step_tool_results.extend(errors);
+                        decisions
+                    }
                     // No tool calls means the model answered directly — treat exactly
                     // like the JSON-prompt path's fallback for plain, non-JSON text
                     // (see `parse_decision_or_finish`): finish with that text as the
@@ -1889,7 +2438,7 @@ where
                 let mut decision = match parse_decision_or_finish(&response.text) {
                     Ok(decision) => decision,
                     Err(_) => {
-                        let (repaired, _) = send_chat_with_fallback(
+                        let (repaired, _) = run_control::run(send_chat_with_fallback(
                             &active_config,
                             &ChatRequest {
                                 message: format!(
@@ -1913,7 +2462,7 @@ where
                                 temperature: active_config.temperature,
                                 ..Default::default()
                             },
-                        )
+                        ))
                         .await?;
                         parse_decision_or_finish(&repaired.text).map_err(|e| {
                             OrchestrationError::Agent(format!(
@@ -1951,7 +2500,6 @@ where
                 extended_emitted = true;
             }
 
-            let mut step_tool_results: Vec<(String, String, Value, String)> = Vec::new();
             // Screenshots (and any future binary/image tool result) are kept out of
             // `step_tool_results`'s plain-text `final_result` — that string is what
             // both the text `trajectory` and the JSON-prompt `observation` are built
@@ -1960,24 +2508,11 @@ where
             // data URI is stashed here by `call_id` instead, and re-attached as a
             // real `ContentBlock::Image` when building `native_messages` below, so
             // the model actually sees the pixels instead of a truncated text blob.
-            let mut step_images: std::collections::HashMap<String, String> =
+            let mut step_images: std::collections::HashMap<String, Vec<String>> =
                 std::collections::HashMap::new();
 
-            if decisions_are_parallel_subagent_batch(&decisions) {
-                step_tool_results = run_parallel_subagent_batch(
-                    &decisions,
-                    step,
-                    &root,
-                    config,
-                    chat_id,
-                    &mut approve,
-                    &mut progress,
-                    &mut action_counts,
-                    &mut trajectory,
-                )
-                .await;
-            } else if decisions_are_parallel_read_only_batch(&decisions) {
-                step_tool_results = run_parallel_read_only_batch(
+            if decisions_are_parallel_read_only_batch(&decisions) {
+                let completed = run_parallel_read_only_batch(
                     &decisions,
                     step,
                     &root,
@@ -1993,8 +2528,11 @@ where
                     fast_mode,
                 )
                 .await;
+                invalid_tool_calls.observe_completed(&completed);
+                step_tool_results.extend(completed);
             } else {
                 for (call_id, decision) in decisions {
+                    if run_control::cancelled() { turn.interrupt(); return Err(OrchestrationError::Agent("Agent turn canceled by user".into())); }
                     let d_thought = decision.thought.trim();
                     if !fast_mode && !d_thought.is_empty() {
                         let already_extended = extended_emitted
@@ -2042,59 +2580,18 @@ where
                             reject_native_finish(tool_mode, &mut native_messages, &response.text, error);
                             continue 'steps;
                         }
-                        if unverified_modification(
-                            last_modify_step,
-                            last_verify_step,
-                            &decision.input.verification,
-                        ) {
-                            let err_msg = "Error: You modified a file (apply_patch/write_file) in this \
-                                       run but finished without verifying it. Call the verify tool \
-                                       with build/test/lint commands appropriate for this project \
-                                       before finishing. If no check genuinely applies (e.g. no test \
-                                       suite, documentation-only change), say so explicitly in the \
-                                       finish action's 'verification' field and finish again.";
-                            trajectory.push(format_trajectory_step(
-                                step,
-                                &decision.thought,
-                                &decision.action,
-                                err_msg,
-                            ));
-                            rebuild_observation(task, &root, &trajectory, &mut observation);
-                            reject_native_finish(
-                                tool_mode,
-                                &mut native_messages,
-                                &response.text,
-                                err_msg,
-                            );
-                            continue 'steps;
-                        }
-                        if unacknowledged_verify_failure(
-                            last_verify_failed,
-                            &decision.input.verification,
-                        ) {
-                            let err_msg = "Error: Your last verify call reported a failure \
-                                       (non-zero exit code), but you're finishing without \
-                                       addressing it. Read the stdout/stderr from that verify \
-                                       call, fix the actual problem, and run verify again until \
-                                       it passes. Do not report success in the finish summary \
-                                       while a real check is failing — if the failure is genuinely \
-                                       unrelated to your change (e.g. pre-existing), say so \
-                                       explicitly in the finish action's 'verification' field and \
-                                       finish again.";
-                            trajectory.push(format_trajectory_step(
-                                step,
-                                &decision.thought,
-                                &decision.action,
-                                err_msg,
-                            ));
-                            rebuild_observation(task, &root, &trajectory, &mut observation);
-                            reject_native_finish(
-                                tool_mode,
-                                &mut native_messages,
-                                &response.text,
-                                err_msg,
-                            );
-                            continue 'steps;
+                        let completion_status = match reliability::completion(&decision.input.completion_status, &decision.input.verification) {
+                            Ok(status) => status,
+                            Err(error) => {
+                                trajectory.push(format_trajectory_step(step, &decision.thought, &decision.action, &error));
+                                rebuild_observation(task, &root, &trajectory, &mut observation);
+                                reject_native_finish(tool_mode, &mut native_messages, &response.text, &error);
+                                continue 'steps;
+                            }
+                        };
+                        if completion_status != "verified" {
+                            let notice = format!("\n\nCompletion: {}. {}", completion_status, decision.input.verification.trim());
+                            summary.push_str(&notice);
                         }
                         // Auto-append generated media (image/video) and model feedback to summary if LLM omitted it
                         let mut media_blocks = Vec::new();
@@ -2127,6 +2624,20 @@ where
                             on_chunk(remainder.to_owned());
                         }
 
+                        if config.auto_skill_writing && allow_subagent_dispatch && !run_control::cancelled() && looks_skill_worthy(step, &action_counts) {
+                            match auto_write_skill(config, task, &summary, &root, &skills, &mut approve).await {
+                                Ok(Some(message)) => {
+                                    on_chunk(format!("\n\n{message}"));
+                                    summary.push_str(&format!("\n\n{message}"));
+                                }
+                                Ok(None) => {}
+                                Err(error) => {
+                                    let message = format!("Skill proposal was not saved: {error}");
+                                    on_chunk(format!("\n\n{message}"));
+                                    summary.push_str(&format!("\n\n{message}"));
+                                }
+                            }
+                        }
                         memory.save_workspace_session(
                             &root.to_string_lossy(),
                             &summary,
@@ -2145,19 +2656,17 @@ where
                             summary.clone(),
                             turn.id,
                         );
-                        if config.auto_skill_writing && looks_skill_worthy(step, &action_counts) {
-                            spawn_auto_skill_write(
-                                config.clone(),
-                                task.to_string(),
-                                summary.clone(),
-                                root.clone(),
-                                skills.clone(),
-                            );
-                        }
+                        trajectory_run.finish(
+                            completion_status.to_ascii_uppercase(),
+                            turn_total_tokens,
+                            started_at.elapsed().as_secs_f64(),
+                            files_created.iter().cloned().collect(),
+                            files_modified.iter().cloned().collect(),
+                        );
                         let run_summary = RunTelemetrySummary {
-                            run_id: format!("run-{}", chrono::Local::now().format("%Y%m%d%H%M%S")),
+                            run_id: run_id.clone(),
                             task: task.to_string(),
-                            outcome: "SUCCESS".to_string(),
+                            outcome: completion_status.to_ascii_uppercase(),
                             total_tokens: turn_total_tokens as usize,
                             tool_calls_count: executed_tools.len(),
                             files_changed: files_created
@@ -2169,7 +2678,9 @@ where
                             duration_secs: started_at.elapsed().as_secs_f64(),
                             tool_timeline: executed_tools.clone(),
                             retries_count: executed_tools.iter().filter(|t| t.retried).count(),
+                            trajectory: Some(trajectory_run),
                         };
+                        let _ = execute_mod_requests(&root, chat_id, config, plan_mode, &mut approve, &mut progress, None).await;
                         progress(AgentProgress::RunCompleted {
                             summary: run_summary,
                         });
@@ -2186,6 +2697,7 @@ where
                             model: final_model,
                             summary,
                             verification,
+                            completion_status,
                             fallback: final_fallback,
                             fallback_reason: final_fallback_reason,
                             total_tokens: turn_total_tokens,
@@ -2194,6 +2706,55 @@ where
                         });
                     }
 
+                    if decision.action == "mcp_tool" && mcp_review.blocks_repeat(&decision.input.server,&decision.input.tool,&decision.input.arguments) {
+                        let message="Error: Automatic repeat blocked: this Device command's completion is unconfirmed. Read its status or wait for a new user instruction; do not send the command again this turn.".to_string();
+                        trajectory.push(format_trajectory_step(step,&decision.thought,&decision.action,&message));
+                        trajectory_run.record_step(StandardTrajectoryStep {
+                            step,
+                            timestamp: chrono::Utc::now().to_rfc3339(),
+                            thought: decision.thought.clone(),
+                            action: decision.action.clone(),
+                            input: tool_progress_input(&root,&decision),
+                            observation: message.clone(),
+                            status: "intercepted".to_string(),
+                            duration_ms: thought_started.elapsed().as_millis() as u64,
+                            tokens: StepTokens {
+                                input_tokens: last_input_tokens,
+                                generated_tokens: response.output_tokens.unwrap_or(0) as u64,
+                            },
+                        });
+                        step_tool_results.push((call_id.clone(),decision.action.clone(),tool_progress_input(&root,&decision),message).into());
+                        continue;
+                    }
+
+                    if decision.action == "mcp_tool" && !plan_mode
+                        && pinned_mcp_server.is_none_or(|p|p==decision.input.server)
+                        && let Some(preparation) = tools::plugins_mcp::prepare(
+                            &decision.input,config,chat_id,&mut mcp_review,&mut approve,&mut progress,
+                        ).await? {
+                            if preparation.status == crate::mcp_result::ToolStatus::Cancelled || run_control::cancelled() {
+                                progress(AgentProgress::Thought{thought:preparation.text.clone()});
+                                turn.interrupt();return Err(OrchestrationError::Agent(preparation.text));
+                            }
+                            trajectory.push(format_trajectory_step(step,&decision.thought,&decision.action,&preparation.text));
+                            trajectory_run.record_step(StandardTrajectoryStep {
+                                step,
+                                timestamp: chrono::Utc::now().to_rfc3339(),
+                                thought: decision.thought.clone(),
+                                action: decision.action.clone(),
+                                input: tool_progress_input(&root,&decision),
+                                observation: preparation.text.clone(),
+                                status: "intercepted".to_string(),
+                                duration_ms: thought_started.elapsed().as_millis() as u64,
+                                tokens: StepTokens {
+                                    input_tokens: last_input_tokens,
+                                    generated_tokens: response.output_tokens.unwrap_or(0) as u64,
+                                },
+                            });
+                            step_tool_results.push(ToolResultEntry{call_id:call_id.clone(),action:decision.action.clone(),input:tool_progress_input(&root,&decision),text:preparation.text,status:preparation.status});
+                            continue;
+                    }
+
                     let action_key = action_fingerprint(&decision);
                     let action_count = {
                         let count = action_counts.entry(action_key).or_insert(0);
@@ -2202,9 +2763,13 @@ where
                     };
 
                     // Set only on the real `execute_tool` path below (PreHookOutcome::Allowed);
-                    // stays false for plan-mode/hook blocks and the duplicate-shell skip, since
+                    // stays false for plan-mode/hook blocks, since
                     // those don't actually run anything and shouldn't count toward verification.
                     let mut action_succeeded = false;
+                    let mut outcome_status = None;
+                    // Provider tool IDs may restart at call_0 on the next model step.
+                    // Activity and artifact IDs must identify this invocation across the chat.
+                    let activity_call_id = uuid::Uuid::new_v4().to_string();
                     let target_file_existed = match decision.action.as_str() {
                         "write_file" => {
                             !decision.input.path.is_empty()
@@ -2288,11 +2853,6 @@ where
                             "Blocked: '{}' is not available in plan mode (read-only investigation only). Call exit_plan_mode with your proposed plan once you are ready to implement it; the user will approve or reject it.",
                             decision.action
                         )
-                    } else if decision.action == "run_shell" && action_count > 1 {
-                        format!(
-                            "Skipped duplicate shell command: {}\n\n[System Tip: This exact shell command already ran once in this task. Do not run it again. Use the finish action now and tell the user the action was completed.]",
-                            decision.input.command.trim()
-                        )
                     } else if pinned_mcp_server.is_some_and(|p| {
                         (decision.action == "mcp_tool" || decision.action == "mcp_list_tools")
                             && decision.input.server != p
@@ -2303,92 +2863,138 @@ where
                         )
                     } else {
                         let input_val =
-                            serde_json::to_value(&decision.input).unwrap_or(Value::Null);
-                        progress(AgentProgress::ToolStart {
+                            tool_progress_input(&root, &decision);
+                        let loop_decision = repetition_guard.check(&decision.action, &input_val);
+                        progress(AgentProgress::ToolStart { call_id: Some(activity_call_id.clone()),
                             action: decision.action.clone(),
                             input: input_val.clone(),
                             subagent: None,
                         });
 
-                        match crate::hooks::run_pre_tool_hooks(
-                            &hooks,
-                            &decision.action,
-                            &input_val,
-                            &root,
-                        ) {
-                            crate::hooks::PreHookOutcome::Blocked(reason) => {
-                                format!(
-                                    "Blocked by hook: {}\n\n[System Tip: A configured PreToolUse hook rejected this action. Adjust your approach or ask the user for guidance.]",
-                                    reason
-                                )
+                        match loop_decision {
+                            loop_guard::LoopGuardDecision::InterceptStuckLoop { ref action, ref reason, ref instruction } => {
+                                outcome_status = Some(crate::integrations::mcp_result::ToolStatus::Failed);
+                                action_succeeded = false;
+                                progress(AgentProgress::Thought {
+                                    thought: format!("[Stuck-Loop Guard] Intercepted repeated call to '{action}': {reason}"),
+                                });
+                                instruction.clone()
                             }
-                            crate::hooks::PreHookOutcome::Allowed => {
-                                if matches!(
-                                    decision.action.as_str(),
-                                    "write_file" | "apply_patch" | "note_write"
-                                ) {
-                                    let target_path = if !decision.input.path.is_empty() {
-                                        Some(decision.input.path.as_str())
-                                    } else {
-                                        None
-                                    };
-                                    let _ = crate::git::create_checkpoint(
-                                        &root,
-                                        chat_id,
-                                        step,
-                                        &decision.action,
-                                        target_path,
-                                        &format!("Before Step {step}: {}", decision.action),
-                                    );
-                                }
-
-                                let (tool_result, success) = match execute_tool(
-                                    &root,
-                                    config,
-                                    &decision,
-                                    chat_id,
-                                    &mut approve,
-                                    &mut progress,
-                                )
-                                .await
-                                {
-                                    Ok(result) => (result, true),
-                                    Err(error) => (format!("Error: {}", error), false),
-                                };
-                                action_succeeded = success;
-                                let hook_messages = crate::hooks::run_post_tool_hooks(
+                            _ => {
+                                match crate::hooks::run_pre_tool_hooks(
                                     &hooks,
                                     &decision.action,
                                     &input_val,
-                                    &tool_result,
-                                    success,
                                     &root,
-                                );
-                                if hook_messages.is_empty() {
-                                    tool_result
-                                } else {
-                                    format!(
-                                        "{}\n\n{}",
-                                        tool_result,
-                                        hook_messages
-                                            .iter()
-                                            .map(|message| format!("[Hook] {}", message))
-                                            .collect::<Vec<_>>()
-                                            .join("\n")
-                                    )
+                                ) {
+                                    crate::hooks::PreHookOutcome::Blocked(reason) => {
+                                        format!(
+                                            "Blocked by hook: {}\n\n[System Tip: A configured PreToolUse hook rejected this action. Adjust your approach or ask the user for guidance.]",
+                                            reason
+                                        )
+                                    }
+                                    crate::hooks::PreHookOutcome::Allowed => {
+                                        if matches!(
+                                            decision.action.as_str(),
+                                            "write_file" | "apply_patch" | "note_write"
+                                        ) {
+                                            let target_path = if !decision.input.path.is_empty() {
+                                                Some(decision.input.path.as_str())
+                                            } else {
+                                                None
+                                            };
+                                            let _ = crate::git::create_checkpoint(
+                                                &root,
+                                                chat_id,
+                                                step,
+                                                &decision.action,
+                                                target_path,
+                                                &format!("Before Step {step}: {}", decision.action),
+                                            );
+                                        }
+
+                                        let (mut tool_result, success) = match execute_tool_outcome_reviewed(
+                                            &root,
+                                            config,
+                                            &decision,
+                                            chat_id,
+                                            &mut approve,
+                                            &mut progress,
+                                            &activity_call_id,
+                                            Some(&mcp_review),
+                                        )
+                                        .await
+                                        {
+                                            Ok(outcome) => {
+                                                if decision.action=="mcp_tool" {mcp_review.record_result(&decision.input.server,&decision.input.tool,&decision.input.arguments,&outcome);}
+                                                outcome_status = Some(outcome.status);
+                                                if !outcome.images.is_empty() { step_images.insert(call_id.clone(), outcome.images); }
+                                                let success = outcome.status == crate::integrations::mcp_result::ToolStatus::Success;
+                                                (outcome.text, success)
+                                            },
+                                            Err(error) => (format!("Error: {}", error), false),
+                                        };
+                                        action_succeeded = success;
+                                        if success {
+                                            invalid_tool_calls.succeeded(&decision.action);
+                                        }
+                                        if let loop_guard::LoopGuardDecision::WarnConsecutiveRepeat { ref notice, .. } = loop_decision {
+                                            tool_result.push_str(&format!("\n\n{notice}"));
+                                        }
+                                        if step >= warning_threshold {
+                                            let remaining = max_steps.saturating_sub(step);
+                                            if remaining == 0 {
+                                                tool_result.push_str("\n\n[CRITICAL STEP LIMIT REACHED - FINAL STEP]: Step budget exhausted. Do not call more tools. Call 'finish' now with your summary.");
+                                            } else {
+                                                tool_result.push_str(&format!(
+                                                    "\n\n[Step Budget Warning]: Step {}/{} ({} step{} remaining). Please begin consolidating your findings and call 'finish'.",
+                                                    step, max_steps, remaining, if remaining == 1 { "" } else { "s" }
+                                                ));
+                                            }
+                                        }
+                                        let hook_messages = crate::hooks::run_post_tool_hooks(
+                                            &hooks,
+                                            &decision.action,
+                                            &input_val,
+                                            &tool_result,
+                                            success,
+                                            &root,
+                                        );
+                                        if hook_messages.is_empty() {
+                                            tool_result
+                                        } else {
+                                            format!(
+                                                "{}\n\n{}",
+                                                tool_result,
+                                                hook_messages
+                                                    .iter()
+                                                    .map(|message| format!("[Hook] {}", message))
+                                                    .collect::<Vec<_>>()
+                                                    .join("\n")
+                                            )
+                                        }
+                                    }
                                 }
                             }
                         }
                     };
 
