diff --git a/.github/workflows/consolidated-tests-ci.yml b/.github/workflows/consolidated-tests-ci.yml
index d1bea819eb..489ee4ca08 100644
--- a/.github/workflows/consolidated-tests-ci.yml
+++ b/.github/workflows/consolidated-tests-ci.yml
@@ -7,7 +7,7 @@
 #
 # Why a separate workflow:
 #   - studio-backend-ci.yml's "Repo tests (CPU)" job already auto-discovers
-#     tests/ minus tests/qlora, tests/saving, tests/utils, tests/sh. The 16
+#     tests/ minus tests/qlora, tests/saving, tests/utils, tests/sh. The 17
 #     Bucket-A tests below live inside those --ignore dirs (CPU-runnable but
 #     historically excluded with their GPU siblings); pulling them out into
 #     a sibling job keeps the existing 760-passed baseline stable while we
@@ -274,6 +274,7 @@ jobs:
             tests/saving/test_export_dispatch.py \
             tests/saving/test_imatrix_export.py \
             tests/saving/test_gguf_single_pass_export.py \
+            tests/saving/test_offline_gguf_vlm_tokenizer_7481.py \
             tests/utils/test_attention_masks.py \
             tests/utils/test_trunc_normal_patch.py \
             tests/python/test_fast_language_model_text_only.py
@@ -365,6 +366,7 @@ jobs:
             tests/saving/test_export_dispatch.py \
             tests/saving/test_imatrix_export.py \
             tests/saving/test_gguf_single_pass_export.py \
+            tests/saving/test_offline_gguf_vlm_tokenizer_7481.py \
             tests/utils/test_attention_masks.py \
             tests/utils/test_trunc_normal_patch.py \
             tests/python/test_fast_language_model_text_only.py \
@@ -2129,7 +2131,7 @@ jobs:
           pip show unsloth_zoo
           echo "::endgroup::"
           echo "Consolidated job done. Coverage:"
-          echo "  - 16 unsloth Bucket-A tests under tests/saving/ + tests/utils/"
+          echo "  - 17 unsloth Bucket-A tests under tests/saving/ + tests/utils/"
           echo "  - unsloth_zoo @ ${UNSLOTH_ZOO_REF} pytest tests/ (5 GPU cases deselected)"
           echo "  - unsloth_zoo.compiler.test_apply_fused_lm_head"
 
diff --git a/.github/workflows/studio-update-smoke.yml b/.github/workflows/studio-update-smoke.yml
index 625c2c7811..047840e41c 100644
--- a/.github/workflows/studio-update-smoke.yml
+++ b/.github/workflows/studio-update-smoke.yml
@@ -146,6 +146,46 @@ jobs:
           kill "$PID" 2>/dev/null || true
           echo "post-update Unsloth /api/health OK"
 
+      - name: A complete install reports itself complete
+        run: |
+          set -o pipefail
+          unsloth studio verify-install
+          unsloth studio desktop-capabilities --json | tee /tmp/caps.json
+          jq -e '.studio_install_ok == true' /tmp/caps.json
+          jq -e '.desktop_manageability_version >= 2' /tmp/caps.json
+
+      - name: An incomplete install must not report itself ready
+        # An installer killed part-way leaves a working CLI but no studio.txt
+        # deps, which the old preflight called ManagedReady. The manifest is
+        # written last, so removing it reproduces that state.
+        run: |
+          set -o pipefail
+          # install.sh's default root, resolved explicitly: `python` on PATH
+          # here is setup-python's, not the managed venv.
+          MANIFEST="$HOME/.unsloth/studio/unsloth_studio/unsloth_install_manifest.json"
+          test -f "$MANIFEST" || { echo "::error::installer never wrote $MANIFEST"; exit 1; }
+          rm -f "$MANIFEST"
+          unsloth studio desktop-capabilities --json | tee /tmp/caps_bad.json
+          jq -e '.studio_install_ok == false' /tmp/caps_bad.json
+          if unsloth studio verify-install; then
+            echo "::error::verify-install passed on an install with no manifest"
+            exit 1
+          fi
+          echo "incomplete install correctly reported not-ready"
+
+      - name: Update repairs an incomplete install
+        # `--local` bypasses setup.sh's PyPI version compare, so this asserts
+        # the repair OUTCOME. The non-local fast path the desktop Repair button
+        # uses is covered by tests/studio/install/test_setup_fast_path_guard.py.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -o pipefail
+          unsloth studio update --local 2>&1 | tee logs/update_repair.log
+          unsloth studio verify-install
+          unsloth studio desktop-capabilities --json | jq -e '.studio_install_ok == true'
+          echo "update repaired the incomplete install"
+
       - name: Uninstall and verify clean
         # Round-trip the installer through scripts/uninstall.sh: confirms the
         # uninstaller actually finds and removes everything install.sh +
diff --git a/.github/workflows/wheel-smoke.yml b/.github/workflows/wheel-smoke.yml
index cdad617027..f7a7511616 100644
--- a/.github/workflows/wheel-smoke.yml
+++ b/.github/workflows/wheel-smoke.yml
@@ -127,6 +127,31 @@ jobs:
           cd /tmp
           /tmp/v/bin/python -c "from studio.backend.main import app; print('Unsloth backend OK:', app.title)"
 
+      - name: CLI without the Studio stack guides instead of tracebacking
+        # The smoke above installs studio.txt first, so it cannot catch a wheel
+        # that ships studio/ without declaring what it imports (#4701, #5260,
+        # #7147). Drop only structlog to reuse that venv without a re-download.
+        run: |
+          set -eu
+          /tmp/v/bin/pip uninstall -y structlog >/dev/null
+          cd /tmp
+          status=0
+          for args in "export ./nope ./out" "list-checkpoints"; do
+            echo "--- unsloth $args"
+            out=$(/tmp/v/bin/unsloth $args 2>&1 || true)
+            printf '%s\n' "$out"
+            case "$out" in
+              *Traceback*)
+                echo "FAIL: raw traceback instead of guidance"; status=1 ;;
+            esac
+            case "$out" in
+              *'unsloth studio update'*) ;;
+              *) echo "FAIL: no remediation in the message"; status=1 ;;
+            esac
+          done
+          /tmp/v/bin/pip install -q structlog >/dev/null
+          exit "$status"
+
       - name: Upload wheel on failure
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
diff --git a/.gitignore b/.gitignore
index 39ca2226ca..fafd17aa95 100644
--- a/.gitignore
+++ b/.gitignore
@@ -238,4 +238,5 @@ package-lock.json
 !studio/package-lock.json
 llama.cpp/
 # Stray "~" dir some tools create from a literal ~ TMPDIR; never part of the repo.
-/~/
+~/
+/temp/
diff --git a/install.ps1 b/install.ps1
index a2aff0b69a..0b06cb3ea1 100644
--- a/install.ps1
+++ b/install.ps1
@@ -28,6 +28,14 @@ function Install-UnslothStudio {
         }
     }
 
+    function Clear-TauriInstallError {
+        param([string]$Message)
+        if ($TauriMode) {
+            Write-TauriLog "ERROR_CLEAR" $Message
+            [Console]::Error.WriteLine("[TAURI:ERROR_CLEAR] $Message")
+        }
+    }
+
     function Format-TauriDiagBool {
         param([bool]$Value)
         if ($Value) { return "true" }
@@ -86,7 +94,7 @@ function Install-UnslothStudio {
             [int]$Code = 1
         )
         if ($Code -eq 0) { $Code = 1 }
-        Write-TauriLog "ERROR" $Message
+        Write-TauriLog "ERROR_DEFAULT" $Message
         if (Get-Command Restore-StudioVenvRollback -CommandType Function -ErrorAction SilentlyContinue) {
             Restore-StudioVenvRollback
         }
@@ -485,7 +493,8 @@ function Install-UnslothStudio {
     # Full command output is shown only when --verbose / UNSLOTH_VERBOSE=1.
     function Invoke-InstallCommand {
         param(
-            [Parameter(Mandatory = $true)][ScriptBlock]$Command
+            [Parameter(Mandatory = $true)][ScriptBlock]$Command,
+            [string]$Label = "install command"
         )
         # Installer-pinned index installs (torch) must beat an inherited uv mirror (#6898):
         # for --default-index, clear the uv index env vars (restore in finally) and set
@@ -504,6 +513,7 @@ function Install-UnslothStudio {
         try {
             # Reset to avoid stale values from prior native commands.
             $global:LASTEXITCODE = 0
+            Write-TauriLog "OUTPUT_CLEAR" $Label
             if ($script:UnslothVerbose) {
                 # Merge stderr into stdout so progress/warning output stays visible
                 # without flipping $? on successful native commands (PS 5.1 treats
@@ -518,7 +528,13 @@ function Install-UnslothStudio {
                     Write-Host (Redact-InstallOutput $output) -ForegroundColor Red
                 }
             }
-            return [int]$LASTEXITCODE
+            $exitCode = [int]$LASTEXITCODE
+            if ($exitCode -eq 0) {
+                Clear-TauriInstallError "$Label recovered"
+            } else {
+                Write-TauriLog "ERROR_OUTPUT" "$Label failed (exit code $exitCode)"
+            }
+            return $exitCode
         } finally {
             $ErrorActionPreference = $prevEap
             if ($savedUvIndex) {
@@ -549,7 +565,7 @@ function Install-UnslothStudio {
         }
         $attempt = 1
         while ($true) {
-            $code = Invoke-InstallCommand $Command
+            $code = Invoke-InstallCommand -Command $Command -Label $Label
             if ($code -eq 0) { return 0 }
             if ($attempt -ge $maxAttempts) { return $code }
             substep ("retrying ""$Label"" after transient failure (attempt $($attempt + 1)/$maxAttempts, waiting ${delay}s)...") "Yellow"
@@ -1603,7 +1619,7 @@ exit 0
     if (-not (Test-Path -LiteralPath $VenvPython)) {
         step "venv" "creating Python $($DetectedPython.Version) virtual environment"
         substep "$VenvDir"
-        $venvExit = Invoke-InstallCommand { uv venv $VenvDir --python "$($DetectedPython.Path)" }
+        $venvExit = Invoke-InstallCommand -Label "create virtual environment" { uv venv $VenvDir --python "$($DetectedPython.Path)" }
         if ($venvExit -ne 0) {
             Write-Host "[ERROR] Failed to create virtual environment (exit code $venvExit)" -ForegroundColor Red
             return (Exit-InstallFailure "Failed to create virtual environment (exit code $venvExit)" $venvExit)
@@ -2375,7 +2391,7 @@ exit 0
         }
         if ($StudioLocalInstall) {
             substep "overlaying local repo (editable)..."
-            $overlayExit = Invoke-InstallCommand { uv pip install --python $VenvPython -e $RepoRoot --no-deps }
+            $overlayExit = Invoke-InstallCommand -Label "overlay local repo" { uv pip install --python $VenvPython -e $RepoRoot --no-deps }
             if ($overlayExit -ne 0) {
                 Write-Host "[ERROR] Failed to overlay local repo (exit code $overlayExit)" -ForegroundColor Red
                 return (Exit-InstallFailure "Failed to overlay local repo (exit code $overlayExit)" $overlayExit)
@@ -2464,7 +2480,7 @@ exit 0
 