-                    progress(AgentProgress::ToolEnd {
+                    if outcome_status.is_none() && matches!(decision.action.as_str(), "mcp_tool" | "mcp_list_tools") {
+                        outcome_status = Some(if action_succeeded {
+                            crate::integrations::mcp_result::ToolStatus::Success
+                        } else {
+                            crate::integrations::mcp_result::ToolStatus::Failed
+                        });
+                    }
+                    if run_control::cancelled() {outcome_status = Some(crate::mcp_result::ToolStatus::Cancelled);}
+                    progress(AgentProgress::ToolEnd { elapsed_ms: None, call_id: Some(activity_call_id), status: outcome_status,
                         action: decision.action.clone(),
-                        input: serde_json::to_value(&decision.input).unwrap_or(Value::Null),
+                        input: tool_progress_input(&root, &decision),
                         result: result.clone(),
                         subagent: None,
                     });
 
-                    let success = action_succeeded && !shell_result_failed(&result);
+                    let success = outcome_status.map(|s| s == crate::mcp_result::ToolStatus::Success).unwrap_or(action_succeeded);
                     let target = if !decision.input.path.is_empty() {
                         decision.input.path.clone()
                     } else if !decision.input.command.is_empty() {
@@ -2409,10 +3015,15 @@ where
                         retried,
                     });
 
+                    if outcome_status == Some(crate::integrations::mcp_result::ToolStatus::Cancelled) {
+                        turn.interrupt();
+                        return Err(OrchestrationError::Agent(result));
+                    }
+
                     if action_succeeded {
                         match decision.action.as_str() {
                             "apply_patch" | "write_file" | "note_write" => {
-                                last_modify_step = Some(step);
+                                repetition_guard.notify_state_change();
                                 let path = if let Some(patch) = &decision.input.patch {
                                     patch.path.to_string_lossy().into_owned()
                                 } else if !decision.input.path.is_empty() {
@@ -2437,8 +3048,7 @@ where
                             // actually passed is tracked separately in `last_verify_failed`
                             // and enforced by `unacknowledged_verify_failure` at finish time.
                             "verify" | "run_tests" | "run_typecheck" | "run_linter" => {
-                                last_verify_step = Some(step);
-                                last_verify_failed = Some(shell_result_failed(&result));
+                                last_verify_failed = Some(!success);
                             }
                             _ => {}
                         }
@@ -2452,7 +3062,7 @@ where
                                 | "video_waveform"
                                 | "view_image"
                         ) {
-                        step_images.insert(call_id.clone(), result.clone());
+                        step_images.insert(call_id.clone(), vec![result.clone()]);
                         match decision.action.as_str() {
                             "video_filmstrip" => "[Filmstrip generated — see attached image: \
                                 sampled frames across the video timeline]"
@@ -2464,28 +3074,31 @@ where
                             _ => "[Screenshot captured — see attached image]".to_string(),
                         }
                     } else {
-                        if decision.action.starts_with("browser_") {result.clone()} else {truncate(&result)}
+                        model_tool_result(&decision.action, &result)
                     };
                     if matches!(
                         decision.action.as_str(),
                         "run_shell" | "verify" | "run_tests" | "run_typecheck" | "run_linter"
                     ) {
                         if shell_result_failed(&result) {
-                            final_result.push_str(
-                        "\n\n[System Tip: The command failed with a non-zero exit code. \
-                         Analyze the stdout/stderr above to locate the error, read the offending files, \
-                         apply corrected edits (using apply_patch), and run the verification command again. \
-                         Do not finish or stop until the compilation or test errors are resolved!]"
-                    );
+                            if let Some(diag) = diagnostics::diagnose_command_failure(&decision.input.command, &result, None) {
+                                final_result.push_str(&format!("\n\n{diag}"));
+                            } else {
+                                final_result.push_str(
+                                    "\n\n[System Tip: The command failed with a non-zero exit code. \
+                                     Analyze the stdout/stderr above to locate the error, read the offending files, \
+                                     apply corrected edits (using apply_patch), and run the verification command again. \
+                                     If checks cannot pass, finish with completionStatus=blocked/failed/unverified and explain the actual result; never claim they passed.]"
+                                );
+                            }
                         }
                     }
                     if decision.action == "apply_patch" || decision.action == "write_file" {
                         final_result.push_str(
                     "\n\n[System Tip: The file edit was approved and applied successfully. \
                      Before finishing, verify this change with the verify tool (build/test/lint, \
-                     whatever fits this project) — finish will be rejected until you do, unless you \
-                     state in the finish action's verification field why no check applies (e.g. no \
-                     test suite, documentation-only change). Do not broaden the scope, do not make \
+                     whatever fits this project). If no check applies, finish with completionStatus=unverified \
+                     and explain why in verification. A written explanation is not a passed check. Do not broaden the scope, do not make \
                      additional unrelated edits, and do not reread the same file unless you need one \
                      concise verification read.]",
                 );
@@ -2505,93 +3118,93 @@ where
                         &final_result,
                     ));
 
-                    step_tool_results.push((
-                        call_id,
-                        decision.action.clone(),
-                        serde_json::to_value(&decision.input).unwrap_or(Value::Null),
-                        final_result,
-                    ));
+                    let step_input_val = serde_json::to_value(&decision.input).unwrap_or(Value::Null);
+                    let step_status_str = match outcome_status {
+                        Some(crate::integrations::mcp_result::ToolStatus::Success) => "success",
+                        Some(crate::integrations::mcp_result::ToolStatus::Failed) => "failed",
+                        Some(crate::integrations::mcp_result::ToolStatus::TimedOut) => "timed_out",
+                        Some(crate::integrations::mcp_result::ToolStatus::Cancelled) => "cancelled",
+                        Some(crate::integrations::mcp_result::ToolStatus::Skipped) => "skipped",
+                        _ => if success { "success" } else { "failed" },
+                    };
+                    trajectory_run.record_step(StandardTrajectoryStep {
+                        step,
+                        timestamp: chrono::Utc::now().to_rfc3339(),
+                        thought: decision.thought.clone(),
+                        action: decision.action.clone(),
+                        input: step_input_val,
+                        observation: final_result.clone(),
+                        status: step_status_str.to_string(),
+                        duration_ms: thought_started.elapsed().as_millis() as u64,
+                        tokens: StepTokens {
+                            input_tokens: last_input_tokens,
+                            generated_tokens: response.output_tokens.unwrap_or(0) as u64,
+                        },
+                    });
+
+                    step_tool_results.push(ToolResultEntry {
+                        call_id, action:decision.action.clone(), input:serde_json::to_value(&decision.input).unwrap_or(Value::Null),
+                        text:final_result, status:outcome_status.unwrap_or(if success {crate::mcp_result::ToolStatus::Success}else{crate::mcp_result::ToolStatus::Failed}),
+                    });
                 } // end `for (call_id, decision) in decisions`
             } // end `else` (sequential path)
 
-            if tool_mode == ToolCallingMode::Native {
-                let mut assistant_content: Vec<ContentBlock> = Vec::new();
-                let response_text = response.text.trim();
-                if !response_text.is_empty() {
-                    assistant_content.push(ContentBlock::Text {
-                        text: response_text.to_string(),
-                    });
-                }
-                let mut tool_result_content: Vec<ContentBlock> = Vec::new();
-                for (call_id, action, input_value, final_result) in &step_tool_results {
-                    assistant_content.push(ContentBlock::ToolUse {
-                        id: call_id.clone(),
-                        name: action.clone(),
-                        input: input_value.clone(),
-                        thought_signature: step_thought_signatures.get(call_id).cloned(),
-                    });
-                    tool_result_content.push(ContentBlock::ToolResult {
-                        tool_use_id: call_id.clone(),
-                        content: final_result.clone(),
-                        is_error: false,
-                    });
-                    if let Some(data_uri) = step_images.get(call_id) {
-                        tool_result_content.push(ContentBlock::Image {
-                            data_uri: data_uri.clone(),
-                        });
+            if run_control::cancelled() { turn.interrupt(); return Err(OrchestrationError::Agent("Agent turn canceled by user".into())); }
+
+            // All interfaces and both native/JSON tool modes share this guard.
+            // Inspect failures, not action counts: legitimate repeated reads
+            // and successful edits must not be stopped as loops.
+            match repeated_failures.observe(step, &mut step_tool_results) {
+                Ok(warnings) => {
+                    for warning in warnings {
+                        progress(AgentProgress::Thought { thought: warning.clone() });
+                        trajectory.push(format!("Step {step} loop warning: {warning}"));
                     }
                 }
-                if !assistant_content.is_empty() {
-                    native_messages.push(ChatMessage {
-                        role: ChatRole::Assistant,
-                        content: assistant_content,
-                    });
-                }
-                if !tool_result_content.is_empty() {
-                    native_messages.push(ChatMessage {
-                        role: ChatRole::Tool,
-                        content: tool_result_content,
-                    });
+                Err(error) => {
+                    progress(AgentProgress::Thought { thought: error.to_string() });
+                    return Err(error);
                 }
+            }
+
+            if tool_mode == ToolCallingMode::JsonPrompt && !step_images.is_empty() {
+                pending_image = Some(step_images.values().flatten().cloned().collect::<Vec<_>>().join(" "));
+            }
+            if tool_mode == ToolCallingMode::Native {
+                append_native_tool_results(
+                    &mut native_messages,
+                    response.text.trim(),
+                    &step_tool_results,
+                    &step_thought_signatures,
+                    &step_images,
+                );
+                prune_historic_images_from_native_messages(
+                    &mut native_messages,
+                    MAX_RETAINED_IMAGE_STEPS,
+                );
 
                 if let Some(total_tokens) = response.total_tokens {
                     let window = active_config.context_window_tokens();
                     last_context_pct = Some(
                         ((total_tokens as f64 / window as f64) * 100.0).clamp(0.0, 255.0) as u8,
                     );
-                    if (total_tokens as f64) >= (window as f64) * COMPACTION_TRIGGER_RATIO {
-                        match compact_native_messages(&active_config, &native_messages).await {
-                            Ok(Some((compacted, fallback_provider))) => {
-                                native_messages = compacted;
-                                let fallback_note = fallback_provider
-                                    .as_deref()
-                                    .map(|p| {
-                                        format!(
-                                            " (summary generated via fallback provider \
-                                             \"{p}\" — the primary provider failed for this \
-                                             call)"
-                                        )
-                                    })
-                                    .unwrap_or_default();
-                                progress(AgentProgress::Thought {
-                                    thought: format!(
-                                        "[Context] Compacted earlier steps to stay under the \
-                                     context window ({total_tokens}/{window} tokens before \
-                                     compaction){fallback_note}."
-                                    ),
-                                });
-                            }
-                            // Nothing worth compacting yet (too little history) — routine, no warning.
-                            Ok(None) => {}
-                            Err(error) => {
-                                progress(AgentProgress::Thought {
-                                    thought: format!(
-                                        "[Context] Context is approaching the model's window \
-                                     ({total_tokens}/{window} tokens) but compaction failed: \
-                                     {error}. Continuing without compacting this step."
-                                    ),
-                                });
-                            }
+                    let compaction_needed = (total_tokens as f64) >= (window as f64) * COMPACTION_TRIGGER_RATIO
+                        || (step >= ADAPTIVE_COMPACTION_MIN_STEPS && total_tokens >= ADAPTIVE_COMPACTION_TOKEN_CEILING);
+                    if compaction_needed {
+                        let eligible = native_messages.len().saturating_sub(1) / 2 > COMPACTION_KEEP_RECENT_STEPS;
+                        if let Ok(Some((compacted, _))) = run_control::run(report_context_compaction(
+                            eligible,
+                            total_tokens,
+                            window,
+                            compact_native_messages(&active_config, &native_messages),
+                            &mut progress,
+                        )).await {
+                            native_messages = compacted;
+                            let payload = mod_usage.compacted();
+                            let _ = crate::mods::event(&root, chat_id, "context_compacted", payload, None);
+                            // Wait for actual usage from the next request, rather than
+                            // displaying the pre-compaction percentage as current.
+                            last_context_pct = None;
                         }
                     }
                 }
@@ -2600,10 +3213,123 @@ where
             rebuild_observation(task, &root, &trajectory, &mut observation);
         }
 
+        progress(AgentProgress::Thought {
+            thought: format!(
+                "[Step Limit Reached] Reached maximum allowed steps ({max_steps}). Synthesizing final findings for user..."
+            ),
+        });
+
+        let (wrapup_config, _, _, _) = resolve_agent_config(config, agent_id, &trajectory);
+        let mut final_streamed_summary = String::new();
+        let mut emit_wrapup_chunk = |chunk| match chunk {
+            AgentStreamChunk::DirectText(delta) | AgentStreamChunk::FinalSummary(delta) => {
+                final_streamed_summary.push_str(&delta);
+                on_chunk(delta);
+            }
+        };
+
+        let synthesis_instruction = format!(
+            "You are an AI assistant completing a multi-step task. The step limit of {max_steps} steps has been reached. \
+             Synthesize all findings, observations, errors encountered, and links discovered so far. \
+             Provide a comprehensive, direct, and well-structured final answer to the user in their requested language."
+        );
+
+        let synthesis_succeeded = if wrapup_config.tool_calling_mode() == ToolCallingMode::Native {
+            let mut final_native = native_messages.clone();
+            final_native.push(ChatMessage {
+                role: ChatRole::User,
+                content: vec![ContentBlock::Text {
+                    text: format!(
+                        "Maximum step limit of {max_steps} reached. Do not call any tools. Please output your final answer and summary of findings now."
+                    ),
+                }],
+            });
+            let wrapup_req = ChatRequest {
+                message: String::new(),
+                system_instruction: synthesis_instruction,
+                chat_id: Some(chat_id.to_owned()),
+                image_data_uri: None,
+                audio_data_uri: None,
+                video_data_uri: None,
+                document_attachment: None,
+                workspace_path: None,
+                agent_id: None,
+                plan_mode: false,
+                pinned_mcp_server: None,
+                messages: Some(final_native),
+                tools: None,
+                temperature: wrapup_config.temperature,
+                ..Default::default()
+            };
+            run_control::run(stream_chat_with_network_retry(
+                &wrapup_config,
+                &wrapup_req,
+                &format!("step-limit-wrapup-{chat_id}"),
+                Instant::now(),
+                fast_mode,
+                &mut progress,
+                false,
+                true,
+                &mut emit_wrapup_chunk,
+            ))
+            .await
+            .is_ok()
+        } else {
+            let wrapup_req = ChatRequest {
+                message: format!(
+                    "Observation: Maximum step limit of {max_steps} reached. Please synthesize your findings and output your final answer now.\nPrevious observation:\n{observation}"
+                ),
+                system_instruction: synthesis_instruction,
+                chat_id: Some(chat_id.to_owned()),
+                image_data_uri: None,
+                audio_data_uri: None,
+                video_data_uri: None,
+                document_attachment: None,
+                workspace_path: None,
+                agent_id: None,
+                plan_mode: false,
+                pinned_mcp_server: None,
+                messages: None,
+                tools: None,
+                temperature: wrapup_config.temperature,
+                ..Default::default()
+            };
+            run_control::run(stream_chat_with_network_retry(
+                &wrapup_config,
+                &wrapup_req,
+                &format!("step-limit-wrapup-{chat_id}"),
+                Instant::now(),
+                fast_mode,
+                &mut progress,
+                false,
+                true,
+                &mut emit_wrapup_chunk,
+            ))
+            .await
+            .is_ok()
+        };
+
+        let summary = if synthesis_succeeded && !final_streamed_summary.trim().is_empty() {
+            final_streamed_summary
+        } else {
+            format!(
+                "Task concluded after reaching the step limit ({} steps). Recent activity:\n{}",
+                max_steps,
+                trajectory.iter().rev().take(5).cloned().collect::<Vec<_>>().join("\n")
+            )
+        };
+
+        trajectory_run.finish(
+            "COMPLETED",
+            turn_total_tokens,
+            started_at.elapsed().as_secs_f64(),
+            files_created.iter().cloned().collect(),
+            files_modified.iter().cloned().collect(),
+        );
         let run_summary = RunTelemetrySummary {
-            run_id: format!("run-{}", chrono::Local::now().format("%Y%m%d%H%M%S")),
+            run_id: run_id.clone(),
             task: task.to_string(),
-            outcome: "FAILED".to_string(),
+            outcome: "COMPLETED".to_string(),
             total_tokens: turn_total_tokens as usize,
             tool_calls_count: executed_tools.len(),
             files_changed: files_created
@@ -2615,22 +3341,49 @@ where
             duration_secs: started_at.elapsed().as_secs_f64(),
             tool_timeline: executed_tools.clone(),
             retries_count: executed_tools.iter().filter(|t| t.retried).count(),
+            trajectory: Some(trajectory_run),
         };
         progress(AgentProgress::RunCompleted {
             summary: run_summary,
         });
 