         if ($StudioLocalInstall) {
             substep "overlaying local repo (editable)..."
-            $overlayExit = Invoke-InstallCommand { uv pip install --python $VenvPython -e $RepoRoot --no-deps }
+            $overlayExit = Invoke-InstallCommand -Label "overlay local repo" { uv pip install --python $VenvPython -e $RepoRoot --no-deps }
             if ($overlayExit -ne 0) {
                 Write-Host "[ERROR] Failed to overlay local repo (exit code $overlayExit)" -ForegroundColor Red
                 return (Exit-InstallFailure "Failed to overlay local repo (exit code $overlayExit)" $overlayExit)
@@ -2487,7 +2503,7 @@ exit 0
                 return (Exit-InstallFailure "Failed to install unsloth (exit code $baseInstallExit)" $baseInstallExit)
             }
             substep "overlaying local repo (editable)..."
-            $overlayExit = Invoke-InstallCommand { uv pip install --python $VenvPython -e $RepoRoot --no-deps }
+            $overlayExit = Invoke-InstallCommand -Label "overlay local repo" { uv pip install --python $VenvPython -e $RepoRoot --no-deps }
             if ($overlayExit -ne 0) {
                 Write-Host "[ERROR] Failed to overlay local repo (exit code $overlayExit)" -ForegroundColor Red
                 return (Exit-InstallFailure "Failed to overlay local repo (exit code $overlayExit)" $overlayExit)
@@ -2535,7 +2551,7 @@ exit 0
                     $visionSpec = if ($PinnedRocmVisionSpec) { $PinnedRocmVisionSpec } elseif ($ROCmGfxArch -and $torchvisionFloorMap -and $torchvisionFloorMap.ContainsKey($ROCmGfxArch)) { $torchvisionFloorMap[$ROCmGfxArch] } else { "torchvision" }
                     $audioSpec = if ($PinnedRocmAudioSpec) { $PinnedRocmAudioSpec } elseif ($ROCmGfxArch -and $torchaudioFloorMap -and $torchaudioFloorMap.ContainsKey($ROCmGfxArch)) { $torchaudioFloorMap[$ROCmGfxArch] } else { "torchaudio" }
                     substep "PyTorch flavor mismatch (installed $installedTorchTag, need ROCm) -- reinstalling correct build..." "Yellow"
-                    $torchFixExit = Invoke-InstallCommand { uv pip install --python $VenvPython --force-reinstall --default-index $ROCmIndexUrl $rocmSpec $visionSpec $audioSpec }
+                    $torchFixExit = Invoke-InstallCommand -Label "reinstall PyTorch (ROCm)" { uv pip install --python $VenvPython --force-reinstall --default-index $ROCmIndexUrl $rocmSpec $visionSpec $audioSpec }
                     if ($torchFixExit -ne 0) {
                         Write-Host "[ERROR] Failed to reinstall PyTorch with the correct ROCm build (exit code $torchFixExit)" -ForegroundColor Red
                         return (Exit-InstallFailure "Failed to reinstall PyTorch (ROCm) (exit code $torchFixExit)" $torchFixExit)
@@ -2544,7 +2560,7 @@ exit 0
                 } elseif ($expectedTorchTag -ne 'rocm') {
                     # CUDA: stale +cpu (or wrong cuXXX) against a CUDA index -> reinstall triplet.
                     substep "PyTorch flavor mismatch (installed $installedTorchTag, need $expectedTorchTag) -- reinstalling correct build..." "Yellow"
-                    $torchFixExit = Invoke-InstallCommand { uv pip install --python $VenvPython "torch>=2.4,<2.11.0" "torchvision>=0.19,<0.26.0" "torchaudio>=2.4,<2.11.0" --default-index $TorchIndexUrl --reinstall-package torch --reinstall-package torchvision --reinstall-package torchaudio }
+                    $torchFixExit = Invoke-InstallCommand -Label "reinstall PyTorch ($expectedTorchTag)" { uv pip install --python $VenvPython "torch>=2.4,<2.11.0" "torchvision>=0.19,<0.26.0" "torchaudio>=2.4,<2.11.0" --default-index $TorchIndexUrl --reinstall-package torch --reinstall-package torchvision --reinstall-package torchaudio }
                     if ($torchFixExit -ne 0) {
                         Write-Host "[ERROR] Failed to reinstall PyTorch with the correct CUDA build (exit code $torchFixExit)" -ForegroundColor Red
                         return (Exit-InstallFailure "Failed to reinstall PyTorch ($expectedTorchTag) (exit code $torchFixExit)" $torchFixExit)
@@ -2645,6 +2661,9 @@ exit 0
     # an inherited value would put llama.cpp in the wrong place.
     $previousUnslothStudioHome = $env:UNSLOTH_STUDIO_HOME
     $hadPreviousUnslothStudioHome = ($null -ne $previousUnslothStudioHome)
+    $previousTauriMode = $env:UNSLOTH_TAURI_MODE
+    $hadPreviousTauriMode = ($null -ne $previousTauriMode)
+    $env:UNSLOTH_TAURI_MODE = if ($TauriMode) { "1" } else { "0" }
     if ($StudioRedirectMode -eq 'env') {
         $env:UNSLOTH_STUDIO_HOME = $StudioHome
     } else {
@@ -2674,14 +2693,22 @@ exit 0
         } else {
             Remove-Item Env:UNSLOTH_STUDIO_HOME -ErrorAction SilentlyContinue
         }
+        if ($hadPreviousTauriMode) {
+            $env:UNSLOTH_TAURI_MODE = $previousTauriMode
+        } else {
+            Remove-Item Env:UNSLOTH_TAURI_MODE -ErrorAction SilentlyContinue
+        }
         Remove-Item Env:UNSLOTH_LOCAL_LLAMA_CPP_DIR -ErrorAction SilentlyContinue
         Remove-Item Env:UNSLOTH_INSTALL_ROLLBACK_MANAGED -ErrorAction SilentlyContinue
         Remove-Item Env:UNSLOTH_SETUP_PYTHON -ErrorAction SilentlyContinue
     }
     if ($setupExit -ne 0) {
-        Write-Host "[ERROR] unsloth studio setup failed (exit code $setupExit)" -ForegroundColor Red
+        if (-not $TauriMode) {
+            Write-Host "[ERROR] unsloth studio setup failed (exit code $setupExit)" -ForegroundColor Red
+        }
         return (Exit-InstallFailure "unsloth studio setup failed (exit code $setupExit)" $setupExit)
     }
+    Clear-TauriInstallError "studio setup completed"
 
     # ── Expose `unsloth` via a shim dir containing only unsloth.exe ──
     # We do NOT add the venv Scripts dir to PATH (it also holds python.exe
diff --git a/install.sh b/install.sh
index d90195399d..376daa8fab 100755
--- a/install.sh
+++ b/install.sh
@@ -207,18 +207,37 @@ run_install_cmd() {
         # command's exit code across the pipe without relying on pipefail
         # (this script runs under plain sh).
         _rcf=$(mktemp)
-        { "$@" 2>&1; printf '%s' "$?" > "$_rcf"; } | _redact_install_output
+        tauri_stream_log stdout "OUTPUT_CLEAR" "$_label"
+        {
+            if "$@" 2>&1; then
+                _cmd_rc=0
+            else
+                _cmd_rc=$?
+            fi
+            printf '%s' "$_cmd_rc" > "$_rcf"
+        } | _redact_install_output
         _rc=$(cat "$_rcf" 2>/dev/null || echo 1)
         rm -f "$_rcf"
-        [ "${_rc:-1}" -eq 0 ] 2>/dev/null && return 0
+        _rc=${_rc:-1}
+        if [ "$_rc" -eq 0 ] 2>/dev/null; then
+            tauri_clear_install_error "$_label recovered"
+            return 0
+        fi
+        tauri_stream_log stdout "ERROR_OUTPUT" "$_label failed (exit code $_rc)"
         step "error" "$_label failed (exit code $_rc)" "$C_ERR" >&2
         return "$_rc"
     fi
     _log=$(mktemp)
-    "$@" >"$_log" 2>&1 && { rm -f "$_log"; return 0; }
+    tauri_stream_log stderr "OUTPUT_CLEAR" "$_label"
+    "$@" >"$_log" 2>&1 && {
+        rm -f "$_log"
+        tauri_clear_install_error "$_label recovered"
+        return 0
+    }
     _rc=$?
     step "error" "$_label failed (exit code $_rc)" "$C_ERR" >&2
     _redact_install_output "$_log" >&2
+    tauri_stream_log stderr "ERROR_OUTPUT" "$_label failed (exit code $_rc)"
     rm -f "$_log"
     return $_rc
 }
@@ -257,6 +276,51 @@ run_install_cmd_retry() {
     done
 }
 
+# True when the runtime target is gfx906 (MI50/Radeon VII): the prebuilt AMD
+# bitsandbytes wheel carries no gfx906 kernels, and force-reinstalling it would
+# clobber a user's source-built bnb (the only 4-bit path on this arch) on every
+# `studio update`. So skip the auto-install and leave whatever bnb is present.
+# _gfx906_target is set during torch-index resolution; also honor an explicit
+# UNSLOTH_ROCM_GFX_ARCH so a pinned-index install still skips. The override is
+# normalized (gfx906:sramecc-:xnack- -> gfx906) so a copied HIP gcnArchName counts.
+_is_gfx906_bnb_skip() {
+    [ "${_gfx906_target:-false}" = true ] && return 0
+    _bnb_gfx_env=$(printf '%s' "${UNSLOTH_ROCM_GFX_ARCH:-}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
+    _bnb_gfx_env=${_bnb_gfx_env%%:*}
+    [ "$_bnb_gfx_env" = "gfx906" ] && return 0
+    # A pinned index (UNSLOTH_TORCH_INDEX_URL/_FAMILY) skips the reroute block that
+    # sets _gfx906_target, so a real gfx906 host with a pinned rocm6.3 index and no
+    # UNSLOTH_ROCM_GFX_ARCH would otherwise clobber a source-built bnb. Probe here
+    # in that gap; skip only when gfx906 is the SOLE distinct arch (mixed hosts
+    # opt in via the env var, mirroring the reroute block's de-dup rule).
+    if [ -z "$_bnb_gfx_env" ] && [ "${_torch_index_pinned:-false}" = true ]; then
+        _bnb_gfx_probe=$(_probe_amd_gfx_arch | awk 'NF && !seen[$0]++')
+        [ "$_bnb_gfx_probe" = "gfx906" ] && return 0
+    fi
+    return 1
+}
+
+# `pip install unsloth` resolves its unconditional bitsandbytes dep to a generic
+# CUDA wheel (no gfx906 kernels) once we skip the prebuilt one. Snapshot bnb before
+# the unsloth install, then drop a freshly pulled wheel afterwards while leaving a
+# pre-existing source build in place.
+_gfx906_bnb_installed() {
+    "$_VENV_PY" -c "import importlib.util as u, sys; sys.exit(0 if u.find_spec('bitsandbytes') else 1)" >/dev/null 2>&1
+}
+_gfx906_bnb_snapshot() {
+    _gfx906_bnb_absent_before=false
+    _is_gfx906_bnb_skip || return 0
+    _gfx906_bnb_installed || _gfx906_bnb_absent_before=true
+}
+_gfx906_bnb_prune() {
+    _is_gfx906_bnb_skip || return 0
+    [ "${_gfx906_bnb_absent_before:-false}" = true ] || return 0
+    _gfx906_bnb_installed || return 0
+    substep "gfx906: removing generic bitsandbytes pulled in as a dependency (no gfx906 kernels; build from source for 4-bit QLoRA)" "$C_WARN"
+    uv pip uninstall --python "$_VENV_PY" bitsandbytes >/dev/null 2>&1 \
+        || "$_VENV_PY" -m pip uninstall -y bitsandbytes >/dev/null 2>&1 || true
+}
+
 # Install bitsandbytes on AMD ROCm hosts. Uses the continuous-release_main
 # wheel for the ROCm 4-bit GEMV fix (bnb PR #1887, post-0.49.2); bnb <= 0.49.2
 # NaNs at decode shape on every AMD GPU. Falls back to PyPI >=0.49.1 if the
@@ -338,6 +402,34 @@ tauri_log() {
     fi
 }
 
+tauri_stream_log() {
+    _tsl_stream="$1"
+    _tsl_tag="$2"
+    shift 2
+    if [ "$TAURI_MODE" = true ]; then
+        if [ "$_tsl_stream" = stderr ]; then
+            printf '[TAURI:%s] %s\n' "$_tsl_tag" "$*" >&2
+        else
+            printf '[TAURI:%s] %s\n' "$_tsl_tag" "$*"
+        fi
+    fi
+}
+
+rollback_substep() {
+    if [ "$TAURI_MODE" = true ]; then
+        tauri_log "PROGRESS" "$1"
+    else
+        substep "$@"
+    fi
+}
+
+tauri_clear_install_error() {
+    if [ "$TAURI_MODE" = true ]; then
+        tauri_log "ERROR_CLEAR" "$1"
+        printf '[TAURI:ERROR_CLEAR] %s\n' "$1" >&2
+    fi
+}
+
 tauri_diag_marker() {
     _diag_gpu_branch="${1:-unknown}"
     _diag_torch_index_family="${2:-none}"
@@ -498,10 +590,10 @@ _restore_studio_venv_replacement() {
         _VENV_ROLLBACK_ACTIVE=false
         return 0
     }
-    substep "restoring previous environment after failed install..." "$C_WARN"
+    rollback_substep "restoring previous environment after failed install..." "$C_WARN"
     rm -rf "$_VENV_ROLLBACK_TARGET"
     if mv "$_VENV_ROLLBACK_DIR" "$_VENV_ROLLBACK_TARGET"; then
-        substep "restored previous environment"
+        rollback_substep "restored previous environment"
         _VENV_ROLLBACK_ACTIVE=false
         _VENV_ROLLBACK_DIR=""
     else
@@ -3296,10 +3388,20 @@ case "$_torch_index_leaf" in
                     if (n > 0) print vals[idx]
                 }')
         fi
+        # An explicit UNSLOTH_ROCM_GFX_ARCH=gfx906 pins the runtime target to the
+        # MI50 / Radeon VII path and must win over Strix probe-order detection on a
+        # mixed Strix + MI50 host, so the Strix reroute is suppressed when it is set.
+        # Normalize a copied HIP gcnArchName (gfx906:sramecc-:xnack- -> gfx906) and
+        # trim whitespace (mirrors the Python .strip()) so the feature-flag suffix or
+        # a stray newline does not defeat the exact gfx906 comparisons below.
+        _gfx906_env=$(printf '%s' "${UNSLOTH_ROCM_GFX_ARCH:-}" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
+        _gfx906_env=${_gfx906_env%%:*}
         _strix_gfx=""
-        case "$_runtime_gfx" in
-            gfx1151|gfx1150|gfx1152) _strix_gfx="$_runtime_gfx" ;;
-        esac
+        if [ "$_gfx906_env" != "gfx906" ]; then
+            case "$_runtime_gfx" in
+                gfx1151|gfx1150|gfx1152) _strix_gfx="$_runtime_gfx" ;;
+            esac
+        fi
         # Skip rocm7.13+ generic indexes: they already ship the fixes, so the
         # arch build (rocm7.13) would be a downgrade rather than a rescue.
         if [ -n "$_strix_gfx" ] && _rocm_leaf_below "$_torch_index_leaf" 7 13; then
@@ -3327,6 +3429,57 @@ case "$_torch_index_leaf" in
             TORCHAUDIO_CONSTRAINT="torchaudio>=2.11.0,<2.12.0"
             _amd_gpu_radeon=false
         fi
+        # ── MI50 / Radeon VII (gfx906, Vega 20): legacy community-supported path ──
+        # Newer rocm wheel families bundle ROCm libraries whose Tensile kernels
+        # dropped gfx906 (rocBLAS "TensileLibrary.dat ... not read for gfx906",
+        # ROCm/TheRock#1844), so a rocm6.4+/7.x index installs a torch that fails
+        # at the first BLAS call. The rocm6.3 index is the last one whose wheels
+        # run on gfx906 (torch 2.7.0 verified on MI50 32GB; up to 2.9 in community
+        # use). Reroute any newer picked index; leave rocm6.0-6.3 alone.
+        #
+        # Target resolution: an explicit UNSLOTH_ROCM_GFX_ARCH wins (lets a host
+        # whose rocminfo/amd-smi emit no gfx token still opt in; _gfx906_env was
+        # lowercased above, before the Strix block it suppresses). Otherwise only
+        # treat gfx906 as the target when it is the SOLE distinct arch present:
+        # _gfx_all is de-duplicated by visible index, which loses per-device
+        # ordinals on a mixed host, so a non-gfx906 selection must never be
+        # downgraded to rocm6.3 -- such hosts set UNSLOTH_ROCM_GFX_ARCH to opt in.
+        _gfx906_target=false
+        if [ -n "$_gfx906_env" ]; then
+            [ "$_gfx906_env" = "gfx906" ] && _gfx906_target=true
+        elif [ -n "$_gfx_all" ]; then
+            _gfx906_uniq=$(printf '%s\n' "$_gfx_all" | awk 'NF && !seen[$0]++')
+            [ "$_gfx906_uniq" = "gfx906" ] && _gfx906_target=true
+        fi
+        # gfx906 always trains from the PyTorch rocm6.3 wheels, never the Radeon repo
+        # (repo.radeon.com wheels carry no gfx906 BLAS kernels). Clear the Radeon
+        # marketing-name flag as soon as gfx906 is the target -- even when the host
+        # already picks rocm6.0-6.3 and the reroute below is a no-op -- so a Radeon VII
+        # does not divert to the radeon branch on those versions.
+        if [ "$_gfx906_target" = true ]; then
+            _amd_gpu_radeon=false
+        fi
+        if [ "$_gfx906_target" = true ] && ! _rocm_leaf_below "$_torch_index_leaf" 6 4; then
+            echo "" >&2
+            echo "  [WARN] gfx906 (MI50 / Radeon VII / Vega 20) detected -- routing torch to the" >&2
+            echo "  [WARN] rocm6.3 index: it is the last wheel family that runs on gfx906 (newer" >&2
+            echo "  [WARN] rocm wheels ship without gfx906 BLAS kernels and fail at first use)." >&2
+            echo "  [WARN] gfx906 is a community-maintained legacy path: 16-bit LoRA and full" >&2
+            echo "  [WARN] finetuning work out of the box; bitsandbytes 4-bit QLoRA requires a" >&2
+            echo "  [WARN] source build of bitsandbytes for gfx906 (see docs.unsloth.ai/amd)." >&2
+            echo "" >&2
+            _amd_gfx906_base="${UNSLOTH_PYTORCH_MIRROR:-https://download.pytorch.org/whl}"
+            while [ "${_amd_gfx906_base%/}" != "$_amd_gfx906_base" ]; do
+                _amd_gfx906_base="${_amd_gfx906_base%/}"
+            done
+            TORCH_INDEX_URL="${_amd_gfx906_base}/rocm6.3"
+            # Reset to the default (<2.11) window: a rocm7.2 pick raised the floor
+            # to 2.11 above, which the rocm6.3 index (torch <= 2.9.x) cannot satisfy.
+            TORCH_CONSTRAINT="torch>=2.4,<2.11.0"
+            TORCHVISION_CONSTRAINT="torchvision>=0.19,<0.26.0"
+            TORCHAUDIO_CONSTRAINT="torchaudio>=2.4,<2.11.0"
+            # (_amd_gpu_radeon already cleared above for every gfx906 target.)
+        fi
         ;;
 esac
 fi  # _torch_index_pinned guard (Radeon + Strix reroute)
@@ -3553,6 +3706,7 @@ for _p in ('torch', 'torchvision', 'torchaudio'):
 if [ "$_MIGRATED" = true ]; then
     # Migrated env: force-reinstall unsloth+unsloth-zoo for a clean state, preserving
     # existing torch/CUDA unless the ROCm repair below fires.
+    _gfx906_bnb_snapshot
     substep "upgrading unsloth in migrated environment..."
     if [ "$SKIP_TORCH" = true ]; then
         # No-torch: install unsloth + unsloth-zoo with --no-deps (current
@@ -3594,13 +3748,18 @@ if [ "$_MIGRATED" = true ]; then
     # existing ROCm installs gain the AMD bitsandbytes build without a
     # fresh reinstall.
     if [ "$SKIP_TORCH" = false ] && [ "$_torch_index_is_rocm_family" = true ]; then
-        _install_bnb_rocm "install bitsandbytes (AMD)" "$_VENV_PY"
+        if _is_gfx906_bnb_skip; then
+            substep "gfx906: skipping prebuilt bitsandbytes (no gfx906 kernels); build from source for 4-bit QLoRA -- https://docs.unsloth.ai/get-started/install-and-update/amd" "$C_WARN"
+        else
+            _install_bnb_rocm "install bitsandbytes (AMD)" "$_VENV_PY"
+        fi
         # Repair ROCm torch if overwritten during migrated install
         _has_hip=$("$_VENV_PY" -c "import torch; print(getattr(torch.version,'hip','') or '')" 2>/dev/null || true)
         if [ -z "$_has_hip" ]; then
             substep "repairing ROCm torch (overwritten by dependency resolution)..."
             _install_torch_default_index --force-reinstall
         fi
+        _gfx906_bnb_prune
     fi
 elif [ -n "$TORCH_INDEX_URL" ]; then
     # Fresh: Step 1 - install torch from explicit index (skip when --no-torch or Intel Mac)
@@ -3791,8 +3950,13 @@ elif [ -n "$TORCH_INDEX_URL" ]; then
     # host stays in GGUF-only mode rather than pulling in bitsandbytes,
     # which is only useful once torch is present for training.
     if [ "$SKIP_TORCH" = false ] && [ "$_torch_index_is_rocm_family" = true ]; then
-        _install_bnb_rocm "install bitsandbytes (AMD)" "$_VENV_PY"
+        if _is_gfx906_bnb_skip; then
+            substep "gfx906: skipping prebuilt bitsandbytes (no gfx906 kernels); build from source for 4-bit QLoRA -- https://docs.unsloth.ai/get-started/install-and-update/amd" "$C_WARN"
+        else
+            _install_bnb_rocm "install bitsandbytes (AMD)" "$_VENV_PY"
+        fi
     fi
+    _gfx906_bnb_snapshot
     # Fresh: Step 2 - install unsloth, preserving the torch Step 1 installed
     tauri_log "STEP" "Installing Unsloth"
     substep "installing unsloth (this may take a few minutes)..."
@@ -3843,6 +4007,7 @@ elif [ -n "$TORCH_INDEX_URL" ]; then
             substep "repairing ROCm torch (overwritten by dependency resolution)..."
             _install_torch_default_index --force-reinstall
         fi
+        _gfx906_bnb_prune
     fi
 else
     # Fallback: GPU detection failed to produce a URL -- let uv resolve torch
@@ -3937,6 +4102,7 @@ if [ -n "$VENV_ABS_BIN" ]; then
 fi
 