-        turn.fail();
-        Err(OrchestrationError::Agent(format!(
-            "code agent reached the limit of {} steps; task incomplete. Last browser state: {}",
-            MAX_STEPS, crate::browser::session_last_state().await
-        )))
-        }).await;
-        if agent_result.is_err() {
-            turn.fail();
-        }
-        agent_result
-    })
+        turn.complete_with_summary(
+            &summary,
+            &final_provider,
+            &final_model,
+            final_fallback.as_deref(),
+        )?;
+
+        return Ok(AgentResult {
+            provider: final_provider,
+            model: final_model,
+            summary,
+            verification: String::new(),
+            completion_status: "step_limit_reached".to_string(),
+            fallback: final_fallback,
+            fallback_reason: final_fallback_reason,
+            total_tokens: turn_total_tokens,
+            input_tokens: last_input_tokens,
+            generated_tokens: turn_generated_tokens,
+        });
+        }))).await;
+            if agent_result.is_err() && !turn.finished {
+                if run_control::cancelled() {
+                    turn.interrupt();
+                } else {
+                    turn.fail();
+                }
+            }
+            let mut mod_turn_end = mod_usage.finish();
+            mod_turn_end["success"] = serde_json::json!(agent_result.is_ok());
+            mod_turn_end["cancelled"] = serde_json::json!(run_control::cancelled());
+            let _ = crate::mods::event(&root, chat_id, "turn_end", mod_turn_end, None);
+            if run_control::cancelled() {
+                crate::mods::close_chat(&root, chat_id);
+            }
+            agent_result
+        },
+    ))
 }
 
 /// Whether `action` may run while plan mode is active. `run_shell` gets a
@@ -2660,300 +3413,166 @@ fn plan_mode_allows(action: &str, input: &AgentInput) -> bool {
     action == "finish" || crate::prompts::agent::PLAN_MODE_ALLOWED_ACTIONS.contains(&action)
 }
 
-/// Runs one subagent to completion and returns its formatted result text.
-/// Extracted from `execute_tool`'s `"dispatch_subagent"` arm so both the plain
-/// sequential path (a single subagent call, or one mixed in with other actions)
-/// and the parallel path (`decisions_are_parallel_subagent_batch`, driven by
-/// `buffer_unordered` in the main step loop) share one implementation. Takes
-/// the same `&mut dyn FnMut(...)` trait object as `execute_tool` — see the
-/// comment on that function for why a trait object rather than a generic —
-/// which lets the parallel path pass a small Mutex-backed adapter closure so
-/// concurrently-running subagents still share one real approval gate.
-async fn dispatch_one_subagent(
+/// Runs a swarm batch of sub-agents to completion and returns the aggregated dossier.
+pub(super) async fn dispatch_swarm(
     root: &Path,
     config: &MintConfig,
-    chat_id: &str,
-    name: &str,
-    task: &str,
+    parent_chat_id: &str,
+    tasks: Vec<crate::swarm::SwarmTask>,
     approve_cb: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
     progress: &mut (dyn FnMut(AgentProgress) + Send),
 ) -> Result<String, OrchestrationError> {
-    let Some(definition) = crate::subagents::find_subagent(name, Some(root)) else {
-        return Err(OrchestrationError::Agent(format!(
-            "no subagent named '{name}' found (check .agents/subagents/ or \
-             ~/.config/mint/mint-agents/)"
-        )));
+    let (is_plan_mode, _) = crate::mods::turn_policy(root, parent_chat_id);
+    let effective_cap = crate::swarm::effective_max_parallel(Some(config.swarm_max_parallel));
+    let profiles = |name: &str| crate::subagents::find_subagent(name, Some(root));
+    let ctx = crate::swarm::BatchCtx {
+        parent_chat_id,
+        max_parallel: effective_cap,
+        profiles: &profiles,
+        plan_mode: is_plan_mode,
     };
 
-    let mut sub_config = config.clone();
-    if let Some(provider) = &definition.provider {
-        sub_config.ai_provider = provider.clone();
-    }
-    if let Some(model) = &definition.model {
-        match sub_config.ai_provider.as_str() {
-            "anthropic" => sub_config.anthropic_model = model.clone(),
-            "openai" => sub_config.openai_model = model.clone(),
-            "openrouter" => sub_config.openrouter_model = model.clone(),
-            "deepseek" => sub_config.deepseek_model = model.clone(),
-            "huggingface" => sub_config.hf_model = model.clone(),
-            "local_openai" => sub_config.local_model_name = model.clone(),
-            "ollama" => sub_config.ollama_model = model.clone(),
-            "gemini" => sub_config.gemini_model = model.clone(),
-            _ => {}
-        }
-    }
+    let approve_mutex = std::sync::Mutex::new(approve_cb);
+    let progress_mutex = std::sync::Mutex::new(progress);
 
-    // The subagent's own persona/instructions are folded into the task
-    // framing rather than replacing Mint's system prompt (which
-    // `orchestrate_agent_loop` builds internally and isn't a parameter),
-    // so the subagent still follows the same tool-use protocol and
-    // safety rules as any other agent run.
-    let sub_task = format!(
-        "{}\n\nTask from parent agent: {task}",
-        definition.system_prompt
-    );
-    let sub_chat_id = format!("{chat_id}::subagent::{}", definition.name);
-
-    // Docker sandbox: a subagent whose resolved backend is "docker" gets one
-    // container for its whole run, started here and torn down unconditionally
-    // below (success or failure) — never per individual `run_shell` call. See
-    // `docker_sandbox`'s module doc for why this is a session-scoped resource
-    // rather than something `run_shell_command` starts itself. Subagents with
-    // no `run_shell` in their tool list (e.g. `explorer`/`plan`) never need a
-    // container, so skip starting one for them.
-    let allows_run_shell = definition
-        .tools
-        .as_ref()
-        .is_none_or(|tools| tools.iter().any(|t| t == "run_shell"));
-    let backend = definition
-        .sandbox
-        .as_deref()
-        .unwrap_or(&config.sandbox_backend);
-    let docker_started = if backend == "docker" && allows_run_shell {
-        match crate::docker_sandbox::start_session(&sub_chat_id, root, &sub_config) {
-            Ok(()) => true,
-            Err(error) if config.sandbox_mode.trim().eq_ignore_ascii_case("enforce") => {
-                return Err(OrchestrationError::Agent(format!(
-                    "subagent '{}' requires the docker sandbox (sandboxMode=enforce) but it \
-                     failed to start: {error}",
-                    definition.name
-                )));
+    let runner = |run: crate::swarm::AgentRun, emitter: crate::swarm::Emitter| {
+        let approve_mutex = &approve_mutex;
+        Box::pin(async move {
+            let mut sub_config = config.clone();
+            if let Some(provider) = &run.provider {
+                sub_config.ai_provider = provider.clone();
+            }
+            if let Some(model) = &run.model {
+                match sub_config.ai_provider.as_str() {
+                    "anthropic" => sub_config.anthropic_model = model.clone(),
+                    "openai" => sub_config.openai_model = model.clone(),
+                    "openrouter" => sub_config.openrouter_model = model.clone(),
+                    "deepseek" => sub_config.deepseek_model = model.clone(),
+                    "huggingface" => sub_config.hf_model = model.clone(),
+                    "local_openai" => sub_config.local_model_name = model.clone(),
+                    "ollama" => sub_config.ollama_model = model.clone(),
+                    "gemini" => sub_config.gemini_model = model.clone(),
+                    _ => {}
+                }
             }
-            // "prefer" (or any other non-"enforce" value): fall back to the
-            // subagent's shell commands running unconfined/OS-sandboxed,
-            // matching `run_shell_command`'s own fallback semantics for a
-            // missing OS sandbox binary.
-            Err(_) => false,
-        }
-    } else {
-        false
-    };
 
-    // Recursing into `orchestrate_agent_loop` from inside `execute_tool`
-    // (which it itself calls) requires boxing this one call — Rust
-    // can't compute a finite size for a directly self-referential
-    // async fn cycle otherwise. `approve_cb` is reborrowed rather than
-    // moved so the subagent's mutating actions still go through the
-    // same approval gate as the caller's; `chunk` stays a no-op so the
-    // subagent's own streamed answer text never lands in the parent's chat
-    // — only its final summary (returned below) does. `progress` is *not*
-    // a no-op: `ToolStart`/`ToolEnd` are re-tagged with this subagent's name
-    // and forwarded to the caller's real `progress`, so the CLI/GUI can
-    // render the subagent's own tool calls nested under its
-    // `dispatch_subagent` call — this only affects what's shown in the UI,
-    // never what reaches the parent model's context (that isolation comes
-    // from `sub_chat_id`/`native_messages` staying local to this call, not
-    // from suppressing progress).
-    // `orchestrate_agent_loop` itself returns a boxed `dyn Future`
-    // (see its doc comment) specifically so this recursive call can
-    // just be awaited directly, with no manual boxing needed here.
-    let subagent_name = definition.name.clone();
-    let mut nested_progress = |event: AgentProgress| {
-        let tagged = match event {
-            AgentProgress::ToolStart { action, input, .. } => AgentProgress::ToolStart {
-                action,
-                input,
-                subagent: Some(subagent_name.clone()),
-            },
-            AgentProgress::ToolEnd {
-                action,
-                input,
-                result,
-                ..
-            } => AgentProgress::ToolEnd {
-                action,
-                input,
-                result,
-                subagent: Some(subagent_name.clone()),
-            },
-            other => other,
-        };
-        progress(tagged);
-    };
-    let result = orchestrate_agent_loop(
-        &sub_config,
-        &sub_task,
-        root,
-        None,
-        None,
-        None,
-        Some(&sub_chat_id),
-        None,
-        None,
-        None,
-        true,
-        false,
-        &mut *approve_cb,
-        &mut nested_progress,
-        |_| {},
-    )
-    .await;
-
-    let outcome = match result {
-        Ok(agent_result) => Ok(format!(
-            "[Subagent '{}' result]\n{}",
-            definition.name, agent_result.summary
-        )),
-        Err(error) => Err(OrchestrationError::Agent(format!(
-            "subagent '{}' failed: {error}",
-            definition.name
-        ))),
-    };
-    // Unconditional teardown — runs on both the Ok and Err arms above, since
-    // an orphaned container left running after a failed subagent is exactly
-    // the failure mode a session-scoped sandbox needs to avoid.
-    if docker_started {
-        crate::docker_sandbox::stop_session(&sub_chat_id);
-    }
-    outcome
-}
+            let allows_run_shell = run.permissions.allows("run_shell");
+            let backend = run.sandbox.as_deref().unwrap_or(&config.sandbox_backend);
+            let docker_started = if backend == "docker" && allows_run_shell {
+                match crate::docker_sandbox::start_session(&run.chat_id, root, &sub_config) {
+                    Ok(()) => true,
+                    Err(error) if config.sandbox_mode.trim().eq_ignore_ascii_case("enforce") => {
+                        return Err(format!(
+                            "agent '{}' requires docker sandbox (sandboxMode=enforce) but failed: {error}",
+                            run.label
+                        ));
+                    }
+                    Err(_) => false,
+                }
+            } else {
+                false
+            };
 
-/// Runs a step's `dispatch_subagent` decisions concurrently (see
-/// `decisions_are_parallel_subagent_batch` for when this is used instead of
-/// the normal one-at-a-time loop), capped at `PARALLEL_SUBAGENT_LIMIT` in
-/// flight at once. `progress`/`action_counts`/`trajectory` are only touched
-/// after every future has completed — back in single-threaded code, in the
-/// decisions' original order — so this never needs to share those across
-/// concurrent tasks. `approve` is the one resource genuinely needed *during*
-/// concurrent execution (a subagent's own risky actions still need real user
-/// approval), so it's wrapped in a `std::sync::Mutex` for the batch: each
-/// concurrent subagent gets a small adapter closure over a shared `&Mutex`,
-/// serializing just the moment of invoking it rather than the whole call.
-#[allow(clippy::too_many_arguments)]
-async fn run_parallel_subagent_batch(
-    decisions: &[(String, AgentDecision)],
-    step: usize,
-    root: &Path,
-    config: &MintConfig,
-    chat_id: &str,
-    approve: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
-    progress: &mut (dyn FnMut(AgentProgress) + Send),
-    action_counts: &mut BTreeMap<String, usize>,
-    trajectory: &mut Vec<String>,
-) -> Vec<(String, String, Value, String)> {
-    let approve_mutex = std::sync::Mutex::new(approve);
-    // Concurrently-running subagents share one real `progress` sink the same
-    // way they share one real `approve` gate above — each gets a small
-    // Mutex-backed adapter closure so their nested `ToolStart`/`ToolEnd`
-    // events (tagged with their own subagent name in `dispatch_one_subagent`)
-    // still reach the CLI/GUI, interleaved but not corrupted, instead of the
-    // batch staying silent until every item in it finishes.
-    let progress_mutex = std::sync::Mutex::new(progress);
+            let subagent_label = run.label.clone();
+            let sub_task = format!(
+                "{}\n\nTask from parent agent: {}",
+                run.system_prompt, run.instruction
+            );
+            let run_chat_id = run.chat_id.clone();
+            let permissions = run.permissions.clone();
 
-    let mut dispatches = Vec::with_capacity(decisions.len());
-    for (index, (call_id, decision)) in decisions.iter().enumerate() {
-        let call_id = call_id.clone();
-        let thought = decision.thought.clone();
-        let action = decision.action.clone();
-        let input_val = serde_json::to_value(&decision.input).unwrap_or(Value::Null);
-        let action_key = action_fingerprint(decision);
-        let name = decision.input.name.clone();
-        let task_text = decision.input.instruction.clone();
-        let approve_mutex = &approve_mutex;
-        let progress_mutex = &progress_mutex;
-        dispatches.push(async move {
-            let result: Result<String, OrchestrationError> = if name.trim().is_empty() {
-                Err(OrchestrationError::Agent("name is required".into()))
-            } else if task_text.trim().is_empty() {
-                Err(OrchestrationError::Agent("instruction is required".into()))
-            } else {
-                let mut approve_adapter =
-                    |approval: &AgentApproval| -> Result<ApprovalOutcome, String> {
-                        let mut guard = approve_mutex.lock().unwrap();
-                        (*guard)(approval)
-                    };
-                let mut progress_adapter = |event: AgentProgress| {
-                    let mut guard = progress_mutex.lock().unwrap();
-                    (*guard)(event);
+            let steps_counter = std::sync::atomic::AtomicU32::new(1);
+            let mut nested_progress = |event: AgentProgress| {
+                if matches!(event, AgentProgress::ToolStart { .. }) {
+                    steps_counter.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                }
+                let tagged = match event {
+                    AgentProgress::ToolStart {
+                        action,
+                        input,
+                        call_id,
+                        ..
+                    } => AgentProgress::ToolStart {
+                        call_id,
+                        action,
+                        input,
+                        subagent: Some(subagent_label.clone()),
+                    },
+                    AgentProgress::ToolEnd {
+                        elapsed_ms,
+                        action,
+                        input,
+                        result,
+                        call_id,
+                        status,
+                        ..
+                    } => AgentProgress::ToolEnd {
+                        elapsed_ms,
+                        call_id,
+                        status,
+                        action,
+                        input,
+                        result,
+                        subagent: Some(subagent_label.clone()),
+                    },
+                    AgentProgress::ContextCompaction {
+                        status, message, ..
+                    } => AgentProgress::ContextCompaction {
+                        status,
+                        message,
+                        subagent: Some(subagent_label.clone()),
+                    },
+                    other => other,
                 };
-                dispatch_one_subagent(
-                    root,
-                    config,
-                    chat_id,
-                    &name,
-                    &task_text,
-                    &mut approve_adapter,
-                    &mut progress_adapter,
-                )
-                .await
+                emitter.progress(tagged);
             };
-            (
-                index, call_id, thought, action, input_val, action_key, result,
-            )
-        });
-    }
 
-    let mut results = futures_util::stream::iter(dispatches)
-        .buffer_unordered(PARALLEL_SUBAGENT_LIMIT)
-        .collect::<Vec<_>>()
-        .await;
-    results.sort_by_key(|(index, ..)| *index);
-    // All `dispatches` futures (the only borrowers of `progress_mutex`) have
-    // finished by now, so this is the sole remaining handle — safe to unwrap
-    // back into a plain `&mut dyn FnMut` for the rest of this function.
-    let progress = progress_mutex.into_inner().unwrap();
+            let mut nested_approve = |approval: &AgentApproval| -> Result<ApprovalOutcome, String> {
+                let mut guard = approve_mutex.lock().unwrap();
+                (*guard)(approval)
+            };
 
-    let mut step_tool_results = Vec::with_capacity(results.len());
-    for (_, call_id, thought, action, input_val, action_key, result) in results {
-        progress(AgentProgress::ToolStart {
-            action: action.clone(),
-            input: input_val.clone(),
-            subagent: None,
-        });
-        let tool_result = match result {
-            Ok(text) => text,
-            Err(error) => format!("Error: {}", error),
-        };
-        progress(AgentProgress::ToolEnd {
-            action: action.clone(),
-            input: input_val.clone(),
-            result: tool_result.clone(),
-            subagent: None,
-        });
+            let loop_fut = Box::pin(orchestrate_agent_loop(
+                &sub_config,
+                &sub_task,
+                root,
+                None,
+                None,
+                None,
+                Some(&run_chat_id),
+                None,
+                None,
+                None,
+                true,
+                false,
+                &mut nested_approve,
+                &mut nested_progress,
+                |_| {},
+            ));
+
+            let res = crate::swarm::scope_permissions(Some(permissions), loop_fut).await;
+
+            if docker_started {
+                crate::docker_sandbox::stop_session(&run_chat_id);
+            }
 
-        let action_count = {
-            let count = action_counts.entry(action_key).or_insert(0);
-            *count += 1;
-            *count
-        };
-        let mut final_result = truncate(&tool_result);
-        if action_count >= 3 && !action.starts_with("browser_") {
-            final_result.push_str(
-                "\n\n[System Tip: You repeated the same tool action three or more times. \
-                 Stop repeating it. If you already have enough information or the requested edit is done, \
-                 use the finish action now. Otherwise choose a different necessary action.]",
-            );
-        }
+            match res {
+                Ok(agent_result) => Ok(crate::swarm::RunnerOutput {
+                    text: agent_result.summary,
+                    steps: steps_counter.load(std::sync::atomic::Ordering::Relaxed),
+                }),
+                Err(err) => Err(err.to_string()),
+            }
+        })
+    };
 
-        trajectory.push(format_trajectory_step(
-            step,
-            &thought,
-            &action,
-            &final_result,
-        ));
-        step_tool_results.push((call_id, action, input_val, final_result));
-    }
-    step_tool_results
+    let mut on_event = |event: crate::swarm::SwarmEvent| {
+        let mut guard = progress_mutex.lock().unwrap();
+        (*guard)(event.into());
+    };
+
+    let outcomes = crate::swarm::run_batch(&ctx, tasks, runner, &mut on_event).await;
+    Ok(crate::swarm::format_batch_result(&outcomes))
 }
 
 #[allow(clippy::too_many_arguments)]
@@ -2967,11 +3586,11 @@ async fn run_parallel_read_only_batch(
     progress: &mut (dyn FnMut(AgentProgress) + Send),
     action_counts: &mut BTreeMap<String, usize>,
     trajectory: &mut Vec<String>,
-    step_images: &mut std::collections::HashMap<String, String>,
+    step_images: &mut std::collections::HashMap<String, Vec<String>>,
     hooks: &[crate::hooks::HookEntry],
     pinned_mcp_server: Option<&str>,
     fast_mode: bool,
-) -> Vec<(String, String, Value, String)> {
+) -> Vec<ToolResultEntry> {
     let approve_mutex = std::sync::Mutex::new(approve);
     let progress_mutex = std::sync::Mutex::new(progress);
 
@@ -2980,13 +3599,14 @@ async fn run_parallel_read_only_batch(
         let call_id = call_id.clone();
         let thought = decision.thought.clone();
         let action = decision.action.clone();
-        let input_val = serde_json::to_value(&decision.input).unwrap_or(Value::Null);
+        let input_val = tool_progress_input(&root, &decision);
         let action_key = action_fingerprint(decision);
         let approve_mutex = &approve_mutex;
         let progress_mutex = &progress_mutex;
         let decision = decision;
 
         tasks.push(async move {
+            let activity_call_id=call_id.clone();
             if !fast_mode && !thought.trim().is_empty() {
                 let t = thought.trim();
                 let mut guard = progress_mutex.lock().unwrap();
@@ -3005,13 +3625,15 @@ async fn run_parallel_read_only_batch(
 
             {
                 let mut guard = progress_mutex.lock().unwrap();
-                (*guard)(AgentProgress::ToolStart {
+                (*guard)(AgentProgress::ToolStart { call_id: Some(activity_call_id.clone()),
                     action: action.clone(),
                     input: input_val.clone(),
                     subagent: None,
                 });
             }
 
+            let mut images=Vec::new();
+            let mut typed_status=None;
             let result: String = if pinned_mcp_server.is_some_and(|p| {
                 (action == "mcp_tool" || action == "mcp_list_tools") && decision.input.server != p
             }) {
@@ -3038,17 +3660,18 @@ async fn run_parallel_read_only_batch(
                             (*guard)(event);
                         };
 
-                        let (tool_result, success) = match execute_tool(
+                        let (tool_result, success) = match execute_tool_outcome(
                             root,
                             config,
                             &decision,
                             chat_id,
                             &mut approve_adapter,
                             &mut progress_adapter,
+                            &activity_call_id,
                         )
                         .await
                         {
-                            Ok(res) => (res, true),
+                            Ok(outcome) => {images=outcome.images;typed_status=Some(outcome.status);(outcome.text,outcome.status==crate::mcp_result::ToolStatus::Success)},
                             Err(err) => (format!("Error: {}", err), false),
                         };
 
@@ -3080,7 +3703,7 @@ async fn run_parallel_read_only_batch(
 
             {
                 let mut guard = progress_mutex.lock().unwrap();
-                (*guard)(AgentProgress::ToolEnd {
+                (*guard)(AgentProgress::ToolEnd { elapsed_ms: None, call_id: Some(activity_call_id.clone()), status: typed_status,
                     action: action.clone(),
                     input: input_val.clone(),
                     result: result.clone(),
@@ -3089,7 +3712,7 @@ async fn run_parallel_read_only_batch(
             }
 
             (
-                index, call_id, thought, action, input_val, action_key, result,
+                index, call_id, thought, action, input_val, action_key, result, images, typed_status,
             )
         });
     }
@@ -3102,7 +3725,12 @@ async fn run_parallel_read_only_batch(
     results.sort_by_key(|(index, ..)| *index);
 
     let mut step_tool_results = Vec::with_capacity(results.len());
-    for (_, call_id, thought, action, input_val, action_key, result) in results {
+    for (_, call_id, thought, action, input_val, action_key, result, images, typed_status) in
+        results
+    {
+        if !images.is_empty() {
+            step_images.insert(call_id.clone(), images);
+        }
         let action_count = {
             let count = action_counts.entry(action_key).or_insert(0);
             *count += 1;
@@ -3114,7 +3742,7 @@ async fn run_parallel_read_only_batch(
                 action.as_str(),
                 "browser_screenshot" | "video_filmstrip" | "video_waveform" | "view_image"
             ) {
-            step_images.insert(call_id.clone(), result.clone());
+            step_images.insert(call_id.clone(), vec![result.clone()]);
             match action.as_str() {
                 "video_filmstrip" => {
                     "[Filmstrip generated — see attached image: sampled frames across the video timeline]".to_string()
@@ -3126,7 +3754,7 @@ async fn run_parallel_read_only_batch(
                 _ => "[Screenshot captured — see attached image]".to_string(),
             }
         } else {
-            truncate(&result)
+            model_tool_result(&action, &result)
         };
 
         if action_count >= 3 && !action.starts_with("browser_") {
@@ -3144,7 +3772,11 @@ async fn run_parallel_read_only_batch(
             &final_result,
         ));
 
-        step_tool_results.push((call_id, action, input_val, final_result));
+        let mut entry = ToolResultEntry::from((call_id, action, input_val, final_result));
+        if let Some(status) = typed_status {
+            entry.status = status;
+        }
+        step_tool_results.push(entry);
     }
 