 if ! command -v bash >/dev/null 2>&1; then
+    tauri_log "ERROR" "bash is required to run studio setup"
     step "setup" "bash is required to run studio setup" "$C_ERR"
     substep "Please install bash and re-run install.sh"
     exit 1
@@ -3975,6 +4141,7 @@ if [ "$STUDIO_LOCAL_INSTALL" = true ]; then
     STUDIO_LOCAL_REPO="$_REPO_ROOT" \
     UNSLOTH_NO_TORCH="$SKIP_TORCH" \
     UNSLOTH_LOCAL_LLAMA_CPP_DIR="$_WITH_LLAMA_CPP_DIR" \
+    UNSLOTH_TAURI_MODE="$TAURI_MODE" \
     bash "$SETUP_SH" </dev/null || _SETUP_EXIT=$?
 else
     # Explicitly reset STUDIO_LOCAL_INSTALL / STUDIO_LOCAL_REPO so a stale
@@ -3990,9 +4157,14 @@ else
     STUDIO_LOCAL_REPO= \
     UNSLOTH_NO_TORCH="$SKIP_TORCH" \
     UNSLOTH_LOCAL_LLAMA_CPP_DIR="$_WITH_LLAMA_CPP_DIR" \
+    UNSLOTH_TAURI_MODE="$TAURI_MODE" \
     bash "$SETUP_SH" </dev/null || _SETUP_EXIT=$?
 fi
 
+if [ "$_SETUP_EXIT" -eq 0 ]; then
+    tauri_clear_install_error "studio setup completed"
+fi
+
 # ── Make 'unsloth' available via $_LOCAL_BIN (resolved earlier) ──
 # Env-mode: $_LOCAL_BIN is $STUDIO_HOME/bin; skip shell-rc PATH append so we
 # don't pollute the user's profile with a workspace-scoped path.
@@ -4048,7 +4220,11 @@ fi
 # PATH and shortcuts are already set up so the user can fix and retry.
 if [ "$_SETUP_EXIT" -ne 0 ]; then
     echo ""
-    step "error" "studio setup failed (exit code $_SETUP_EXIT)" "$C_ERR"
+    if [ "$TAURI_MODE" = true ]; then
+        tauri_log "ERROR_DEFAULT" "studio setup failed (exit code $_SETUP_EXIT)"
+    else
+        step "error" "studio setup failed (exit code $_SETUP_EXIT)" "$C_ERR"
+    fi
     echo ""
     exit "$_SETUP_EXIT"
 fi
diff --git a/pyproject.toml b/pyproject.toml
index 0f57ecf4df..62623499d6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -30,6 +30,12 @@ dependencies = [
     "pydantic",
     "pyyaml",
     "nest-asyncio",
+    # Every CLI command imports studio.backend.*, which reaches structlog at
+    # module level. The rest of the server stack lives in the studio extra.
+    "structlog>=24.1.0",
+    # unsloth_cli/__init__.py reaches click via commands/start.py, so every
+    # command needs it. typer supplied it until 0.27 dropped the dependency.
+    "click>=8.0",
 ]
 
 [project.scripts]
@@ -68,6 +74,33 @@ include = ["unsloth*", "unsloth_cli*", "studio", "studio.backend*"]
 exclude = ["images*", "tests*", "*.node_modules", "*.node_modules.*"]
 
 [project.optional-dependencies]
+# Studio's server stack, mirroring studio/backend/requirements/studio.txt.
+# test_studio_extra_matches_requirements.py catches drift.
+studio = [
+    "typer",
+    "fastapi",
+    "uvicorn",
+    "pydantic",
+    "packaging",
+    "matplotlib==3.10.9",
+    "pandas",
+    "nest_asyncio",
+    "datasets==4.3.0",
+    "pyjwt",
+    "huggingface-hub==0.36.2",
+    "structlog>=24.1.0",
+    "diceware",
+    "ddgs",
+    "cryptography>=42.0.0",
+    "boto3>=1.34.0",
+    "httpx>=0.27.0",
+    "fastmcp>=3.0.2",
+    "sqlite-vec==0.1.9",
+    "pymupdf==1.27.2.3",
+    "pymupdf4llm==0.3.4",
+    "python-docx==1.2.0",
+]
+
 triton = [
     "triton>=3.0.0 ; ('linux' in sys_platform)",
     "triton-windows ; (sys_platform == 'win32') and (platform_machine == 'AMD64' or platform_machine == 'x86_64')",
diff --git a/studio/backend/auth/authentication.py b/studio/backend/auth/authentication.py
index dfb8fc513e..94df994928 100644
--- a/studio/backend/auth/authentication.py
+++ b/studio/backend/auth/authentication.py
@@ -164,6 +164,21 @@ async def get_current_subject_allow_password_change(
     )
 
 
+# The literal the examples ship with; pasted unedited more often than a revoked key.
+API_KEY_PLACEHOLDER = f"{API_KEY_PREFIX}YOUR_KEY"
+
+
+def _invalid_api_key_detail(token: str) -> str:
+    """Why the key failed. Only the example placeholder is called out; every real
+    key gets one indistinguishable message, so this leaks no key existence."""
+    if token == API_KEY_PLACEHOLDER:
+        return (
+            "This is the placeholder key from the example. Create an API key in "
+            f"Unsloth Studio under Settings > API and use it in place of {API_KEY_PLACEHOLDER}."
+        )
+    return "Invalid or expired API key"
+
+
 async def _get_current_subject(
     credentials: HTTPAuthorizationCredentials, *, allow_password_change: bool
 ) -> str:
@@ -176,7 +191,7 @@ async def _get_current_subject(
         if username is None:
             raise HTTPException(
                 status_code = status.HTTP_401_UNAUTHORIZED,
-                detail = "Invalid or expired API key",
+                detail = _invalid_api_key_detail(token),
             )
         return username
 
diff --git a/studio/backend/core/inference/_vulkan_probe.py b/studio/backend/core/inference/_vulkan_probe.py
index 706346daad..4bfefc21ce 100644
--- a/studio/backend/core/inference/_vulkan_probe.py
+++ b/studio/backend/core/inference/_vulkan_probe.py
@@ -6,12 +6,14 @@
 Run in a short-lived subprocess (``python _vulkan_probe.py <bindir>``) so the
 Vulkan instance never lives in the long-running backend process. Loads the
 bundled ggml Vulkan backend from ``<bindir>`` and prints one
-``<idx>\\t<free_bytes>\\t<is_igpu>\\t<total_bytes>`` line per device to stdout.
-Indices are ggml's own Vulkan device ordinals, which need not match nvidia-smi
-order. ``is_igpu`` (from ggml's device type) is ``1`` for an integrated GPU
-sharing system RAM. ``total_bytes`` is the device-local heap; the reader uses
-it to reserve absolute headroom on a discrete card (parity with the CUDA/ROCm
-fit) and ignores it for an iGPU, whose "VRAM" is shared system RAM.
+``<idx>\\t<free_bytes>\\t<is_igpu>\\t<total_bytes>\\t<name>`` line per device to
+stdout. Indices are ggml's own Vulkan device ordinals, which need not match
+nvidia-smi order. ``is_igpu`` (from ggml's device type) is ``1`` for an
+integrated GPU sharing system RAM. ``total_bytes`` is the device-local heap;
+the reader uses it to reserve absolute headroom on a discrete card (parity
+with the CUDA/ROCm fit) and ignores it for an iGPU, whose "VRAM" is shared
+system RAM. ``name`` is ggml's device description (the marketing name, e.g.
+"AMD Radeon RX 9070 XT"); empty when the registry lookup fails.
 
 Uses only the standard library so it stays runnable as a bare script.
 """
@@ -24,15 +26,30 @@ import sys
 _GGML_BACKEND_DEVICE_TYPE_IGPU = 2
 
 
-def _igpu_flags(base, lib, count: int) -> list[bool]:
-    """Per-device integrated-GPU flags via ggml's backend registry.
+def _igpu_flags_and_names(base, lib, count: int) -> tuple[list[bool], list[str]]:
+    """Per-device integrated-GPU flags and descriptions via ggml's backend registry.
 