     step_tool_results
@@ -3166,39 +3798,442 @@ async fn execute_tool(
     config: &MintConfig,
     decision: &AgentDecision,
     chat_id: &str,
-    approve_cb: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
+    approve: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
     progress: &mut (dyn FnMut(AgentProgress) + Send),
 ) -> Result<String, OrchestrationError> {
-    let input = &decision.input;
-    match decision.action.as_str() {
-        "list_files" | "read_file" | "note_write" | "apply_patch" | "write_file" => {
-            tools::files::execute(
-                decision.action.as_str(),
-                input,
-                root,
-                config,
-                chat_id,
-                approve_cb,
-            )
-            .await
-        }
-        "search_code" | "symbols" | "find_definition" | "find_references" | "repo_map"
-        | "semantic_index" | "semantic_search" => {
-            tools::code_search::execute(
-                decision.action.as_str(),
-                input,
-                root,
-                config,
-                chat_id,
-                approve_cb,
-            )
-            .await
-        }
-        "knowledge_search" | "web_search" | "image_search" => {
-            tools::web::execute(
-                decision.action.as_str(),
-                input,
-                root,
+    Ok(execute_tool_outcome(
+        root,
+        config,
+        decision,
+        chat_id,
+        approve,
+        progress,
+        &uuid::Uuid::new_v4().to_string(),
+    )
+    .await?
+    .text)
+}
+
+async fn execute_tool_outcome(
+    root: &Path,
+    config: &MintConfig,
+    decision: &AgentDecision,
+    chat_id: &str,
+    approve: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
+    progress: &mut (dyn FnMut(AgentProgress) + Send),
+    call_id: &str,
+) -> Result<crate::integrations::mcp_result::ToolOutcome, OrchestrationError> {
+    execute_tool_outcome_reviewed(
+        root, config, decision, chat_id, approve, progress, call_id, None,
+    )
+    .await
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn execute_tool_outcome_reviewed(
+    root: &Path,
+    config: &MintConfig,
+    decision: &AgentDecision,
+    chat_id: &str,
+    approve: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
+    progress: &mut (dyn FnMut(AgentProgress) + Send),
+    call_id: &str,
+    expected: Option<&mcp_review::McpReview>,
+) -> Result<crate::integrations::mcp_result::ToolOutcome, OrchestrationError> {
+    run_control::check()?;
+    let origin = MOD_ORIGIN.try_with(Clone::clone).ok().flatten();
+    let input = serde_json::to_value(&decision.input).unwrap_or(Value::Null);
+    crate::mods::event(
+        root,
+        chat_id,
+        "pre_tool_use",
+        serde_json::json!({"callId":call_id,"action":decision.action,"input":input}),
+        origin.as_deref(),
+    )
+    .map_err(OrchestrationError::Agent)?;
+    let execution = execute_tool_outcome_reviewed_inner(
+        root, config, decision, chat_id, approve, progress, call_id, expected,
+    );
+    let result = if matches!(
+        decision.action.as_str(),
+        "run_shell" | "verify" | "run_tests" | "run_typecheck" | "run_linter"
+    ) {
+        // Foreground shell cancellation joins process cleanup and imports any
+        // checkpointed screenshots before the turn is marked interrupted.
+        execution.await
+    } else {
+        run_control::run(Box::pin(execution)).await
+    };
+    let _ = crate::mods::event(
+        root,
+        chat_id,
+        "post_tool_use",
+        serde_json::json!({"callId":call_id,"action":decision.action,"input":input,"result":result.as_ref().map(|r|r.text.clone()).unwrap_or_else(|e|e.to_string()),"success":result.is_ok()}),
+        origin.as_deref(),
+    );
+    result
+}
+
+tokio::task_local! { static MOD_ORIGIN: Option<String>; }
+
+/// Run queued requests through the same policy and approval path as agent tools.
+pub async fn execute_mod_requests(
+    root: &Path,
+    chat: &str,
+    config: &MintConfig,
+    plan_mode: bool,
+    approve: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
+    progress: &mut (dyn FnMut(AgentProgress) + Send),
+    selected: Option<&[String]>,
+) -> Result<(), String> {
+    let requests = match selected {
+        Some(ids) => crate::mods::take_selected_requests(root, chat, ids)?,
+        None => crate::mods::take_requests(root, chat)?,
+    };
+    let (remembered_plan, pin) = crate::mods::turn_policy(root, chat);
+    let plan_mode = plan_mode || remembered_plan;
+    for request in requests {
+        let action = request["action"].as_str().unwrap_or("");
+        let id = request["modId"].as_str().unwrap_or("");
+        let input = match decode_agent_input(request["input"].clone()) {
+            Ok(input) => input,
+            Err(error) => {
+                crate::mods::complete_request(
+                    root,
+                    chat,
+                    id,
+                    request["hash"].as_str().unwrap_or(""),
+                    serde_json::json!({"requestId":request["id"],"action":action,"error":error}),
+                )?;
+                continue;
+            }
+        };
+        let allowed = crate::prompts::agent::base_allowed_actions().contains(&action)
+            && !action.starts_with("mod_")
+            && !config.disabled_tools.iter().any(|t| t == action)
+            && (!plan_mode || plan_mode_allows(action, &input))
+            && pin.as_deref().is_none_or(|p| {
+                !matches!(action, "mcp_tool" | "mcp_list_tools") || input.server == p
+            });
+        let result = if allowed {
+            let decision = AgentDecision {
+                thought: String::new(),
+                action: action.into(),
+                input,
+            };
+            MOD_ORIGIN
+                .scope(
+                    Some(id.into()),
+                    execute_tool_outcome_reviewed(
+                        root,
+                        config,
+                        &decision,
+                        chat,
+                        approve,
+                        progress,
+                        request["id"].as_str().unwrap_or(""),
+                        None,
+                    ),
+                )
+                .await
+                .map(|r| r.text)
+                .map_err(|e| e.to_string())
+        } else {
+            Err("This tool is unavailable to mods in the current mode".into())
+        };
+        crate::mods::complete_request(
+            root,
+            chat,
+            id,
+            request["hash"].as_str().unwrap_or(""),
+            serde_json::json!({"requestId":request["id"],"action":action,"result":result.as_ref().ok(),"error":result.as_ref().err()}),
+        )?;
+    }
+    Ok(())
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn execute_tool_outcome_reviewed_inner(
+    root: &Path,
+    config: &MintConfig,
+    decision: &AgentDecision,
+    chat_id: &str,
+    approve: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
+    progress: &mut (dyn FnMut(AgentProgress) + Send),
+    call_id: &str,
+    expected: Option<&mcp_review::McpReview>,
+) -> Result<crate::integrations::mcp_result::ToolOutcome, OrchestrationError> {
+    run_control::check()?;
+    if decision.action == "view_image" {
+        if decision.input.path.is_empty() == decision.input.artifact_id.is_empty() {
+            return Err(OrchestrationError::Agent(
+                "Provide exactly one of path or artifactId".into(),
+            ));
+        }
+        let root = root.to_path_buf();
+        let config = config.clone();
+        let chat = chat_id.to_owned();
+        let call = call_id.to_owned();
+        let path = decision.input.path.clone();
+        let artifact_id = decision.input.artifact_id.clone();
+        let out = tokio::task::spawn_blocking(
+            move || -> Result<crate::mcp_result::ToolOutcome, String> {
+                if !artifact_id.is_empty() {
+                    return crate::media::tool_images::view_artifact(&artifact_id, &chat);
+                }
+                let path = agent_read_path(&root, &path, &config).map_err(|e| e.to_string())?;
+                let path = assert_path_capability(&path, Capability::Read, &config)
+                    .map_err(|e| e.to_string())?;
+                if std::fs::metadata(&path).map_err(|e| e.to_string())?.len()
+                    > crate::media::tool_images::ORIGINAL_LIMIT as u64
+                {
+                    return Err("Image exceeds 20 MiB".into());
+                }
+                let mime = match path
+                    .extension()
+                    .and_then(|e| e.to_str())
+                    .unwrap_or("")
+                    .to_ascii_lowercase()
+                    .as_str()
+                {
+                    "png" => "image/png",
+                    "jpg" | "jpeg" => "image/jpeg",
+                    "gif" => "image/gif",
+                    "webp" => "image/webp",
+                    "svg" => "image/svg+xml",
+                    _ => return Err("Unsupported image type".into()),
+                };
+                let bytes = std::fs::read(&path).map_err(|e| e.to_string())?;
+                crate::media::tool_images::save(
+                    &bytes,
+                    mime,
+                    path.file_name().and_then(|n| n.to_str()).unwrap_or("Image"),
+                    &chat,
+                    &call,
+                    "view_image",
+                    None,
+                )
+            },
+        )
+        .await
+        .map_err(|e| OrchestrationError::Agent(e.to_string()))?
+        .map_err(OrchestrationError::Agent)?;
+        progress(AgentProgress::ToolArtifacts {
+            call_id: call_id.into(),
+            artifacts: out.artifacts.clone(),
+            warnings: out.warnings.clone(),
+        });
+        return Ok(out);
+    }
+    if matches!(decision.action.as_str(), "mcp_tool" | "mcp_list_tools") {
+        let mut out = tools::plugins_mcp::execute_reviewed(
+            &decision.action,
+            &decision.input,
+            config,
+            chat_id,
+            call_id,
+            expected,
+            approve,
+            progress,
+        )
+        .await?;
+        if !out.images.is_empty()
+            && config.extra.get("mcpImageInput").and_then(Value::as_bool) == Some(false)
+        {
+            out.images.clear();
+            let warning="Model image input is disabled for MCP. Use attachment metadata only; do not claim visual inspection.".to_string();
+            out.text.push_str(&format!("\nWarning: {warning}"));
+            out.warnings.push(warning);
+        }
+        if !out.artifacts.is_empty() || !out.warnings.is_empty() {
+            progress(AgentProgress::ToolArtifacts {
+                call_id: call_id.into(),
+                artifacts: out.artifacts.clone(),
+                warnings: out.warnings.clone(),
+            });
+        }
+        Ok(out)
+    } else {
+        let mut tool_config = config.clone();
+        let bridge = if decision.action == "run_shell" && !decision.input.background {
+            crate::browser::workflow::ShellBridge::prepare(
+                &decision.input.command,
+                root,
+                &mut tool_config,
+            )
+            .map_err(OrchestrationError::Agent)?
+        } else {
+            None
+        };
+        let checkpoint = reliability::checkpoint();
+        let text = match execute_tool_text(root, &tool_config, decision, chat_id, approve, progress)
+            .await
+        {
+            Ok(text) => text,
+            Err(error) => {
+                if decision.action.starts_with("browser_") {
+                    reliability::record_browser(&decision.action, None, false);
+                }
+                reliability::complete_tool(&decision.action, call_id, checkpoint, false);
+                return Err(error);
+            }
+        };
+        let mut out = if decision.action == "browser_screenshot"
+            && text.starts_with("data:image/png;base64,")
+        {
+            let bytes = BASE64_STANDARD
+                .decode(text.trim_start_matches("data:image/png;base64,"))
+                .map_err(|e| OrchestrationError::Agent(e.to_string()))?;
+            let metadata = crate::browser::capture_metadata().await;
+            let out = crate::media::tool_images::save(
+                &bytes,
+                "image/png",
+                &format!("screenshot-{call_id}.png"),
+                chat_id,
+                call_id,
+                "browser",
+                Some(metadata),
+            )
+            .map_err(OrchestrationError::Agent)?;
+            progress(AgentProgress::ToolArtifacts {
+                call_id: call_id.into(),
+                artifacts: out.artifacts.clone(),
+                warnings: out.warnings.clone(),
+            });
+            out
+        } else {
+            crate::mcp_result::ToolOutcome::from(text)
+        };
+        let mut workflow_verified = None;
+        if let Some(bridge) = bridge {
+            match bridge.images(chat_id, call_id) {
+                Ok((images, verified)) => {
+                    workflow_verified = Some(verified);
+                    out.text.push_str(&images.text);
+                    out.images.extend(images.images);
+                    out.artifacts.extend(images.artifacts);
+                    out.warnings.extend(images.warnings);
+                    progress(AgentProgress::ToolArtifacts {
+                        call_id: call_id.into(),
+                        artifacts: out.artifacts.clone(),
+                        warnings: out.warnings.clone(),
+                    });
+                }
+                Err(error) => {
+                    out.text.push_str(&format!("\nWarning: {error}"));
+                    out.warnings.push(error);
+                    workflow_verified = Some(false);
+                }
+            }
+        }
+        if decision.action.starts_with("browser_") {
+            let report = serde_json::from_str::<Value>(&out.text).ok();
+            if report
+                .as_ref()
+                .is_some_and(|r| r.get("error").is_some_and(|e| !e.is_null()))
+            {
+                out.status = crate::mcp_result::ToolStatus::Failed;
+            }
+            reliability::record_browser(
+                &decision.action,
+                report.as_ref(),
+                out.status == crate::mcp_result::ToolStatus::Success,
+            );
+        }
+        let mut entries = reliability::complete_tool(
+            &decision.action,
+            call_id,
+            checkpoint,
+            out.status == crate::mcp_result::ToolStatus::Success,
+        );
+        if let Some(verified) = workflow_verified {
+            entries = reliability::mark_workflow(call_id, verified);
+        }
+        if decision.action == "shell_output" {
+            entries = reliability::for_job(&decision.input.job_id);
+        }
+        if !entries.is_empty() {
+            out.status = if entries
+                .iter()
+                .any(|e| e.state == reliability::ExecutionState::Cancelled)
+            {
+                crate::mcp_result::ToolStatus::Cancelled
+            } else if entries
+                .iter()
+                .any(|e| e.state == reliability::ExecutionState::Failed)
+            {
+                crate::mcp_result::ToolStatus::Failed
+            } else if entries
+                .iter()
+                .any(|e| e.state == reliability::ExecutionState::Running)
+            {
+                crate::mcp_result::ToolStatus::Running
+            } else if entries
+                .iter()
+                .any(|e| e.state == reliability::ExecutionState::Unknown)
+            {
+                crate::mcp_result::ToolStatus::Unknown
+            } else {
+                crate::mcp_result::ToolStatus::Success
+            };
+            progress(AgentProgress::ExecutionUpdate {
+                call_id: call_id.into(),
+                executions: entries,
+            });
+        }
+        Ok(out)
+    }
+}
+
+async fn execute_tool_text(
+    root: &Path,
+    config: &MintConfig,
+    decision: &AgentDecision,
+    chat_id: &str,
+    approve_cb: &mut (dyn FnMut(&AgentApproval) -> Result<ApprovalOutcome, String> + Send),
+    progress: &mut (dyn FnMut(AgentProgress) + Send),
+) -> Result<String, OrchestrationError> {
+    if let Some(permissions) = crate::swarm::current_permissions() {
+        if !permissions.allows(&decision.action) {
+            return Err(OrchestrationError::Agent(format!(
+                "action '{}' is not permitted by this subagent's permissions",
+                decision.action
+            )));
+        }
+    }
+    let input = &decision.input;
+    match decision.action.as_str() {
+        "mod_help" | "mod_list" | "mod_validate" | "mod_publish" => {
+            tools::mods::execute(&decision.action, input, root, config, chat_id, approve_cb).await
+        }
+        "list_files" | "read_file" | "note_write" | "apply_patch" | "write_file" => {
+            tools::files::execute(
+                decision.action.as_str(),
+                input,
+                root,
+                config,
+                chat_id,
+                approve_cb,
+            )
+            .await
+        }
+        "search_code" | "symbols" | "find_definition" | "find_references" | "repo_map"
+        | "semantic_index" | "semantic_search" => {
+            tools::code_search::execute(
+                decision.action.as_str(),
+                input,
+                root,
+                config,
+                chat_id,
+                approve_cb,
+            )
+            .await
+        }
+        "knowledge_search" | "web_search" | "image_search" => {
+            tools::web::execute(
+                decision.action.as_str(),
+                input,
+                root,
                 config,
                 chat_id,
                 approve_cb,
@@ -3216,11 +4251,6 @@ async fn execute_tool(
             )
             .await
         }
-        "conversation_summary" => Ok(serde_json::json!({
-            "status": "acknowledged",
-            "message": "Previous steps summary is already recorded in context."
-        })
-        .to_string()),
         "browser_open"
         | "browser_click"
         | "browser_type"
@@ -3282,7 +4312,7 @@ async fn execute_tool(
             .await
         }
         "avatar_signal" => tools::avatar::execute(input).await,
-        "run_plugin" | "dispatch_subagent" | "mcp_tool" | "mcp_list_tools" => {
+        "run_plugin" | "dispatch_agents" | "dispatch_subagent" | "mcp_tool" | "mcp_list_tools" => {
             tools::plugins_mcp::execute(
                 decision.action.as_str(),
                 input,
@@ -3374,56 +4404,606 @@ where
     let decision = AgentDecision {
         thought: String::new(),
         action: action.to_string(),
-        input: serde_json::from_value(input).unwrap_or_default(),
+        input: parse_tool_input(action, input)?,
     };
     // No progress channel from the realtime voice session — tool-call
     // activity isn't surfaced there the way it is in the CLI/GUI.
     execute_tool(root, config, &decision, chat_id, approve_cb, &mut |_| {}).await
 }
 
+fn parse_tool_input(action: &str, input: Value) -> Result<AgentInput, OrchestrationError> {
+    let normalized = if action == "run_shell" {
+        match &input {
+            Value::String(cmd) if !cmd.trim().is_empty() => {
+                if let Ok(val) = serde_json::from_str::<Value>(cmd)
+                    && val.is_object()
+                {
+                    val
+                } else {
+                    serde_json::json!({ "command": cmd.trim() })
+                }
+            }
+            _ => input,
+        }
+    } else {
+        input
+    };
+    decode_agent_input(normalized).map_err(|error| {
+        OrchestrationError::Agent(format!("invalid arguments for tool '{action}': {error}"))
+    })
+}
+
+fn append_native_tool_results(
+    messages: &mut Vec<ChatMessage>,
+    response_text: &str,
+    results: &[ToolResultEntry],
+    signatures: &std::collections::HashMap<String, String>,
+    images: &std::collections::HashMap<String, Vec<String>>,
+) {
+    let mut assistant_content: Vec<ContentBlock> = Vec::new();
+    if !response_text.is_empty() {
+        assistant_content.push(ContentBlock::Text {
+            text: response_text.to_string(),
+        });
+    }
+    let mut tool_result_content: Vec<ContentBlock> = Vec::new();
+    for ToolResultEntry {
+        call_id,
+        action,
+        input: input_value,
+        text: final_result,
+        status,
+    } in results
+    {
+        // Activity annotations are for the UI, not parameters of the provider tool schema.
+        let mut tool_input = input_value.clone();
+        if let Some(object) = tool_input.as_object_mut() {
+            object.remove("skill_name");
+        }
+        assistant_content.push(ContentBlock::ToolUse {
+            id: call_id.clone(),
+            name: action.clone(),
+            input: tool_input,
+            thought_signature: signatures.get(call_id).cloned(),
+        });
+        tool_result_content.push(ContentBlock::ToolResult {
+            tool_use_id: call_id.clone(),
+            content: final_result.clone(),
+            is_error: matches!(
+                *status,
+                crate::mcp_result::ToolStatus::Failed
+                    | crate::mcp_result::ToolStatus::TimedOut
+                    | crate::mcp_result::ToolStatus::Cancelled
+            ),
+        });
+        if let Some(data_uris) = images.get(call_id) {
+            for data_uri in data_uris {
+                tool_result_content.push(ContentBlock::Image {
+                    data_uri: data_uri.clone(),
+                });
+            }
+        }
+    }
+    if !assistant_content.is_empty() {
+        messages.push(ChatMessage {
+            role: ChatRole::Assistant,
+            content: assistant_content,
+        });
+    }
+    if !tool_result_content.is_empty() {
+        messages.push(ChatMessage {
+            role: ChatRole::Tool,
+            content: tool_result_content,
+        });
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(super) struct ToolResultEntry {
+    pub(super) call_id: String,
+    pub(super) action: String,
+    pub(super) input: Value,
+    pub(super) text: String,
+    pub(super) status: crate::mcp_result::ToolStatus,
+}
+
+// Legacy tools determine their outcome once at this adapter; MCP supplies its
+// explicit status directly, regardless of the wording of server text.
+impl From<(String, String, Value, String)> for ToolResultEntry {
+    fn from((call_id, action, input, text): (String, String, Value, String)) -> Self {
+        let mut status = crate::mcp_result::ToolOutcome::from(text.clone()).status;
+        if text.starts_with("Skipped") {
+            status = crate::mcp_result::ToolStatus::Skipped;
+        } else if matches!(
+            action.as_str(),
+            "run_shell" | "verify" | "run_tests" | "run_typecheck" | "run_linter"
+        ) && shell_result_failed(&text)
+        {
+            status = crate::mcp_result::ToolStatus::Failed;
+        }
+        Self {
+            call_id,
+            action,
+            input,
+            text,
+            status,
+        }
+    }
+}
+type PreparedToolCalls = (Vec<(String, AgentDecision)>, Vec<ToolResultEntry>);
+
+#[derive(Debug, Default)]
+struct ToolArgumentRetries {
+    failures: BTreeMap<String, usize>,
+}
+
+impl ToolArgumentRetries {
+    fn succeeded(&mut self, tool: &str) {
+        self.failures.remove(tool);
+    }
+
+    fn observe_completed(&mut self, results: &[ToolResultEntry]) {
+        for ToolResultEntry {
+            action: tool,
+            status,
+            ..
+        } in results
+        {
+            // Parallel batches encode execution errors and hook blocks in
+            // their results. Neither is a successful execution.
+            if *status == crate::mcp_result::ToolStatus::Success {
+                self.succeeded(tool);
+            }
+        }
+    }
+}
+
+/// Invalid calls never become executable decisions. Return their original
+/// arguments and call IDs so the next model turn can repair them.
+fn prepare_native_tool_calls(
+    calls: Vec<crate::chat::ToolCall>,
+    thought: &str,
+    retries: &mut ToolArgumentRetries,
+) -> Result<PreparedToolCalls, OrchestrationError> {
+    let mut decisions = Vec::new();
+    let mut errors = Vec::new();
+    for (index, call) in calls.into_iter().enumerate() {
+        match parse_tool_input(&call.name, call.input.clone()) {
+            Ok(input) => decisions.push((
+                call.id,
+                AgentDecision {
+                    thought: if index == 0 {
+                        thought.to_owned()
+                    } else {
+                        String::new()
+                    },
+                    action: call.name,
+                    input,
+                },
+            )),
+            Err(error) => {
+                let invalid_count = retries.failures.entry(call.name.clone()).or_default();
+                if *invalid_count >= MAX_TOOL_ARGUMENT_RETRIES {
+                    return Err(OrchestrationError::Agent(format!(
+                        "Tool '{}' exhausted its {MAX_TOOL_ARGUMENT_RETRIES} argument-correction retries without a successful execution. Other tools have independent budgets. {error}",
+                        call.name
+                    )));
+                }
+                *invalid_count += 1;
+                errors.push((call.id, call.name, call.input, format!(
+                    "Error: {error}. No tool was executed for this call. Correct the arguments to match the tool schema, or choose another suitable tool. Correction retries for this tool: {}/{MAX_TOOL_ARGUMENT_RETRIES}. This counter resets only after this tool executes successfully; changing arguments alone does not reset it. Other tools have independent counters. Continued failures for this tool will stop the run.",
+                    *invalid_count,
+                )).into());
+            }
+        }
+    }
+    Ok((decisions, errors))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::config::AgentConfig;
 
-    #[tokio::test]
-    async fn turn_start_listener_reports_only_the_matching_chat() {
-        let memory = MemoryStore::open(std::env::temp_dir().join(format!(
-            "mint-turn-start-listener-{}.sqlite",
-            uuid::Uuid::new_v4()
-        )));
-        let reported = Arc::new(std::sync::Mutex::new(Vec::new()));
-        let callback_reported = reported.clone();
-        with_turn_start_listener(
-            "cli::one".to_string(),
-            move |id| callback_reported.lock().unwrap().push(id),
-            async {
-                let first = TurnLease::start(&memory, "cli::one", "hello")
-                    .await
-                    .unwrap();
-                let other = TurnLease::start(&memory, "cli::two", "other")
-                    .await
-                    .unwrap();
-                assert_eq!(*reported.lock().unwrap(), vec![first.id]);
-                drop(first);
-                drop(other);
-            },
+    #[test]
+    fn stringified_patch_uses_explicit_outer_target() {
+        let patch =
+            serde_json::json!({"hunks": [{"oldText": "old", "newText": "new"}]}).to_string();
+        let input = parse_tool_input(
+            "apply_patch",
+            serde_json::json!({"path": "style.css", "patch": patch}),
         )
-        .await;
+        .unwrap();
+        let patch = input.patch.unwrap();
+        assert_eq!(patch.path, PathBuf::from("style.css"));
+        assert_eq!(patch.hunks.len(), 1);
     }
 
-    #[test]
-    fn test_compact_agent_progress_cleans_deltas_and_preserves_tools() {
-        let events = vec![
-            AgentProgress::ToolStart {
-                action: "read_file".into(),
-                input: serde_json::json!({ "path": "src/main.rs" }),
-                subagent: None,
-            },
-            AgentProgress::ThinkingDelta {
-                id: "cot-1".into(),
-                delta: "Reading ".into(),
-                elapsed_ms: 100,
+    #[tokio::test]
+    async fn stringified_patch_executes_only_after_approval_and_can_be_undone() {
+        let root = std::env::temp_dir().join(format!("mint-patch-repro-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::write(root.join("style.css"), "body { color: black; }").unwrap();
+        let config = MintConfig {
+            allowed_read_paths: vec![root.clone()],
+            allowed_write_paths: vec![root.clone()],
+            blocked_paths: vec![],
+            blocked_file_names: vec![],
+            ..MintConfig::default()
+        };
+        let input = serde_json::json!({"path": "style.css", "patch": serde_json::json!({"hunks": [{"oldText": "black", "newText": "orange"}]}).to_string()});
+        execute_tool_from_json(
+            &root,
+            &config,
+            "apply_patch",
+            input.clone(),
+            "patch-repro",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            std::fs::read_to_string(root.join("style.css")).unwrap(),
+            "body { color: black; }"
+        );
+        execute_tool_from_json(
+            &root,
+            &config,
+            "apply_patch",
+            input,
+            "patch-repro",
+            &mut |_| Ok(ApprovalOutcome::Approved),
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            std::fs::read_to_string(root.join("style.css")).unwrap(),
+            "body { color: orange; }"
+        );
+        crate::system::workspace_history::undo(&root, None).unwrap();
+        assert_eq!(
+            std::fs::read_to_string(root.join("style.css")).unwrap(),
+            "body { color: black; }"
+        );
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn patch_decoding_preserves_strict_types_and_rejects_ambiguous_targets() {
+        let patch = serde_json::json!({"path": "style.css", "hunks": [{"oldText": "old", "newText": "new"}]});
+        assert!(parse_tool_input("apply_patch", serde_json::json!({"patch": patch})).is_ok());
+        assert!(
+            parse_tool_input(
+                "apply_patch",
+                serde_json::json!({"path": "other.css", "patch": patch.to_string()})
+            )
+            .is_err()
+        );
+        assert!(
+            parse_tool_input(
+                "apply_patch",
+                serde_json::json!({"patch": "{\"hunks\": []}"})
+            )
+            .is_err()
+        );
+        assert!(parse_tool_input("apply_patch", serde_json::json!({"patch": "not JSON"})).is_err());
+        assert!(parse_tool_input("list_files", serde_json::json!({"limit": "100"})).is_err());
+        let huge = "private-code-marker".repeat(1000);
+        let error = parse_tool_input(
+            "apply_patch",
+            serde_json::json!({"patch": {"path": "style.css", "hunks": huge}}),
+        )
+        .unwrap_err()
+        .to_string();
+        assert!(error.len() < 600);
+        assert!(!error.contains("private-code-marker"));
+        let decision: AgentDecision = serde_json::from_value(serde_json::json!({"action": "apply_patch", "input": {"path": "style.css", "patch": serde_json::json!({"hunks": [{"oldText": "old", "newText": "new"}]}).to_string()}})).unwrap();
+        assert_eq!(
+            decision.input.patch.unwrap().path,
+            PathBuf::from("style.css")
+        );
+    }
+
+    fn test_list_call(id: &str, input: Value) -> crate::chat::ToolCall {
+        crate::chat::ToolCall {
+            id: id.into(),
+            name: "list_files".into(),
+            input,
+            thought_signature: Some("signature".into()),
+        }
+    }
+
+    #[tokio::test]
+    async fn native_argument_error_is_returned_and_corrected_call_can_execute() {
+        let raw = serde_json::json!({"path": "Downloads/YOUTUBE_DL/playlist", "limit": "100"});
+        let mut count = ToolArgumentRetries::default();
+        let (decisions, errors) =
+            prepare_native_tool_calls(vec![test_list_call("bad", raw.clone())], "", &mut count)
+                .unwrap();
+        assert!(decisions.is_empty());
+        assert_eq!(errors.len(), 1);
+        let mut messages = Vec::new();
+        let signatures = std::collections::HashMap::from([("bad".into(), "signature".into())]);
+        append_native_tool_results(&mut messages, "", &errors, &signatures, &Default::default());
+        assert!(
+            matches!(&messages[0].content[0], ContentBlock::ToolUse { id, input, thought_signature, .. }
+            if id == "bad" && input == &raw && thought_signature.as_deref() == Some("signature"))
+        );
+        assert!(
+            matches!(&messages[1].content[0], ContentBlock::ToolResult { tool_use_id, content, is_error }
+            if tool_use_id == "bad" && *is_error && content.contains("Correct the arguments"))
+        );
+
+        let root =
+            std::env::temp_dir().join(format!("mint-tool-recovery-{}", uuid::Uuid::new_v4()));
+        let nested = root.join("Downloads/YOUTUBE_DL/playlist");
+        std::fs::create_dir_all(&nested).unwrap();
+        std::fs::write(nested.join("song.txt"), "song").unwrap();
+        let config = MintConfig {
+            allowed_read_paths: vec![root.clone()],
+            blocked_paths: vec![],
+            blocked_file_names: vec![],
+            ..MintConfig::default()
+        };
+        let (decisions, errors) = prepare_native_tool_calls(
+            vec![test_list_call(
+                "fixed",
+                serde_json::json!({"path": "Downloads/YOUTUBE_DL/playlist", "limit": 100}),
+            )],
+            "",
+            &mut count,
+        )
+        .unwrap();
+        assert!(errors.is_empty());
+        let output = execute_tool(
+            &root,
+            &config,
+            &decisions[0].1,
+            "regression",
+            &mut |_| panic!("listing must not request approval"),
+            &mut |_| {},
+        )
+        .await
+        .unwrap();
+        let entries: Vec<Value> = serde_json::from_str(&output).unwrap();
+        assert_eq!(entries.len(), 1);
+        assert_eq!(
+            entries[0]["path"],
+            serde_json::json!(nested.join("song.txt"))
+        );
+        // Parsing the repaired call alone must not renew its budget.
+        assert_eq!(count.failures["list_files"], 1);
+        count.observe_completed(&[
+            ("fixed".into(), "list_files".into(), Value::Null, output).into()
+        ]);
+        assert!(!count.failures.contains_key("list_files"));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn native_invalid_calls_are_bounded_without_blocking_valid_alternatives() {
+        let mut count = ToolArgumentRetries::default();
+        for _ in 0..MAX_TOOL_ARGUMENT_RETRIES {
+            let (decisions, errors) = prepare_native_tool_calls(
+                vec![test_list_call(
+                    "bad",
+                    serde_json::json!({"path": "~/Downloads/YOUTUBE_DL", "limit": "100"}),
+                )],
+                "",
+                &mut count,
+            )
+            .unwrap();
+            assert!(decisions.is_empty());
+            assert_eq!(errors.len(), 1);
+        }
+        let alternative = crate::chat::ToolCall {
+            id: "alternative".into(),
+            name: "run_shell".into(),
+            input: serde_json::json!({"command": "ls ~/Downloads/YOUTUBE_DL"}),
+            thought_signature: None,
+        };
+        let (decisions, errors) =
+            prepare_native_tool_calls(vec![alternative], "", &mut count).unwrap();
+        assert_eq!(decisions[0].1.action, "run_shell");
+        assert!(errors.is_empty());
+        assert_eq!(count.failures["list_files"], MAX_TOOL_ARGUMENT_RETRIES);
+        let error =
+            prepare_native_tool_calls(vec![test_list_call("bad", Value::Null)], "", &mut count)
+                .unwrap_err();
+        assert!(
+            error
+                .to_string()
+                .contains("exhausted its 5 argument-correction retries")
+        );
+        // One exhausted tool must not consume another tool's corrections.
+        let other = crate::chat::ToolCall {
+            id: "other-bad".into(),
+            name: "read_file".into(),
+            input: serde_json::json!({"path": 123}),
+            thought_signature: None,
+        };
+        let (_, errors) = prepare_native_tool_calls(vec![other], "", &mut count).unwrap();
+        assert_eq!(errors.len(), 1);
+        assert_eq!(count.failures["read_file"], 1);
+        for result in [
+            "Error: execution failed",
+            "Blocked by hook",
+            "Skipped duplicate",
+        ] {
+            count.observe_completed(&[(
+                "x".into(),
+                "list_files".into(),
+                Value::Null,
+                result.into(),
+            )
+                .into()]);
+            assert_eq!(count.failures["list_files"], MAX_TOOL_ARGUMENT_RETRIES);
+        }
+        count.succeeded("list_files");
+        assert_eq!(count.failures["read_file"], 1);
+        assert!(!count.failures.contains_key("list_files"));
+        assert!(
+            prepare_native_tool_calls(vec![test_list_call("fresh", Value::Null)], "", &mut count)
+                .is_ok()
+        );
+    }
+
+    #[test]
+    fn native_mixed_batch_keeps_valid_calls_and_matches_each_error_to_its_id() {
+        let mut count = ToolArgumentRetries::default();
+        let (decisions, errors) = prepare_native_tool_calls(
+            vec![
+                test_list_call("bad", Value::Null),
+                test_list_call("valid-1", serde_json::json!({"path": "."})),
+                test_list_call("valid-2", serde_json::json!({"path": "src"})),
+            ],
+            "",
+            &mut count,
+        )
+        .unwrap();
+        assert_eq!(decisions.len(), 2);
+        assert!(decisions_are_parallel_read_only_batch(&decisions));
+        assert_eq!(errors[0].call_id, "bad");
+        let mut results = errors;
+        results.extend(decisions.iter().map(|(id, d)| {
+            (
+                id.clone(),
+                d.action.clone(),
+                serde_json::to_value(&d.input).unwrap(),
+                "[]".into(),
+            )
+                .into()
+        }));
+        let mut messages = Vec::new();
+        append_native_tool_results(
+            &mut messages,
+            "",
+            &results,
+            &Default::default(),
+            &Default::default(),
+        );
+        assert_eq!(messages[0].content.len(), 3);
+        assert_eq!(messages[1].content.len(), 3);
+        assert!(
+            matches!(&messages[1].content[0], ContentBlock::ToolResult { tool_use_id, is_error: true, .. } if tool_use_id == "bad")
+        );
+        assert!(
+            matches!(&messages[1].content[1], ContentBlock::ToolResult { tool_use_id, is_error: false, .. } if tool_use_id == "valid-1")
+        );
+    }
+
+    #[tokio::test]
+    async fn list_files_rejects_invalid_arguments_instead_of_listing_workspace() {
+        let config = MintConfig::default();
+        // A nonexistent root ensures no filesystem lookup occurs for bad input.
+        let root = Path::new("/nonexistent-mint-list-files-regression");
+        for input in [
+            serde_json::json!({"path": "~/Downloads/YOUTUBE_DL", "limit": "100"}),
+            serde_json::json!({"path": "~/Downloads/YOUTUBE_DL", "limit": -1}),
+            serde_json::json!({"path": null}),
+            Value::String(r#"{"path":"~/Downloads/YOUTUBE_DL""#.into()),
+            Value::Null,
+        ] {
+            let error = execute_tool_from_json(
+                root,
+                &config,
+                "list_files",
+                input,
+                "regression",
+                &mut |_| panic!("invalid arguments must not request approval"),
+            )
+            .await
+            .unwrap_err();
+            assert!(
+                error
+                    .to_string()
+                    .contains("invalid arguments for tool 'list_files'")
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn list_files_preserves_nested_paths_and_default_directory() {
+        let root =
+            std::env::temp_dir().join(format!("mint-list-files-paths-{}", std::process::id()));
+        let nested = root.join("Downloads/YOUTUBE_DL/playlist");
+        std::fs::create_dir_all(&nested).unwrap();
+        std::fs::write(nested.join("song.txt"), "song").unwrap();
+        let config = MintConfig {
+            allowed_read_paths: vec![root.clone()],
+            blocked_paths: vec![],
+            blocked_file_names: vec![],
+            ..MintConfig::default()
+        };
+        for input in [
+            serde_json::json!({"path": "Downloads/YOUTUBE_DL/playlist", "limit": 100}),
+            serde_json::json!({"path": nested}),
+            serde_json::json!({}),
+        ] {
+            let expected = if input.get("path").is_some() {
+                &nested
+            } else {
+                &root
+            };
+            let output = execute_tool_from_json(
+                &root,
+                &config,
+                "list_files",
+                input,
+                "regression",
+                &mut |_| panic!("listing must not request approval"),
+            )
+            .await
+            .unwrap();
+            let entries: Vec<Value> = serde_json::from_str(&output).unwrap();
+            assert_eq!(entries.len(), 1);
+            assert_eq!(
+                Path::new(entries[0]["path"].as_str().unwrap()).parent(),
+                Some(expected.as_path())
+            );
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[tokio::test]
+    async fn turn_start_listener_reports_only_the_matching_chat() {
+        let memory = MemoryStore::open(std::env::temp_dir().join(format!(
+            "mint-turn-start-listener-{}.sqlite",
+            uuid::Uuid::new_v4()
+        )));
+        let reported = Arc::new(std::sync::Mutex::new(Vec::new()));
+        let callback_reported = reported.clone();
+        with_turn_start_listener(
+            "cli::one".to_string(),
+            move |id| callback_reported.lock().unwrap().push(id),
+            async {
+                let first = TurnLease::start(&memory, "cli::one", "hello")
+                    .await
+                    .unwrap();
+                let other = TurnLease::start(&memory, "cli::two", "other")
+                    .await
+                    .unwrap();
+                assert_eq!(*reported.lock().unwrap(), vec![first.id]);
+                drop(first);
+                drop(other);
+            },
+        )
+        .await;
+    }
+
+    #[test]
+    fn test_compact_agent_progress_cleans_deltas_and_preserves_tools() {
+        let events = vec![
+            AgentProgress::ToolStart {
+                call_id: None,
+                action: "read_file".into(),
+                input: serde_json::json!({ "path": "src/main.rs" }),
+                subagent: None,
+            },
+            AgentProgress::ThinkingDelta {
+                id: "cot-1".into(),
+                delta: "Reading ".into(),
+                elapsed_ms: 100,
             },
             AgentProgress::ThinkingDelta {
                 id: "cot-1".into(),
@@ -3436,6 +5016,9 @@ mod tests {
                 elapsed_ms: Some(200),
             },
             AgentProgress::ToolEnd {
+                elapsed_ms: None,
+                call_id: None,
+                status: None,
                 action: "read_file".into(),
                 input: serde_json::json!({ "path": "src/main.rs" }),
                 result: "fn main() {}".into(),
@@ -3485,11 +5068,15 @@ mod tests {
             .lock()
             .unwrap()
             .push(AgentProgress::ToolStart {
+                call_id: None,
                 action: "run_shell".into(),
                 input: serde_json::json!({ "command": "ls -la" }),
                 subagent: None,
             });
         turn.activity.lock().unwrap().push(AgentProgress::ToolEnd {
+            elapsed_ms: None,
+            call_id: None,
+            status: None,
             action: "run_shell".into(),
             input: serde_json::json!({ "command": "ls -la" }),
             result: "file.txt".into(),
@@ -3527,6 +5114,7 @@ mod tests {
             .lock()
             .unwrap()
             .push(AgentProgress::ToolStart {
+                call_id: None,
                 action: "read_file".into(),
                 input: serde_json::json!({ "path": "test.txt" }),
                 subagent: None,
@@ -3750,7 +5338,7 @@ mod tests {
             "exit: 1\nmode: normal\nsandboxed: true\nstdout:\nfail\nstderr:\n"
         ));
         // A killed/unknown-status process isn't treated as a confirmed failure.
-        assert!(!shell_result_failed(
+        assert!(shell_result_failed(
             "exit: unknown\nmode: normal\nsandboxed: true\nstdout:\nstderr:\n"
         ));
     }
@@ -3775,8 +5363,8 @@ mod tests {
         assert!(unverified_modification(Some(2), Some(1), ""));
         // Edited, verified after — satisfied regardless of what verify found.
         assert!(!unverified_modification(Some(2), Some(3), ""));
-        // Edited, never verified, but explicitly explained why no check applies.
-        assert!(!unverified_modification(
+        // An explanation cannot promote an unchecked edit to verified.
+        assert!(unverified_modification(
             Some(2),
             None,
             "Docs-only change, no test suite."
@@ -3792,9 +5380,8 @@ mod tests {
         // "claims success while a check is actually failing" case.
         assert!(unacknowledged_verify_failure(Some(true), ""));
         assert!(unacknowledged_verify_failure(Some(true), "n/a"));
-        // Verify failed, but the agent explicitly addressed it in the finish
-        // action's verification field (e.g. explaining it's pre-existing).
-        assert!(!unacknowledged_verify_failure(
+        // Even an explanation of pre-existing failures does not make them pass.
+        assert!(unacknowledged_verify_failure(
             Some(true),
             "2 pre-existing test failures unrelated to this change; see notes."
         ));
@@ -4064,8 +5651,8 @@ mod tests {
     }
 
     #[test]
-    fn explicit_written_justification_satisfies_the_gate_without_a_verify_call() {
-        assert!(!unverified_modification(
+    fn explicit_written_justification_does_not_verify_an_unchecked_edit() {
+        assert!(unverified_modification(
             Some(2),
             None,
             "Documentation-only change; no test suite in this repo."
@@ -4091,41 +5678,8 @@ mod tests {
         )
     }
 