     The Vulkan reg enumerates devices in the same order as
     ``ggml_backend_vk_get_device_memory`` (each context uses ``ctx->device =
-    i``), so reg index == device ordinal. Returns all-False on any failure so
-    the reader never over-caps a discrete card.
+    i``), so reg index == device ordinal. Returns all-False / empty-name on any
+    failure so the reader never over-caps a discrete card and the memory
+    readings still get through.
     """
     flags = [False] * count
+    names = [""] * count
+
+    # The name lookup is bound OUTSIDE the type-detection try: a ggml-base
+    # without ggml_backend_dev_description (older/custom build) must degrade to
+    # unnamed devices, not abort before the iGPU flags are read (which would
+    # count an iGPU's shared RAM as VRAM).
+    describe = None
+    try:
+        base.ggml_backend_dev_description.restype = ctypes.c_char_p
+        base.ggml_backend_dev_description.argtypes = [ctypes.c_void_p]
+        describe = base.ggml_backend_dev_description
+    except Exception:
+        pass
+
     try:
         lib.ggml_backend_vk_reg.restype = ctypes.c_void_p
         lib.ggml_backend_vk_reg.argtypes = []
@@ -45,17 +62,31 @@ def _igpu_flags(base, lib, count: int) -> list[bool]:
 
         reg = lib.ggml_backend_vk_reg()
         if not reg:
-            return flags
+            return flags, names
         dev_count = base.ggml_backend_reg_dev_count(reg)
         for i in range(min(count, dev_count)):
             dev = base.ggml_backend_reg_dev_get(reg, i)
             if dev:
                 flags[i] = base.ggml_backend_dev_type(dev) == _GGML_BACKEND_DEVICE_TYPE_IGPU
+                if describe is not None:
+                    try:
+                        desc = describe(dev)
+                        if desc:
+                            # Tabs/newlines would corrupt the line protocol;
+                            # spaces are safe.
+                            names[i] = (
+                                desc.decode("utf-8", errors = "replace")
+                                .replace("\t", " ")
+                                .replace("\n", " ")
+                                .strip()
+                            )
+                    except Exception:
+                        pass
     except Exception:
-        # Best-effort: any failure degrades to "discrete" so the memory
-        # readings still get through instead of crashing the probe.
+        # Best-effort: any failure degrades to "discrete"/"unnamed" so the
+        # memory readings still get through instead of crashing the probe.
         pass
-    return flags
+    return flags, names
 
 
 def main() -> int:
@@ -63,6 +94,14 @@ def main() -> int:
         return 0
     bindir = sys.argv[1]
 
+    # Device names can be non-ASCII (localized drivers); the platform-default
+    # stdout encoding (e.g. cp1252) would raise on them and lose the whole
+    # inventory. The reader decodes UTF-8 with the same error mode.
+    try:
+        sys.stdout.reconfigure(encoding = "utf-8", errors = "replace")
+    except Exception:
+        pass
+
     # Hold add_dll_directory's handle for the rest of main() (the documented
     # idiom) so bindir stays on the search path while the sibling ggml DLLs
     # resolve below.
@@ -96,12 +135,12 @@ def main() -> int:
     ]
 
     count = lib.ggml_backend_vk_get_device_count()
-    igpu = _igpu_flags(base, lib, count)
+    igpu, names = _igpu_flags_and_names(base, lib, count)
     rows = []
     for i in range(count):
         free, total = ctypes.c_size_t(0), ctypes.c_size_t(0)
         lib.ggml_backend_vk_get_device_memory(i, ctypes.byref(free), ctypes.byref(total))
-        rows.append("%d\t%d\t%d\t%d" % (i, free.value, int(igpu[i]), total.value))
+        rows.append("%d\t%d\t%d\t%d\t%s" % (i, free.value, int(igpu[i]), total.value, names[i]))
     sys.stdout.write("\n".join(rows))
     return 0
 
diff --git a/studio/backend/core/inference/anthropic_compat.py b/studio/backend/core/inference/anthropic_compat.py
index 34445cc58e..a32e372d73 100644
--- a/studio/backend/core/inference/anthropic_compat.py
+++ b/studio/backend/core/inference/anthropic_compat.py
@@ -172,6 +172,136 @@ def anthropic_messages_to_openai(
     return result
 
 
+_ANTHROPIC_SCHEMA_CLIENT_TOOL_PARAMETERS = {
+    "bash": {
+        "type": "object",
+        "properties": {
+            "command": {"type": "string"},
+            "restart": {"type": "boolean"},
+        },
+        "anyOf": [
+            {"required": ["command"]},
+            {"properties": {"restart": {"const": True}}, "required": ["restart"]},
+        ],
+    },
+    "text_editor": {
+        "type": "object",
+        "properties": {
+            "command": {
+                "type": "string",
+                "enum": ["view", "str_replace", "create", "insert"],
+            },
+            "path": {"type": "string"},
+            "view_range": {
+                "type": "array",
+                "items": {"type": "integer"},
+                "minItems": 2,
+                "maxItems": 2,
+            },
+            "old_str": {"type": "string"},
+            "new_str": {"type": "string"},
+            "file_text": {"type": "string"},
+            "insert_line": {"type": "integer"},
+            "insert_text": {"type": "string"},
+        },
+        "required": ["command", "path"],
+    },
+    "computer": {
+        "type": "object",
+        "properties": {
+            "action": {"type": "string"},
+            "coordinate": {
+                "type": "array",
+                "items": {"type": "integer"},
+                "minItems": 2,
+                "maxItems": 2,
+            },
+            "text": {"type": "string"},
+            "duration": {"type": "number"},
+            "scroll_direction": {"type": "string"},
+            "scroll_amount": {"type": "integer"},
+            "start_coordinate": {
+                "type": "array",
+                "items": {"type": "integer"},
+                "minItems": 2,
+                "maxItems": 2,
+            },
+            "key": {"type": "string"},
+        },
+        "required": ["action"],
+        "additionalProperties": True,
+    },
+    "memory": {
+        "type": "object",
+        "properties": {
+            "command": {
+                "type": "string",
+                "enum": ["view", "create", "str_replace", "insert", "delete", "rename"],
+            },
+            "path": {"type": "string"},
+            "view_range": {
+                "type": "array",
+                "items": {"type": "integer"},
+                "minItems": 2,
+                "maxItems": 2,
+            },
+            "file_text": {"type": "string"},
+            "old_str": {"type": "string"},
+            "new_str": {"type": "string"},
+            "insert_line": {"type": "integer"},
+            "insert_text": {"type": "string"},
+            "old_path": {"type": "string"},
+            "new_path": {"type": "string"},
+        },
+        "required": ["command"],
+    },
+}
+
+_ANTHROPIC_SCHEMA_CLIENT_TOOL_DESCRIPTIONS = {
+    "bash": "Run a command in the caller-owned persistent bash session, or restart it.",
+    "text_editor": "View, create, or edit files in the caller-owned filesystem.",
+    "computer": "Interact with the caller-owned computer using an action and its parameters.",
+    "memory": "Store and retrieve files in the caller-owned persistent memory directory.",
+}
+
+
+def anthropic_schema_client_tool_kind(tool) -> Optional[str]:
+    """Return the kind of a schema-less Anthropic client tool, if recognized."""
+    td = tool if isinstance(tool, dict) else tool.model_dump()
+    if td.get("input_schema") is not None:
+        return None
+    type_ = td.get("type")
+    if not isinstance(type_, str):
+        return None
+    kind, separator, version = type_.rpartition("_")
+    if (
+        separator
+        and kind in _ANTHROPIC_SCHEMA_CLIENT_TOOL_PARAMETERS
+        and len(version) == 8
+        and version.isdigit()
+    ):
+        return kind
+    return None
+
+
+def _anthropic_schema_client_tool_parameters(td: dict, kind: str) -> dict:
+    parameters = _ANTHROPIC_SCHEMA_CLIENT_TOOL_PARAMETERS[kind]
+    if kind != "text_editor":
+        return parameters
+
+    version = td["type"].rpartition("_")[2]
+    commands = list(parameters["properties"]["command"]["enum"])
+    if version < "20250429":
+        commands.append("undo_edit")
+    return {
+        **parameters,
+        "properties": {
+            **parameters["properties"],
+            "command": {**parameters["properties"]["command"], "enum": commands},
+        },
+    }
+
+
 def anthropic_tools_to_openai(tools: list) -> list[dict]:
     """Convert Anthropic client tools to OpenAI function-tool format."""
     result = []
@@ -179,6 +309,9 @@ def anthropic_tools_to_openai(tools: list) -> list[dict]:
         td = t if isinstance(t, dict) else t.model_dump()
         name = td.get("name")
         input_schema = td.get("input_schema")
+        schema_client_kind = anthropic_schema_client_tool_kind(td)
+        if schema_client_kind is not None:
+            input_schema = _anthropic_schema_client_tool_parameters(td, schema_client_kind)
         if not name or input_schema is None:
             continue
         result.append(
@@ -186,7 +319,8 @@ def anthropic_tools_to_openai(tools: list) -> list[dict]:
                 "type": "function",
                 "function": {
                     "name": name,
-                    "description": td.get("description", ""),
+                    "description": td.get("description")
+                    or _ANTHROPIC_SCHEMA_CLIENT_TOOL_DESCRIPTIONS.get(schema_client_kind, ""),
                     "parameters": input_schema,
                 },
             }
diff --git a/studio/backend/core/inference/api_monitor.py b/studio/backend/core/inference/api_monitor.py
index f76a38576f..b637ba56d1 100644
--- a/studio/backend/core/inference/api_monitor.py
+++ b/studio/backend/core/inference/api_monitor.py
@@ -5,6 +5,7 @@
 
 from __future__ import annotations
 
+import os
 import threading
 import time
 import uuid
@@ -18,6 +19,14 @@ _MAX_PROMPT_CHARS = 12000
 _MAX_REPLY_CHARS = 12000
 _PREVIEW_CHARS = 360
 
+# Opt-in startup kill switch for Studio's in-memory API monitor.
+_DISABLE_ENV = "UNSLOTH_STUDIO_DISABLE_API_MONITOR"
+_TRUE_VALUES = frozenset({"1", "true", "yes", "on"})
+
+
+def _api_monitor_disabled() -> bool:
+    return os.environ.get(_DISABLE_ENV, "").strip().lower() in _TRUE_VALUES
+
 
 def _trim(text: Optional[str], limit: int) -> str:
     if not text:
@@ -52,6 +61,13 @@ class ApiMonitorEntry:
     total_tokens: Optional[int] = None
     total_tokens_authoritative: bool = False
     error: Optional[str] = None
+    # "request" (HTTP call) or "lifecycle" (model load/unload: event/reason, not a prompt; shared).
+    kind: str = "request"
+    event: Optional[str] = None
+    reason: Optional[str] = None
+    shared: bool = False
+    # 0-100 for a running download row; None when not applicable.
+    progress: Optional[float] = None
 
     def snapshot(self, *, include_details: bool = True) -> dict[str, Any]:
         duration_ms = None
@@ -85,6 +101,10 @@ class ApiMonitorEntry:
             "completion_tokens": self.completion_tokens,
             "total_tokens": self.total_tokens,
             "error": self.error,
+            "kind": self.kind,
+            "event": self.event,
+            "reason": self.reason,
+            "progress": self.progress,
         }
         if include_details:
             payload["prompt"] = self.prompt
@@ -93,10 +113,16 @@ class ApiMonitorEntry:
 
 
 class ApiMonitor:
-    def __init__(self, max_entries: int = _MAX_ENTRIES):
+    def __init__(
+        self,
+        max_entries: int = _MAX_ENTRIES,
+        *,
+        enabled: bool = True,
+    ):
         self._entries: deque[ApiMonitorEntry] = deque()
         self._max_entries = max(0, max_entries)
         self._lock = threading.Lock()
+        self._enabled = enabled
 
     def start(
         self,
@@ -108,6 +134,8 @@ class ApiMonitor:
         context_length: Optional[int] = None,
         subject: Optional[str] = None,
     ) -> str:
+        if not self._enabled:
+            return ""
         now = time.time()
         entry = ApiMonitorEntry(
             id = f"apireq_{uuid.uuid4().hex[:12]}",
@@ -127,6 +155,75 @@ class ApiMonitor:
             self._trim_terminal_locked()
         return entry.id
 