-    #[test]
-    fn two_or_more_subagent_only_decisions_qualify_for_the_parallel_batch() {
-        let decisions = vec![
-            decision_with_action("dispatch_subagent"),
-            decision_with_action("dispatch_subagent"),
-        ];
-        assert!(decisions_are_parallel_subagent_batch(&decisions));
-
-        let decisions = vec![
-            decision_with_action("dispatch_subagent"),
-            decision_with_action("dispatch_subagent"),
-            decision_with_action("dispatch_subagent"),
-        ];
-        assert!(decisions_are_parallel_subagent_batch(&decisions));
-    }
-
-    #[test]
-    fn a_lone_subagent_dispatch_stays_sequential() {
-        let decisions = vec![decision_with_action("dispatch_subagent")];
-        assert!(!decisions_are_parallel_subagent_batch(&decisions));
-    }
-
-    #[test]
-    fn subagent_dispatch_mixed_with_another_action_stays_sequential() {
-        let decisions = vec![
-            decision_with_action("dispatch_subagent"),
-            decision_with_action("dispatch_subagent"),
-            decision_with_action("read_file"),
-        ];
-        assert!(!decisions_are_parallel_subagent_batch(&decisions));
-    }
-
     #[test]
     fn empty_decisions_never_qualify_for_the_parallel_batch() {
-        assert!(!decisions_are_parallel_subagent_batch(&[]));
         assert!(!decisions_are_parallel_read_only_batch(&[]));
     }
 