+    def record_lifecycle(
+        self,
+        *,
+        event: str,
+        model: str,
+        reason: Optional[str] = None,
+        running: bool = False,
+    ) -> str:
+        """Record a model load/unload alongside the request traffic that caused it.
+
+        ``running=True`` opens the row for the caller to close with :meth:`finish` /
+        :meth:`fail`; an unload is terminal on arrival. Rows are shared (visible to
+        every subject) and share the request retention budget.
+        """
+        if not self._enabled:
+            return ""
+        now = time.time()
+        entry = ApiMonitorEntry(
+            id = f"apievt_{uuid.uuid4().hex[:12]}",
+            endpoint = f"model.{event}",
+            method = "",
+            model = model or "default",
+            prompt = "",
+            status = "running" if running else "completed",
+            started_at = now,
+            updated_at = now,
+            started_monotonic = time.monotonic(),
+            finished_at = None if running else now,
+            finished_monotonic = None if running else time.monotonic(),
+            kind = "lifecycle",
+            event = event,
+            reason = reason,
+            shared = True,
+        )
+        with self._lock:
+            self._entries.appendleft(entry)
+            self._trim_terminal_locked()
+        return entry.id
+
+    def relabel(self, entry_id: Optional[str], model: str) -> None:
+        """Rename an open lifecycle row once the load resolves its real id: up front
+        the caller only has the load path, which may be an HF snapshot dir."""
+        if not entry_id or not model:
+            return
+        with self._lock:
+            entry = self._find_locked(entry_id)
+            if entry is not None:
+                entry.model = model
+                entry.updated_at = time.time()
+
+    def set_progress(self, entry_id: Optional[str], progress: Optional[float]) -> None:
+        """Update an open download row's percentage (clamped to 0-100)."""
+        if not entry_id or progress is None:
+            return
+        with self._lock:
+            entry = self._find_locked(entry_id)
+            if entry is not None and entry.status == "running":
+                entry.progress = min(100.0, max(0.0, float(progress)))
+                entry.updated_at = time.time()
+
+    def discard(self, entry_id: Optional[str]) -> None:
+        """Drop a row that turned out not to be an event (an already-satisfied load)."""
+        if not entry_id:
+            return
+        with self._lock:
+            entry = self._find_locked(entry_id)
+            if entry is not None:
+                self._entries.remove(entry)
+
     def append_reply(self, entry_id: Optional[str], text: str) -> None:
         if not entry_id or not text:
             return
@@ -212,6 +309,18 @@ class ApiMonitor:
             self._entries.appendleft(entry)
             self._trim_terminal_locked()
 
+    def fail_open(self, entry_id: Optional[str], error: str) -> None:
+        """Fail only a still-open row: unlike :meth:`fail`, a catch-all in a
+        ``finally`` cannot stamp an error onto a request that already succeeded."""
+        if not entry_id:
+            return
+        with self._lock:
+            entry = self._find_locked(entry_id)
+            if entry is None or entry.finished_at is not None:
+                return
+            # Same lock as the check, so a finish() cannot land in between.
+            self._fail_locked(entry, error)
+
     def fail(self, entry_id: Optional[str], error: str) -> None:
         if not entry_id:
             return
@@ -224,15 +333,18 @@ class ApiMonitor:
                 if error:
                     entry.error = _trim(error, 1000)
                 return
-            now = time.time()
-            entry.status = "error"
-            entry.error = _trim(error, 1000)
-            entry.updated_at = now
-            entry.finished_at = now
-            entry.finished_monotonic = time.monotonic()
-            self._entries.remove(entry)
-            self._entries.appendleft(entry)
-            self._trim_terminal_locked()
+            self._fail_locked(entry, error)
+
+    def _fail_locked(self, entry: ApiMonitorEntry, error: str) -> None:
+        now = time.time()
+        entry.status = "error"
+        entry.error = _trim(error, 1000)
+        entry.updated_at = now
+        entry.finished_at = now
+        entry.finished_monotonic = time.monotonic()
+        self._entries.remove(entry)
+        self._entries.appendleft(entry)
+        self._trim_terminal_locked()
 
     def snapshot(
         self,
@@ -244,7 +356,7 @@ class ApiMonitor:
             return [
                 entry.snapshot(include_details = include_details)
                 for entry in self._entries
-                if subject is None or entry.subject == subject
+                if self._visible(entry, subject)
             ]
 
     def get(
@@ -257,22 +369,29 @@ class ApiMonitor:
             entry = self._find_locked(entry_id)
             if entry is None:
                 return None
-            if subject is not None and entry.subject != subject:
+            if not self._visible(entry, subject):
                 return None
             return entry.snapshot(include_details = True)
 
     def active_count(self, *, subject: Optional[str] = None) -> int:
+        # Lifecycle rows show as "running" while loading but are not in-flight API requests.
         with self._lock:
             return sum(
                 1
                 for entry in self._entries
-                if entry.status == "running" and (subject is None or entry.subject == subject)
+                if entry.status == "running"
+                and entry.kind != "lifecycle"
+                and (subject is None or entry.subject == subject)
             )
 
     def clear(self) -> None:
         with self._lock:
             self._entries.clear()
 
+    @staticmethod
+    def _visible(entry: ApiMonitorEntry, subject: Optional[str]) -> bool:
+        return subject is None or entry.subject == subject or entry.shared
+
     def _find_locked(self, entry_id: str) -> Optional[ApiMonitorEntry]:
         for entry in self._entries:
             if entry.id == entry_id:
@@ -292,4 +411,4 @@ class ApiMonitor:
         self._entries = kept
 
 
-api_monitor = ApiMonitor()
+api_monitor = ApiMonitor(enabled = not _api_monitor_disabled())
diff --git a/studio/backend/core/inference/chat_template_helpers.py b/studio/backend/core/inference/chat_template_helpers.py
index 528c059fbc..3a8463855b 100644
--- a/studio/backend/core/inference/chat_template_helpers.py
+++ b/studio/backend/core/inference/chat_template_helpers.py
@@ -326,6 +326,58 @@ def _normalize_tool_call_arguments(messages: list) -> list:
     return out if mutated else messages
 
 
+def _take_tool_result(pending: list, call_id) -> Optional[dict]:
+    if call_id:
+        for i, result in enumerate(pending):
+            if result.get("tool_call_id") == call_id:
+                return pending.pop(i)
+    for i, result in enumerate(pending):
+        if not result.get("tool_call_id"):
+            return pending.pop(i)
+    return None
+
+
+def _split_parallel_tool_calls(messages: list) -> list:
+    """Llama 3.x templates render one call per message, so split parallel calls
+    into consecutive single-call messages, each followed by its own result."""
+    if not any(isinstance(m, dict) and len(m.get("tool_calls") or ()) > 1 for m in messages):
+        return messages
+
+    out: list = []
+    i = 0
+    total = len(messages)
+    while i < total:
+        msg = messages[i]
+        calls = msg.get("tool_calls") if isinstance(msg, dict) else None
+        if not calls or len(calls) <= 1:
+            out.append(msg)
+            i += 1
+            continue
+
+        # Tool results right after this message answer its calls.
+        j = i + 1
+        pending: list = []
+        while (
+            j < total
+            and isinstance(messages[j], dict)
+            and messages[j].get("role") in ("tool", "ipython")
+        ):
+            pending.append(messages[j])
+            j += 1
+
+        for idx, call in enumerate(calls):
+            piece = {**msg, "tool_calls": [call]}
+            if idx:
+                piece["content"] = ""
+            out.append(piece)
+            result = _take_tool_result(pending, call.get("id") if isinstance(call, dict) else None)
+            if result is not None:
+                out.append(result)
+        out.extend(pending)
+        i = j
+    return out
+
+
 def apply_chat_template_for_generation(
     tokenizer,
     messages: list,
@@ -378,13 +430,21 @@ def apply_chat_template_for_generation(
     try:
         return _render(messages)
     except Exception:
-        # Strict tool templates reject the JSON-string ``arguments`` form via
-        # TypeError or a broad Jinja raise_exception, so retry with dicts coerced.
-        # Original messages render first, so working templates stay byte-identical.
+        # Retry with repairs applied cumulatively. Originals render first, so
+        # working templates stay byte-identical.
+        candidates: list = []
         normalized = _normalize_tool_call_arguments(messages)
-        if normalized is messages:
-            raise
-        return _render(normalized)
+        if normalized is not messages:
+            candidates.append(normalized)
+        split = _split_parallel_tool_calls(normalized)
+        if split is not normalized:
+            candidates.append(split)
+        for candidate in candidates:
+            try:
+                return _render(candidate)
+            except Exception:
+                continue
+        raise
 
 
 def render_native_template(
diff --git a/studio/backend/core/inference/inference.py b/studio/backend/core/inference/inference.py
index 563a6732a1..0af37e627f 100644
--- a/studio/backend/core/inference/inference.py
+++ b/studio/backend/core/inference/inference.py
@@ -2281,8 +2281,13 @@ class InferenceBackend:
         except Exception as e:
             logger.warning(f"Could not fully reset model state for {model_name}: {e}")
 
-    def reset_generation_state(self):
-        """Reset any cached generation state to prevent hanging after errors"""
+    def reset_generation_state(self, caller_cancel_event = None):
+        """Reset any cached generation state to prevent hanging after errors
+
+        ``caller_cancel_event`` is accepted for signature parity with the
+        orchestrator, which uses it to drop a reset from a request that never
+        started. Nothing here cancels a live generation, so it is unused.
+        """
         try:
             # Clear cached state for ALL loaded models
             for model_name in self.models.keys():
diff --git a/studio/backend/core/inference/llama_admission.py b/studio/backend/core/inference/llama_admission.py
index b6a939c87b..db9a5d8ce4 100644
--- a/studio/backend/core/inference/llama_admission.py
+++ b/studio/backend/core/inference/llama_admission.py
@@ -13,37 +13,85 @@ from __future__ import annotations
 
 import asyncio
 import os
+import sys
 import threading
 from collections import deque
 from dataclasses import dataclass
 from typing import Deque, Optional
 
 
-ADMISSION_CONTROL_ENV = "UNSLOTH_OPENAI_COMPAT_ADMISSION_CONTROL"
-ADMISSION_QUEUE_TIMEOUT_ENV = "UNSLOTH_OPENAI_COMPAT_ADMISSION_QUEUE_TIMEOUT"
-ADMISSION_KEEPALIVE_INTERVAL_ENV = "UNSLOTH_OPENAI_COMPAT_ADMISSION_KEEPALIVE_INTERVAL"
-ADMISSION_MAX_QUEUE_ENV = "UNSLOTH_OPENAI_COMPAT_ADMISSION_MAX_QUEUE"
+# dataclass(slots = True) halves per-instance overhead. Measured as perf-neutral
+# here, not a speed win: it costs a little on construction and gains it back on
+# access. It is 3.10+ and this package declares >=3.9, so gate it rather than
+# dropping it outright. Empty on 3.9 means a plain dataclass.
+_SLOTS = {"slots": True} if sys.version_info >= (3, 10) else {}
+
+
+ADMISSION_CONTROL_ENV = "UNSLOTH_LLAMA_ADMISSION_CONTROL"
+ADMISSION_QUEUE_TIMEOUT_ENV = "UNSLOTH_LLAMA_ADMISSION_QUEUE_TIMEOUT"
+ADMISSION_KEEPALIVE_INTERVAL_ENV = "UNSLOTH_LLAMA_ADMISSION_KEEPALIVE_INTERVAL"
+ADMISSION_MAX_QUEUE_ENV = "UNSLOTH_LLAMA_ADMISSION_MAX_QUEUE"
+ADMISSION_QUEUE_PER_SLOT_ENV = "UNSLOTH_LLAMA_ADMISSION_QUEUE_PER_SLOT"
+
+# The UNSLOTH_OPENAI_COMPAT_* spellings predate this queue being shared with the
+# Anthropic /v1/messages route (same llama-server slots). Still honored; the
+# neutral name above wins when both are set.
+_LEGACY_ENV = {
+    ADMISSION_CONTROL_ENV: "UNSLOTH_OPENAI_COMPAT_ADMISSION_CONTROL",
+    ADMISSION_QUEUE_TIMEOUT_ENV: "UNSLOTH_OPENAI_COMPAT_ADMISSION_QUEUE_TIMEOUT",
+    ADMISSION_KEEPALIVE_INTERVAL_ENV: "UNSLOTH_OPENAI_COMPAT_ADMISSION_KEEPALIVE_INTERVAL",
+    ADMISSION_MAX_QUEUE_ENV: "UNSLOTH_OPENAI_COMPAT_ADMISSION_MAX_QUEUE",
+}
 
 DEFAULT_ADMISSION_ENABLED = True
+# None: a queued request waits for its slot indefinitely rather than timing out.
 DEFAULT_ADMISSION_QUEUE_TIMEOUT_S = None
 DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S = 5.0
-DEFAULT_ADMISSION_MAX_QUEUE = 64
+# None: no absolute cap, the wait line is sized from the pool instead.
+DEFAULT_ADMISSION_MAX_QUEUE = None
+# Wait line = 16 x the serving slots, so it tracks --parallel (4 slots -> 64
+# waiters, 8 -> 128). Purely a memory guard; waiting itself is never timed out.
+DEFAULT_ADMISSION_QUEUE_PER_SLOT = 16
+# Floor for the scaled line, so a 1-slot backend (plain `unsloth studio`, or any
+# load downshifted to fit VRAM) keeps the depth it had before scaling existed
+# rather than dropping to 16 and rejecting callers that used to queue.
+DEFAULT_ADMISSION_MIN_QUEUE = 64
 
 
-@dataclass(frozen = True)
+@dataclass(frozen = True, **_SLOTS)
 class LlamaAdmissionConfig:
     enabled: bool = DEFAULT_ADMISSION_ENABLED
     queue_timeout_s: Optional[float] = DEFAULT_ADMISSION_QUEUE_TIMEOUT_S
     keepalive_interval_s: float = DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S
     max_queue: Optional[int] = DEFAULT_ADMISSION_MAX_QUEUE
+    queue_per_slot: Optional[int] = DEFAULT_ADMISSION_QUEUE_PER_SLOT
+    # Unconditional floor on the scaled line. The env path clears it when the
+    # operator sets QUEUE_PER_SLOT, so only the default multiplier is floored.
+    min_queue: Optional[int] = DEFAULT_ADMISSION_MIN_QUEUE
+
+    def queue_limit(self, capacity: int) -> Optional[int]:
+        """How many callers may line up for a pool of ``capacity`` slots.
+
+        An explicit ``max_queue`` wins; otherwise the line scales with the slots
+        so it follows ``--parallel``. The default multiplier is floored, so a
+        1-slot backend does not end up shallower than it was before scaling. None
+        (or any non-positive setting) means an unbounded line.
+        """
+        if self.max_queue is not None:
+            return self.max_queue if self.max_queue > 0 else None
+        if not self.queue_per_slot or self.queue_per_slot <= 0:
+            return None
+        scaled = self.queue_per_slot * max(1, capacity)
+        return max(self.min_queue, scaled) if self.min_queue else scaled
 
 
-@dataclass(frozen = True)
+@dataclass(frozen = True, **_SLOTS)
 class LlamaAdmissionSnapshot:
     key: str
     capacity: int
     active: int
     queued: int
+    free: int = 0
 
 
 class LlamaAdmissionError(Exception):
@@ -69,8 +117,17 @@ class LlamaAdmissionCancelled(LlamaAdmissionError):
     pass
 
 
-def _bool_env(name: str, default: bool) -> bool:
+def _raw_env(name: str) -> Optional[str]:
+    """Value for a canonical name, falling back to its legacy spelling."""
     value = os.environ.get(name)
+    if value is None or not value.strip():
+        legacy = _LEGACY_ENV.get(name)
+        value = os.environ.get(legacy) if legacy else None
+    return value
+
+
+def _bool_env(name: str, default: bool) -> bool:
+    value = _raw_env(name)
     if value is None or not value.strip():
         return default
     value = value.strip().lower()
@@ -82,7 +139,7 @@ def _bool_env(name: str, default: bool) -> bool:
 
 
 def _optional_positive_float_env(name: str, default: Optional[float]) -> Optional[float]:
-    value = os.environ.get(name)
+    value = _raw_env(name)
     if value is None or not value.strip():
         return default
     try:
@@ -93,7 +150,7 @@ def _optional_positive_float_env(name: str, default: Optional[float]) -> Optiona
 
 
 def _positive_float_env(name: str, default: float) -> float:
-    value = os.environ.get(name)
+    value = _raw_env(name)
     if value is None or not value.strip():
         return default
     try:
@@ -103,19 +160,38 @@ def _positive_float_env(name: str, default: float) -> float:
     return parsed if parsed > 0 else default
 
 
-def _optional_positive_int_env(name: str, default: Optional[int]) -> Optional[int]:
-    value = os.environ.get(name)
-    if value is None or not value.strip():
-        return default
+def _queue_limits_from_env() -> tuple[Optional[int], Optional[int], Optional[int]]:
+    """(max_queue, queue_per_slot, min_queue) from the environment.
+
+    An absolute MAX_QUEUE wins outright; MAX_QUEUE=0 asks for an unbounded line.
+    Unset leaves the per-slot multiplier in charge (itself 0 for unbounded). The
+    floor applies only to the default multiplier: setting QUEUE_PER_SLOT means
+    the operator wants that exact depth, however shallow.
+    """
+    # Explicit means it parsed, not just that something was set: a typo falls back
+    # to the default multiplier, so it has to keep the default's floor too.
+    raw_per_slot = _raw_env(ADMISSION_QUEUE_PER_SLOT_ENV)
     try:
-        parsed = int(value.strip())
+        per_slot = int((raw_per_slot or "").strip())
     except ValueError:
-        return default
-    return parsed if parsed > 0 else None
+        per_slot, min_queue = DEFAULT_ADMISSION_QUEUE_PER_SLOT, DEFAULT_ADMISSION_MIN_QUEUE
+    else:
+        per_slot, min_queue = (per_slot if per_slot > 0 else None), None
+    raw = _raw_env(ADMISSION_MAX_QUEUE_ENV)
+    if raw is None or not raw.strip():
+        return None, per_slot, min_queue
+    try:
+        parsed = int(raw.strip())
+    except ValueError:
+        return None, per_slot, min_queue
+    return (parsed, None, None) if parsed > 0 else (None, None, None)
 
 
 def llama_admission_config_from_env() -> LlamaAdmissionConfig:
+    max_queue, queue_per_slot, min_queue = _queue_limits_from_env()
     return LlamaAdmissionConfig(
+        queue_per_slot = queue_per_slot,
+        min_queue = min_queue,
         enabled = _bool_env(ADMISSION_CONTROL_ENV, DEFAULT_ADMISSION_ENABLED),
         queue_timeout_s = _optional_positive_float_env(
             ADMISSION_QUEUE_TIMEOUT_ENV,
@@ -125,14 +201,11 @@ def llama_admission_config_from_env() -> LlamaAdmissionConfig:
             ADMISSION_KEEPALIVE_INTERVAL_ENV,
             DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S,
         ),
-        max_queue = _optional_positive_int_env(
-            ADMISSION_MAX_QUEUE_ENV,
-            DEFAULT_ADMISSION_MAX_QUEUE,
-        ),
+        max_queue = max_queue,
     )
 
 
-@dataclass
+@dataclass(**_SLOTS)
 class _Waiter:
     loop: asyncio.AbstractEventLoop
     future: asyncio.Future
@@ -141,20 +214,100 @@ class _Waiter:
 
 
 class LlamaAdmissionLease:
-    def __init__(self, queue: Optional["LlamaAdmissionQueue"]):
+    __slots__ = ("_queue", "_slot", "_released", "_release_lock", "_parked")
+
+    def __init__(
+        self,
+        queue: Optional["LlamaAdmissionQueue"],
+        slot: Optional[int] = None,
+    ):
         self._queue = queue
+        self._slot = slot
         self._released = False
         self._release_lock = threading.Lock()
+        self._parked = False
+
+    @property
+    def slot(self) -> Optional[int]:
+        """Pool slot this lease holds, or None when admission is disabled."""
+        return self._slot
+
+    def park(self) -> None:
+        """Hand the slot back while this holder waits on something off the GPU.
+
+        A run stopped on a tool approval prompt is not decoding, so holding its
+        slot would let unanswered prompts fill the pool while llama-server idles.
+        The lease itself stays valid: releasing it after a park is still correct.
+        """
+        queue = self._queue
+        slot = None
+        with self._release_lock:
+            if queue is None or self._released or self._parked:
+                return
+            self._parked = True
+            slot, self._slot = self._slot, None
+        queue.park(slot)
+
+    def unpark(self) -> None:
+        """Drop the parked state without reclaiming a slot.
+
+        For a holder that is tearing down: it will not decode again. Resuming
+        holders must use ``unpark_async``, which waits for a slot instead of
+        going back to llama-server past the admission limit.
+        """
+        with self._release_lock:
+            if not self._parked:
+                return
+            self._parked = False
+        if self._queue is not None:
+            self._queue.unpark()
+
+    async def unpark_async(
+        self,
+        *,
+        cancel_event = None,
+        poll_s: float = 0.02,
+    ) -> None:
+        """Take a slot back, waiting until the pool has room.
+
+        ``park`` gave the slot to a waiter, so by the time the user answers the
+        prompt someone else may be decoding in it. Resuming regardless put two
+        holders on a one-slot server. Gives up if the caller is cancelled, since
+        the holder is then leaving anyway and must not be stuck here.
+        """
+        queue = self._queue
+        if queue is None or not self._parked:
+            return
+        slot = await queue.acquire_parked_slot(cancel_event = cancel_event, poll_s = poll_s)
+        stranded = None
+        with self._release_lock:
+            # release() may have run during the wait; it clears the flag and does
+            # the unpark itself, so only the caller that clears it here repeats one.
+            parked, self._parked = self._parked, False
+            if self._released:
+                # Released while waiting: this lease will never hand the slot
+                # back, so return it here rather than strand it for good.
+                stranded = slot
+            else:
+                self._slot = slot
+        if parked:
+            queue.unpark()
+        if stranded is not None:
+            queue.release(stranded)
 