@@ -4194,3 +5748,888 @@ mod tests {
         assert!(buffer.contains("Step 3:\n- Thought: All done"));
     }
 }
+
+#[cfg(test)]
+mod full_skill_result_tests {
+    use super::*;
+    #[test]
+    fn large_loaded_skill_results_reach_the_model_without_losing_middle_instructions() {
+        let content = format!(
+            "[Loaded skill: review]\n{}\nREQUIRED-MIDDLE-INSTRUCTION\n{}",
+            "a".repeat(40_000),
+            "z".repeat(40_000)
+        );
+        assert_eq!(model_tool_result("read_file", &content), content);
+        assert!(model_tool_result("run_shell", &"x".repeat(80_000)).len() < 20_000);
+    }
+}
+
+#[cfg(all(test, unix))]
+mod mcp_outcome_tests {
+    use super::*;
+    use std::time::Duration;
+    fn generic_server(tool: &str, response: Value) -> String {
+        format!(
+            r#"
+import sys,json
+response=json.loads({:?})
+for line in sys.stdin:
+ r=json.loads(line);m=r.get('method')
+ if m=='initialize': result={{}}
+ elif m=='tools/list': result={{'tools':[{{'name':{:?},'inputSchema':{{'type':'object'}}}}]}}
+ elif m=='tools/call': result=response
+ else: continue
+ print(json.dumps({{'jsonrpc':'2.0','id':r['id'],'result':result}}),flush=True)
+"#,
+            response.to_string(),
+            tool
+        )
+    }
+
+    #[test]
+    fn compact_device_progress_keeps_acceptance_and_latest_observation() {
+        let events=["accepted","running","running","verified"].into_iter().enumerate().map(|(seq,state)|serde_json::from_value(serde_json::json!({"type":"DeviceState","data":{"callId":"one","server":"motor","tool":"move","update":{"state":state,"target":{"rpm":100},"actual":{"rpm":seq},"observationSeq":seq,"elapsedSecs":seq,"message":"observed"}}})).unwrap()).collect::<Vec<AgentProgress>>();
+        let compacted = compact_agent_progress(&events);
+        assert_eq!(
+            compacted.len(),
+            2,
+            "saved history should retain acceptance and the final fresh observation"
+        );
+        assert!(matches!(
+            &compacted[1],
+            AgentProgress::DeviceState {
+                update: crate::mcp::device::DeviceUpdate {
+                    state: crate::mcp::device::DevicePhase::Verified,
+                    ..
+                },
+                ..
+            }
+        ));
+    }
+
+    #[tokio::test]
+    async fn mcp_definitions_reach_native_and_json_models_before_any_command() {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+        for native in [true, false] {
+            let marker =
+                std::env::temp_dir().join(format!("mint-model-command-{}", uuid::Uuid::new_v4()));
+            let server = format!("model-mcp-{}", uuid::Uuid::new_v4());
+            let mut cfg = MintConfig::default();
+            let script=generic_server("move",serde_json::json!({"content":[{"type":"text","text":"moved"}]})).replace("elif m=='tools/call': result=response",&format!("elif m=='tools/call':\n  open({:?},'a').write('called\\n')\n  result=response",marker.to_string_lossy())).replace("'name':\"move\",'inputSchema'","'name':\"move\",'description':'Move the mock axis. RPM are integer units.', 'inputSchema'");
+            cfg.extra.insert("mcpServers".into(),serde_json::json!({server.clone():{"command":"python3","args":["-u","-c",script],"timeoutSecs":5}}));
+            cfg.extra.insert(
+                "allowedMcpTools".into(),
+                serde_json::json!({server.clone():["*"]}),
+            );
+            cfg.ai_provider = "ollama".into();
+            cfg.ollama_model = "qwen2.5".into();
+            cfg.extra
+                .insert("forceJsonPromptMode".into(), serde_json::json!(!native));
+            let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+            cfg.ollama_host = format!("http://{}", listener.local_addr().unwrap());
+            let recorded = Arc::new(std::sync::Mutex::new(Vec::<Value>::new()));
+            let requests = Arc::clone(&recorded);
+            let observed_marker = marker.clone();
+            let name = server.clone();
+            let provider = tokio::spawn(async move {
+                for step in 0..3 {
+                    let (mut socket, _) = listener.accept().await.unwrap();
+                    let mut bytes = Vec::new();
+                    let mut chunk = [0u8; 4096];
+                    let (end, len) = loop {
+                        let n = socket.read(&mut chunk).await.unwrap();
+                        assert!(n > 0);
+                        bytes.extend_from_slice(&chunk[..n]);
+                        if let Some(end) = bytes.windows(4).position(|w| w == b"\r\n\r\n") {
+                            let header = String::from_utf8_lossy(&bytes[..end]);
+                            let len = header
+                                .lines()
+                                .find_map(|l| {
+                                    l.to_ascii_lowercase()
+                                        .strip_prefix("content-length:")
+                                        .and_then(|v| v.trim().parse::<usize>().ok())
+                                })
+                                .unwrap();
+                            break (end + 4, len);
+                        }
+                    };
+                    while bytes.len() < end + len {
+                        let n = socket.read(&mut chunk).await.unwrap();
+                        assert!(n > 0);
+                        bytes.extend_from_slice(&chunk[..n]);
+                    }
+                    requests
+                        .lock()
+                        .unwrap()
+                        .push(serde_json::from_slice(&bytes[end..end + len]).unwrap());
+                    if step == 1 {
+                        assert!(
+                            !observed_marker.exists(),
+                            "initial preparation sent a tools/call"
+                        );
+                    }
+                    let (action, input) = if step < 2 {
+                        (
+                            "mcp_tool",
+                            serde_json::json!({"server":name,"tool":"move","arguments":{}}),
+                        )
+                    } else {
+                        (
+                            "finish",
+                            serde_json::json!({"summary":"done","verification":"Mock command verified"}),
+                        )
+                    };
+                    let message = if native {
+                        serde_json::json!({"role":"assistant","content":"","tool_calls":[{"function":{"name":action,"arguments":input}}]})
+                    } else {
+                        serde_json::json!({"role":"assistant","content":serde_json::json!({"thought":"test","action":action,"input":input}).to_string()})
+                    };
+                    let body = format!(
+                        "{}\n",
+                        serde_json::json!({"model":"qwen2.5","message":message,"done":true,"prompt_eval_count":100,"eval_count":10})
+                    );
+                    socket.write_all(format!("HTTP/1.1 200 OK\r\nContent-Type: application/x-ndjson\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",body.len()).as_bytes()).await.unwrap();
+                }
+            });
+            let chat = format!("model-review-{}", uuid::Uuid::new_v4());
+            let mut events = Vec::new();
+            let outcome = tokio::time::timeout(
+                Duration::from_secs(15),
+                orchestrate_agent_loop(
+                    &cfg,
+                    "Use the mock MCP move tool",
+                    Path::new("."),
+                    None,
+                    None,
+                    None,
+                    Some(&chat),
+                    None,
+                    None,
+                    None,
+                    true,
+                    false,
+                    |_| Ok(ApprovalOutcome::Denied),
+                    |e| events.push(e),
+                    |_| {},
+                ),
+            )
+            .await;
+            provider.abort();
+            crate::mcp::close_mcp_session(&server);
+            assert!(
+                matches!(outcome, Ok(Ok(_))),
+                "native={native}, {outcome:?}; requests={}, events={:?}",
+                recorded.lock().unwrap().len(),
+                events.iter().rev().take(5).collect::<Vec<_>>()
+            );
+            let requests = recorded.lock().unwrap();
+            assert_eq!(requests.len(), 3);
+            assert!(
+                requests[1].to_string().contains("Move the mock axis"),
+                "full tool definition missing from model request: {}",
+                requests[1]
+            );
+            assert!(
+                requests[2].to_string().contains("Move the mock axis"),
+                "definition must remain in later requests"
+            );
+            assert_eq!(std::fs::read_to_string(&marker).unwrap().lines().count(), 1);
+            std::fs::remove_file(marker).unwrap();
+            assert_eq!(
+                events
+                    .iter()
+                    .filter(
+                        |e| matches!(e,AgentProgress::ToolStart {action,..} if action=="mcp_tool")
+                    )
+                    .count(),
+                1
+            );
+            let memory = MemoryStore::open_default().unwrap();
+            let _ = memory.delete_chat_session(&chat);
+        }
+    }
+
+    #[tokio::test]
+    async fn device_command_waits_for_a_fresh_verified_observation() {
+        let server = format!("device-{}", uuid::Uuid::new_v4());
+        let mut cfg = MintConfig::default();
+        cfg.extra.insert("mcpServers".into(),serde_json::json!({server.clone():{"command":"node","args":[Path::new(env!("CARGO_MANIFEST_DIR")).join("../../examples/device-mcp/server.mjs")],"timeoutSecs":5}}));
+        cfg.extra.insert(
+            "allowedMcpTools".into(),
+            serde_json::json!({server.clone():["*"]}),
+        );
+        let decision:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"set_speed","arguments":{"deviceId":"mock-device","rpm":100}}})).unwrap();
+        let mut events = Vec::new();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &cfg,
+            &decision,
+            "device-test",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+            &mut |e| events.push(e),
+            "device-command",
+        )
+        .await
+        .unwrap();
+        crate::mcp::close_mcp_session(&server);
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::Success
+        );
+        let events = serde_json::to_value(events).unwrap();
+        assert!(
+            events
+                .as_array()
+                .unwrap()
+                .iter()
+                .any(|e| e["type"] == "DeviceState" && e["data"]["update"]["state"] == "verified"),
+            "receipt must not be considered a verified device state: {events}"
+        );
+    }
+
+    #[tokio::test]
+    async fn device_capture_preserves_verified_images_and_explicit_stop_confirms_zero() {
+        let server = format!("device-photo-{}", uuid::Uuid::new_v4());
+        let mut cfg = MintConfig::default();
+        cfg.extra.insert("mcpServers".into(),serde_json::json!({server.clone():{"command":"node","args":[Path::new(env!("CARGO_MANIFEST_DIR")).join("../../examples/device-mcp/server.mjs")],"timeoutSecs":10}}));
+        cfg.extra.insert(
+            "allowedMcpTools".into(),
+            serde_json::json!({server.clone():["*"]}),
+        );
+        let photo:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"capture_photo","arguments":{"deviceId":"mock-device"}}})).unwrap();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &cfg,
+            &photo,
+            "photo-test",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+            &mut |_| {},
+            "photo-command",
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::Success
+        );
+        assert_eq!(out.images.len(), 1);
+        assert!(out.warnings.is_empty());
+        remove_test_artifacts(&out.artifacts);
+        crate::mcp::call_mcp_tool_async(
+            &cfg,
+            &server,
+            "set_speed",
+            serde_json::json!({"deviceId":"mock-device","rpm":1000}),
+            "photo-test",
+            |_| {},
+        )
+        .await
+        .unwrap();
+        let stop:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"stop","arguments":{"deviceId":"mock-device"}}})).unwrap();
+        let mut events = Vec::new();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &cfg,
+            &stop,
+            "photo-test",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+            &mut |e| events.push(e),
+            "stop-command",
+        )
+        .await
+        .unwrap();
+        crate::mcp::close_mcp_session(&server);
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::Success
+        );
+        assert!(events.iter().any(|e|matches!(e,AgentProgress::DeviceState {update,..} if matches!(update.state,crate::mcp::device::DevicePhase::Verified) && update.actual["rpm"]==0)));
+    }
+
+    fn device_fixture(status: Value, timeout: u64) -> (MintConfig, String, PathBuf) {
+        let name = format!("device-fault-{}", uuid::Uuid::new_v4());
+        let log = std::env::temp_dir().join(format!("mint-device-calls-{}", uuid::Uuid::new_v4()));
+        let schema = serde_json::json!({"type":"object","properties":{"deviceId":{"type":"string"},"operationId":{"type":"string"},"rpm":{"type":"integer"}},"required":["deviceId"],"additionalProperties":false});
+        let tools = serde_json::json!([{"name":"set_speed","inputSchema":schema,"outputSchema":{"type":"object"},"_meta":{"mint/device":{"version":1,"statusTool":"get_status"}}},{"name":"get_status","inputSchema":schema,"outputSchema":{"type":"object"}}]);
+        let receipt = serde_json::json!({"deviceId":"mock","operationId":"one","state":"accepted","observationSeq":1,"target":{"rpm":100},"actual":{"rpm":0}});
+        let script = format!(
+            r#"
+import sys,json
+tools=json.loads({:?});receipt=json.loads({:?});status=json.loads({:?})
+for line in sys.stdin:
+ r=json.loads(line);m=r.get('method')
+ if m=='initialize': result={{}}
+ elif m=='tools/list': result={{'tools':tools}}
+ elif m=='tools/call':
+  with open({:?},'a') as f: f.write(json.dumps(r['params'])+'\n')
+  result={{'structuredContent':receipt if r['params']['name']=='set_speed' else status,'content':[]}}
+ else: continue
+ print(json.dumps({{'jsonrpc':'2.0','id':r['id'],'result':result}}),flush=True)
+"#,
+            tools.to_string(),
+            receipt.to_string(),
+            status.to_string(),
+            log.to_string_lossy()
+        );
+        let mut cfg = MintConfig::default();
+        cfg.extra.insert("mcpServers".into(),serde_json::json!({name.clone():{"command":"python3","args":["-u","-c",script],"timeoutSecs":timeout}}));
+        cfg.extra.insert(
+            "allowedMcpTools".into(),
+            serde_json::json!({name.clone():["*"]}),
+        );
+        (cfg, name, log)
+    }
+
+    #[tokio::test]
+    async fn device_stale_observations_cannot_confirm_completion() {
+        let (cfg, server, log) = device_fixture(
+            serde_json::json!({"deviceId":"mock","operationId":"one","state":"completed","observationSeq":1,"target":{"rpm":100},"actual":{"rpm":100}}),
+            1,
+        );
+        let decision:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"set_speed","arguments":{"deviceId":"mock","rpm":100}}})).unwrap();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &cfg,
+            &decision,
+            "stale-test",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+            &mut |_| {},
+            "stale-command",
+        )
+        .await
+        .unwrap();
+        crate::mcp::close_mcp_session(&server);
+        let calls = std::fs::read_to_string(&log).unwrap();
+        std::fs::remove_file(log).unwrap();
+        assert_eq!(calls.lines().filter(|l| l.contains("set_speed")).count(), 1);
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::TimedOut
+        );
+        assert!(
+            out.completion_unconfirmed,
+            "a dispatched command remains uncertain after stale observations"
+        );
+    }
+
+    #[tokio::test]
+    async fn review_device_session_loss_preserves_receipt_without_reconnecting_or_repeating() {
+        let (mut cfg, server, log) = device_fixture(
+            serde_json::json!({"deviceId":"mock","operationId":"one","state":"running","observationSeq":2,"target":{"rpm":100},"actual":{"rpm":50}}),
+            5,
+        );
+        let starts = log.with_extension("starts");
+        let script = cfg.extra["mcpServers"][&server]["args"][2]
+            .as_str()
+            .unwrap()
+            .replace(
+                "import sys,json",
+                &format!(
+                    "import sys,json,os\nopen({:?},'a').write('start\\n')",
+                    starts.to_string_lossy()
+                ),
+            );
+        cfg.extra.get_mut("mcpServers").unwrap()[&server]["args"][2] = serde_json::json!(format!(
+            "{script}\n if m=='tools/call' and r['params']['name']=='get_status': os._exit(0)\n"
+        ));
+        let decision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"set_speed","arguments":{"deviceId":"mock","rpm":100}}})).unwrap();
+        let mut events = Vec::new();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &cfg,
+            &decision,
+            "review-device-loss",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+            &mut |e| events.push(e),
+            "command",
+        )
+        .await
+        .unwrap();
+        crate::mcp::close_mcp_session(&server);
+        let calls = std::fs::read_to_string(&log).unwrap();
+        assert_eq!(std::fs::read_to_string(&starts).unwrap(), "start\n");
+        let _ = std::fs::remove_file(log);
+        let _ = std::fs::remove_file(starts);
+        assert_eq!(calls.lines().filter(|l| l.contains("set_speed")).count(), 1);
+        assert_eq!(
+            calls.lines().filter(|l| l.contains("get_status")).count(),
+            1
+        );
+        assert_eq!(out.status, crate::mcp_result::ToolStatus::Failed);
+        assert!(out.completion_unconfirmed);
+        assert!(
+            out.text.contains("one"),
+            "operation receipt lost: {}",
+            out.text
+        );
+        assert!(events.iter().any(|e|matches!(e,AgentProgress::DeviceState{update,..} if matches!(update.state,crate::mcp::device::DevicePhase::Unconfirmed) && update.operation_id.as_deref()==Some("one"))));
+        assert!(!events.iter().any(|e|matches!(e,AgentProgress::DeviceState{update,..} if matches!(update.state,crate::mcp::device::DevicePhase::Verified))));
+    }
+
+    #[tokio::test]
+    async fn device_wrong_operation_and_physical_failure_never_report_success() {
+        for status in [
+            serde_json::json!({"deviceId":"mock","operationId":"other","state":"completed","observationSeq":2,"target":{"rpm":100},"actual":{"rpm":100}}),
+            serde_json::json!({"deviceId":"mock","operationId":"one","state":"failed","observationSeq":2,"target":{"rpm":100},"actual":{"rpm":0},"error":"jammed"}),
+        ] {
+            let (cfg, server, log) = device_fixture(status, 3);
+            let decision:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"set_speed","arguments":{"deviceId":"mock","rpm":100}}})).unwrap();
+            let out = execute_tool_outcome(
+                Path::new("."),
+                &cfg,
+                &decision,
+                "wrong-operation",
+                &mut |_| Ok(ApprovalOutcome::Denied),
+                &mut |_| {},
+                "wrong-command",
+            )
+            .await
+            .unwrap();
+            crate::mcp::close_mcp_session(&server);
+            std::fs::remove_file(log).unwrap();
+            assert_eq!(
+                out.status,
+                crate::integrations::mcp_result::ToolStatus::Failed
+            );
+            assert!(
+                out.text.starts_with("Error:"),
+                "Native tool results must carry an error marker for failed verification: {}",
+                out.text
+            );
+            assert!(
+                !out.text.contains("no tool was executed"),
+                "verification errors must acknowledge the already dispatched command: {}",
+                out.text
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn device_failed_receipt_is_terminal_without_status_polling() {
+        let (mut cfg, server, log) = device_fixture(
+            serde_json::json!({"deviceId":"mock","operationId":"one","state":"completed","observationSeq":2,"target":{"rpm":100},"actual":{"rpm":100}}),
+            3,
+        );
+        let script = cfg.extra["mcpServers"][&server]["args"][2]
+            .as_str()
+            .unwrap()
+            .replace("accepted", "failed");
+        cfg.extra.get_mut("mcpServers").unwrap()[&server]["args"][2] = serde_json::json!(script);
+        let decision:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"set_speed","arguments":{"deviceId":"mock","rpm":100}}})).unwrap();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &cfg,
+            &decision,
+            "failed-receipt",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+            &mut |_| {},
+            "failed-command",
+        )
+        .await
+        .unwrap();
+        crate::mcp::close_mcp_session(&server);
+        let calls = std::fs::read_to_string(&log).unwrap();
+        std::fs::remove_file(log).unwrap();
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::Failed
+        );
+        assert!(
+            !calls.contains("get_status"),
+            "failed receipt must not be overwritten by a later status"
+        );
+    }
+
+    #[tokio::test]
+    async fn device_denied_status_access_blocks_movement_before_dispatch() {
+        let (mut cfg, server, log) = device_fixture(serde_json::json!({}), 3);
+        cfg.extra.insert(
+            "allowedMcpTools".into(),
+            serde_json::json!({server.clone():["set_speed"]}),
+        );
+        let decision:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"set_speed","arguments":{"deviceId":"mock","rpm":100}}})).unwrap();
+        let mut approvals = Vec::new();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &cfg,
+            &decision,
+            "denied-status",
+            &mut |a| {
+                approvals.push(serde_json::to_value(a).unwrap());
+                Ok(ApprovalOutcome::Denied)
+            },
+            &mut |_| {},
+            "blocked-command",
+        )
+        .await
+        .unwrap();
+        crate::mcp::close_mcp_session(&server);
+        assert!(
+            !log.exists(),
+            "command was dispatched without access to status verification"
+        );
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::Failed
+        );
+        assert!(
+            serde_json::to_string(&approvals)
+                .unwrap()
+                .contains("get_status")
+        );
+    }
+
+    #[tokio::test]
+    async fn canceling_between_device_observations_does_not_issue_another_command() {
+        let (cfg, server, log) = device_fixture(
+            serde_json::json!({"deviceId":"mock","operationId":"one","state":"running","observationSeq":2,"target":{"rpm":100},"actual":{"rpm":20}}),
+            15,
+        );
+        let decision:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"set_speed","arguments":{"deviceId":"mock","rpm":100}}})).unwrap();
+        let chat = format!("cancel-between-{}", uuid::Uuid::new_v4());
+        let name = chat.clone();
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        let mut tx = Some(tx);
+        let running = tokio::spawn(async move {
+            execute_tool_outcome(
+                Path::new("."),
+                &cfg,
+                &decision,
+                &name,
+                &mut |_| Ok(ApprovalOutcome::Denied),
+                &mut |e| {
+                    if matches!(
+                        e,
+                        AgentProgress::DeviceState {
+                            update: crate::mcp::device::DeviceUpdate {
+                                state: crate::mcp::device::DevicePhase::Running,
+                                ..
+                            },
+                            ..
+                        }
+                    ) && let Some(tx) = tx.take()
+                    {
+                        let _ = tx.send(());
+                    }
+                },
+                "cancel-command",
+            )
+            .await
+            .unwrap()
+        });
+        tokio::time::timeout(Duration::from_secs(10), rx)
+            .await
+            .unwrap()
+            .unwrap();
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        assert!(crate::mcp::cancel_mcp_calls(&chat) > 0);
+        let out = tokio::time::timeout(Duration::from_secs(2), running)
+            .await
+            .unwrap()
+            .unwrap();
+        crate::mcp::close_mcp_session(&server);
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::Cancelled
+        );
+        let calls = std::fs::read_to_string(&log).unwrap();
+        std::fs::remove_file(log).unwrap();
+        assert_eq!(calls.lines().filter(|l| l.contains("set_speed")).count(), 1);
+        assert!(!calls.contains("\"stop\""));
+    }
+
+    #[tokio::test]
+    async fn approval_feedback_does_not_mark_an_unexecuted_mcp_call_successful() {
+        let decision: AgentDecision = serde_json::from_value(serde_json::json!({
+            "action":"mcp_tool", "input":{"server":"feedback-server","tool":"render","arguments":{}}
+        }))
+        .unwrap();
+        let mut config = MintConfig::default();
+        config.extra.insert("mcpServers".into(),serde_json::json!({"feedback-server":{"command":"python3","args":["-u","-c",generic_server("render",serde_json::json!({}))]}}));
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &config,
+            &decision,
+            "feedback",
+            &mut |_| {
+                Ok(ApprovalOutcome::Intercepted(
+                    "Use a different device".into(),
+                ))
+            },
+            &mut |_| {},
+            "not-executed",
+        )
+        .await
+        .unwrap();
+        assert!(out.text.contains("Use a different device"));
+        assert!(out.text.contains("no command was executed"));
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::Failed
+        );
+    }
+
+    #[tokio::test]
+    async fn text_only_model_keeps_artifacts_without_receiving_image_blocks() {
+        use base64::Engine as _;
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        image::DynamicImage::new_rgb8(1, 1)
+            .write_to(&mut bytes, image::ImageFormat::Png)
+            .unwrap();
+        let encoded = base64::engine::general_purpose::STANDARD.encode(bytes.into_inner());
+        let response =
+            serde_json::json!({"content":[{"type":"image","mimeType":"image/png","data":encoded}]})
+                .to_string();
+        let script = generic_server("preview", serde_json::from_str(&response).unwrap());
+        let server = format!("text-model-{}", uuid::Uuid::new_v4());
+        let mut cfg = MintConfig::default();
+        cfg.extra.insert(
+            "mcpServers".into(),
+            serde_json::json!({server.clone():{"command":"python3","args":["-u","-c",script]}}),
+        );
+        cfg.extra.insert(
+            "allowedMcpTools".into(),
+            serde_json::json!({server.clone():["preview"]}),
+        );
+        cfg.extra.insert("mcpImageInput".into(), Value::Bool(false));
+        let decision:AgentDecision=serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"preview","arguments":{}}})).unwrap();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &cfg,
+            &decision,
+            "text-only",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+            &mut |_| {},
+            "preview",
+        )
+        .await
+        .unwrap();
+        assert!(out.images.is_empty());
+        assert_eq!(out.artifacts.len(), 1);
+        assert!(out.text.contains("do not claim visual inspection"));
+        crate::mcp::close_mcp_session(&server);
+        remove_test_artifacts(&out.artifacts);
+    }
+
+    #[test]
+    fn multiple_images_attach_to_the_correct_native_tool_result() {
+        let images = std::collections::HashMap::from([(
+            "call-2".to_string(),
+            vec![
+                "data:image/png;base64,first".into(),
+                "data:image/png;base64,second".into(),
+            ],
+        )]);
+        let results = vec![
+            (
+                "call-1".into(),
+                "mcp_tool".into(),
+                Value::Null,
+                "one".into(),
+            )
+                .into(),
+            (
+                "call-2".into(),
+                "mcp_tool".into(),
+                Value::Null,
+                "two".into(),
+            )
+                .into(),
+        ];
+        let mut messages = Vec::new();
+        append_native_tool_results(&mut messages, "", &results, &Default::default(), &images);
+        assert!(
+            matches!(&messages[1].content[1],ContentBlock::ToolResult {tool_use_id,..} if tool_use_id=="call-2")
+        );
+        assert!(
+            matches!(&messages[1].content[2],ContentBlock::Image {data_uri} if data_uri.ends_with("first"))
+        );
+        assert!(
+            matches!(&messages[1].content[3],ContentBlock::Image {data_uri} if data_uri.ends_with("second"))
+        );
+    }
+
+    #[tokio::test]
+    async fn mcp_images_do_not_enter_the_text_observation() {
+        let server = format!("image-{}", uuid::Uuid::new_v4());
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        image::DynamicImage::new_rgb8(1, 1)
+            .write_to(&mut bytes, image::ImageFormat::Png)
+            .unwrap();
+        let png = BASE64_STANDARD.encode(bytes.into_inner());
+        let result = serde_json::json!({"content":[{"type":"text","text":"preview"},{"type":"image","mimeType":"image/png","data":png}]}).to_string();
+        let script = generic_server("preview", serde_json::from_str(&result).unwrap());
+        let mut config = MintConfig::default();
+        config.extra.insert(
+            "mcpServers".into(),
+            serde_json::json!({server.clone():{"command":"python3","args":["-u","-c",script]}}),
+        );
+        let decision: AgentDecision = serde_json::from_value(serde_json::json!({"action":"mcp_tool","input":{"server":server,"tool":"preview","arguments":{}}})).unwrap();
+        let mut events = Vec::new();
+        let out = execute_tool_outcome(
+            Path::new("."),
+            &config,
+            &decision,
+            "image-test",
+            &mut |_| Ok(ApprovalOutcome::Approved),
+            &mut |event| events.push(event),
+            "image-invocation",
+        )
+        .await
+        .unwrap();
+        assert!(
+            !out.text.contains(&png),
+            "binary data must be removed from the model's text observation"
+        );
+        assert_eq!(
+            out.status,
+            crate::integrations::mcp_result::ToolStatus::Success
+        );
+        assert_eq!(out.images.len(), 1);
+        assert_eq!(out.artifacts[0].call_id, "image-invocation");
+        assert!(out.text.contains("preview"));
+        assert!(!serde_json::to_string(&events).unwrap().contains(&png));
+        assert!(
+            !crate::mcp::is_mcp_tool_allowed(&config, &server, "preview"),
+            "one-call approval must not persist a grant"
+        );
+        crate::mcp::close_mcp_session(&server);
+        remove_test_artifacts(&out.artifacts);
+    }
+
+    fn remove_test_artifacts(artifacts: &[crate::integrations::mcp_result::McpArtifact]) {
+        let directory = crate::integrations::mcp_result::artifact_directory().unwrap();
+        for artifact in artifacts {
+            std::fs::remove_file(directory.join(&artifact.id)).unwrap();
+            std::fs::remove_file(directory.join(format!("{}.json", artifact.id))).unwrap();
+        }
+    }
+
+    // A transport-successful tool failure must not become a successful agent step.
+    #[tokio::test]
+    async fn mcp_tool_failure_is_visible_to_the_agent() {
+        let server = format!("outcome-{}", uuid::Uuid::new_v4());
+        let mut config = MintConfig::default();
+        config.extra.insert("mcpServers".into(),serde_json::json!({server.clone():{"command":"python3","args":["-u","-c",generic_server("render",serde_json::json!({"isError":true,"content":[{"type":"text","text":"render failed"}]}))]}}));
+        config.extra.insert(
+            "allowedMcpTools".into(),
+            serde_json::json!({server.clone():["render"]}),
+        );
+        let decision: AgentDecision = serde_json::from_value(serde_json::json!({
+            "thought":"render", "action":"mcp_tool", "input":{"server":server,"tool":"render","arguments":{}}
+        })).unwrap();
+        let result = execute_tool(
+            Path::new("."),
+            &config,
+            &decision,
+            "outcome-test",
+            &mut |_| Ok(ApprovalOutcome::Denied),
+            &mut |_| {},
+        )
+        .await
+        .unwrap();
+        assert!(
+            result.starts_with("Error:"),
+            "tool failure must reach the model as a failure: {result}"
+        );
+        assert!(result.contains("render failed"));
+        crate::mcp::close_mcp_session(&server);
+    }
+
+    #[test]
+    fn test_fault_tolerant_null_handling() {
+        let input = serde_json::json!({
+            "command": "curl -sL https://example.com",
+            "city": null,
+            "columns": null,
+            "verification": null,
+            "filter": null
+        });
+        let parsed = decode_agent_input(input).unwrap();
+        assert_eq!(parsed.command, "curl -sL https://example.com");
+        assert_eq!(parsed.city, "");
+        assert_eq!(parsed.verification, "");
+    }
+
+    #[test]
+    fn test_unpack_nested_arguments() {
+        // Stringified JSON arguments
+        let str_args = serde_json::json!({
+            "action": "run_shell",
+            "arguments": "{\"command\": \"ls -la\", \"city\": null}"
+        });
+        let parsed_str = decode_agent_input(str_args).unwrap();
+        assert_eq!(parsed_str.command, "ls -la");
+
+        // Object arguments
+        let obj_args = serde_json::json!({
+            "action": "run_shell",
+            "arguments": { "command": "pwd" }
+        });
+        let parsed_obj = decode_agent_input(obj_args).unwrap();
+        assert_eq!(parsed_obj.command, "pwd");
+    }
+
+    #[test]
+    fn test_shell_command_aliases() {
+        for (alias, expected) in [
+            ("cmd", "echo 1"),
+            ("script", "echo 2"),
+            ("exec", "echo 3"),
+            ("code", "echo 4"),
+            ("bash", "echo 5"),
+            ("sh", "echo 6"),
+        ] {
+            let input = serde_json::json!({ alias: expected });
+            let parsed = decode_agent_input(input).unwrap();
+            assert_eq!(parsed.command, expected, "Failed for alias {alias}");
+        }
+    }
+
+    #[test]
+    fn test_parse_tool_input_raw_shell_string() {
+        let raw = Value::String("curl -sL --max-time 25 https://sndiary02.com".into());
+        let parsed = parse_tool_input("run_shell", raw).unwrap();
+        assert_eq!(
+            parsed.command,
+            "curl -sL --max-time 25 https://sndiary02.com"
+        );
+    }
+
+    #[test]
+    fn test_parse_tool_input_prunes_dummy_null_strings() {
+        let raw = serde_json::json!({
+            "command": "curl -sL https://example.com",
+            "path": "null",
+            "query": "null",
+            "name": "null",
+            "title": "undefined",
+            "url": "none"
+        });
+        let parsed = parse_tool_input("run_shell", raw).unwrap();
+        assert_eq!(parsed.command, "curl -sL https://example.com");
+        assert_eq!(parsed.path, "");
+        assert_eq!(parsed.query, "");
+        assert_eq!(parsed.name, "");
+        assert_eq!(parsed.title, "");
+        assert_eq!(parsed.url, "");
+    }
+
+    #[test]
+    fn test_is_dummy_value() {
+        assert!(is_dummy_value("null"));
+        assert!(is_dummy_value("NULL"));
+        assert!(is_dummy_value("  null  "));
+        assert!(is_dummy_value("undefined"));
+        assert!(is_dummy_value("none"));
+        assert!(is_dummy_value("nil"));
+        assert!(is_dummy_value("(null)"));
+        assert!(is_dummy_value("\"\""));
+        assert!(is_dummy_value("''"));
+
+        assert!(!is_dummy_value("echo null"));
+        assert!(!is_dummy_value("cat /dev/null"));
+        assert!(!is_dummy_value("src/main.rs"));
+        assert!(!is_dummy_value("pwd"));
+    }
+}