     def release(self) -> None:
         queue = None
+        parked = False
         with self._release_lock:
             if self._released:
                 return
             self._released = True
             queue = self._queue
+            parked, self._parked = self._parked, False
         if queue is not None:
-            queue.release()
+            if parked:
+                queue.unpark()
+            queue.release(self._slot)
 
     async def __aenter__(self) -> "LlamaAdmissionLease":
         return self
@@ -164,6 +317,8 @@ class LlamaAdmissionLease:
 
 
 class LlamaAdmissionReservation:
+    __slots__ = ("_queue", "_lease", "_waiter", "snapshot")
+
     def __init__(
         self,
         *,
@@ -195,6 +350,13 @@ class LlamaAdmissionReservation:
         return self._lease
 
     async def wait(self, timeout_s: float) -> Optional[LlamaAdmissionLease]:
+        """Wait up to ``timeout_s`` for a slot.
+
+        A timeout leaves this reservation queued so the caller can poll again.
+        Any exit that abandons the wait for good must call ``cancel()``, or the
+        slot granted later is delivered to a future nobody reads and is never
+        released.
+        """
         lease = self.lease_nowait()
         if lease is not None:
             return lease
@@ -229,12 +391,74 @@ class LlamaAdmissionReservation:
 
 
 class LlamaAdmissionQueue:
+    """A fixed pool of generation slots for one llama-server, plus a FIFO wait line.
+
+    The pool mirrors llama-server's own ``--parallel`` slots: ``capacity`` slot ids
+    are each either free or held by exactly one caller. A caller that finds every
+    slot busy waits in arrival order and is handed the next slot to free, so no
+    caller is starved. This bounds only the callers that reserve: chat completions
+    and messages do, while /v1/completions, Studio's own chat endpoint and RAG
+    captioning all reach llama-server directly, so it is not a global cap.
+    Waiting is unbounded in time by default (``queue_timeout_s``
+    None); the wait line itself is bounded, and only how many may line up before
+    new arrivals are rejected. By default that is ``16 x slots`` floored at 64,
+    not unlimited: an unbounded line takes ``max_queue`` or ``queue_per_slot``
+    set to 0. See ``LlamaAdmissionConfig.queue_limit``.
+    """
+
+    __slots__ = (
+        "key",
+        "_lock",
+        "_capacity",
+        "_free",
+        "_in_use",
+        "_held",
+        "_waiters",
+        "_parked",
+        "_unpark_tickets",
+        "_unpark_seq",
+    )
+
     def __init__(self, key: str):
         self.key = key
         self._lock = threading.Lock()
-        self._active = 0
         self._capacity = 1
+        self._free: list[int] = [0]
+        # Held slots as a bitmask: one int instead of a set, so the pool costs the
+        # same whether it is idle or saturated. _held is its popcount, kept as a
+        # counter because int.bit_count() is 3.10+ and this package targets 3.9.
+        self._in_use = 0
+        self._held = 0
         self._waiters: Deque[_Waiter] = deque()
+        # Holders parked on a tool approval prompt. They hold no slot, so this only
+        # keeps the queue off the idle-eviction list while they are away.
+        self._parked = 0
+        # FIFO tickets for holders resuming from a park (see acquire_parked_slot). A
+        # bare count deadlocked: every approved holder blocked every other one.
+        self._unpark_tickets: Deque[int] = deque()
+        self._unpark_seq = 0
+
+    def _resize_pool_locked(self, capacity: int) -> None:
+        # Slots past a shrunk capacity retire when their holder releases them.
+        if capacity == self._capacity:
+            return
+        self._capacity = capacity
+        self._free = [slot for slot in range(capacity) if not self._in_use >> slot & 1]
+
+    def _can_admit_locked(self, reserved: int) -> bool:
+        # Slots still held above a shrunk capacity keep occupying the backend, so
+        # count every held slot against the ceiling, not just the ids below it.
+        # ``reserved`` holds slots back for approved holders waiting to resume;
+        # without it a stream of new arrivals took the next slot, forever.
+        return bool(self._free) and (self._held + reserved) < self._capacity
+
+    def _take_slot_locked(self, reserved: int) -> Optional[int]:
+        if not self._can_admit_locked(reserved):
+            return None
+        slot = self._free.pop()
+        self._in_use |= 1 << slot
+        self._held += 1
+        return slot
 
     def reserve(self, *, capacity: int, config: LlamaAdmissionConfig) -> LlamaAdmissionReservation:
         capacity = max(1, int(capacity or 1))
@@ -242,22 +466,25 @@ class LlamaAdmissionQueue:
             return LlamaAdmissionReservation(
                 queue = None,
                 lease = LlamaAdmissionLease(None),
-                snapshot = LlamaAdmissionSnapshot(self.key, capacity, 0, 0),
+                snapshot = LlamaAdmissionSnapshot(self.key, capacity, 0, 0, capacity),
             )
 
         loop = asyncio.get_running_loop()
         with self._lock:
-            self._capacity = capacity
-            self._prune_waiters_locked()
+            self._resize_pool_locked(capacity)
             self._grant_waiters_locked()
-            if self._active < self._capacity and not self._waiters:
-                self._active += 1
-                return LlamaAdmissionReservation(
-                    queue = self,
-                    lease = LlamaAdmissionLease(self),
-                    snapshot = self._snapshot_locked(),
-                )
-            if config.max_queue is not None and len(self._waiters) >= config.max_queue:
+            if not self._waiters:
+                slot = self._take_slot_locked(len(self._unpark_tickets))
+                if slot is not None:
+                    # No snapshot here: callers read it through snapshot_now(),
+                    # which re-reads the queue, so building one per admitted
+                    # request would be pure allocation on the hot path.
+                    return LlamaAdmissionReservation(
+                        queue = self,
+                        lease = LlamaAdmissionLease(self, slot),
+                    )
+            limit = config.queue_limit(self._capacity)
+            if limit is not None and self._live_waiters_locked() >= limit:
                 raise LlamaAdmissionQueueFull(
                     "llama-server generation queue is full",
                     snapshot = self._snapshot_locked(),
@@ -270,15 +497,74 @@ class LlamaAdmissionQueue:
             return LlamaAdmissionReservation(
                 queue = self,
                 waiter = waiter,
-                snapshot = self._snapshot_locked(),
             )
 
-    def release(self) -> None:
+    def _release_slot_locked(self, slot: Optional[int]) -> None:
+        # A slot id at or past a shrunk capacity retires instead of returning.
+        if slot is None or not self._in_use >> slot & 1:
+            return
+        self._in_use &= ~(1 << slot)
+        self._held -= 1
+        if slot < self._capacity:
+            self._free.append(slot)
+
+    def release(self, slot: Optional[int]) -> None:
         with self._lock:
-            if self._active > 0:
-                self._active -= 1
+            self._release_slot_locked(slot)
             self._grant_waiters_locked()
 
+    def park(self, slot: Optional[int]) -> None:
+        """Return a parked holder's slot to the pool. See ``LlamaAdmissionLease.park``."""
+        with self._lock:
+            self._parked += 1
+            self._release_slot_locked(slot)
+            self._grant_waiters_locked()
+
+    def unpark(self) -> None:
+        with self._lock:
+            if self._parked > 0:
+                self._parked -= 1
+
+    async def acquire_parked_slot(
+        self,
+        *,
+        cancel_event = None,
+        poll_s: float = 0.02,
+    ) -> Optional[int]:
+        """Wait for a slot for a holder resuming from a park, None if cancelled.
+
+        Ordered by ticket rather than counted, so approvals resume in the order
+        they came back: counting them made every approved holder block every
+        other one, and with nothing decoding that never resolved.
+        """
+        with self._lock:
+            self._unpark_seq += 1
+            ticket = self._unpark_seq
+            self._unpark_tickets.append(ticket)
+        try:
+            while True:
+                with self._lock:
+                    ahead = 0
+                    for queued in self._unpark_tickets:
+                        if queued == ticket:
+                            break
+                        ahead += 1
+                    # Only the approvals ahead of this one hold slots back from it.
+                    slot = self._take_slot_locked(ahead)
+                    if slot is not None:
+                        return slot
+                    if cancel_event is not None and cancel_event.is_set():
+                        return None
+                await asyncio.sleep(poll_s)
+        finally:
+            with self._lock:
+                try:
+                    self._unpark_tickets.remove(ticket)
+                except ValueError:
+                    pass
+                # This ticket was holding a slot back from the wait line.
+                self._grant_waiters_locked()
+
     def cancel(self, waiter: _Waiter) -> None:
         lease_to_release = None
         with self._lock:
@@ -291,7 +577,13 @@ class LlamaAdmissionQueue:
                 lease_to_release = waiter.granted_lease
                 waiter.granted_lease = None
             if not waiter.future.done():
-                waiter.loop.call_soon_threadsafe(waiter.future.cancel)
+                try:
+                    waiter.loop.call_soon_threadsafe(waiter.future.cancel)
+                except RuntimeError:
+                    # Loop gone. Routes call cancel() from finally blocks, so
+                    # raising here would both mask their exception and skip the
+                    # release below, stranding the slot for the process lifetime.
+                    pass
         if lease_to_release is not None:
             lease_to_release.release()
 
@@ -303,20 +595,32 @@ class LlamaAdmissionQueue:
     def is_idle(self) -> bool:
         with self._lock:
             self._prune_waiters_locked()
-            return self._active == 0 and not self._waiters
+            # A parked holder owns no slot but is coming back to this queue, so
+            # evicting it here would resume it against a fresh 1-slot pool.
+            return self._in_use == 0 and not self._waiters and not self._parked
 
     def _grant_waiters_locked(self) -> None:
-        self._prune_waiters_locked()
-        while self._waiters and self._active < self._capacity:
+        # Dead waiters are skipped as they are popped, so no prune is needed here.
+        while self._waiters and self._can_admit_locked(len(self._unpark_tickets)):
             waiter = self._waiters.popleft()
             if waiter.cancelled or waiter.future.done():
                 continue
-            self._active += 1
-            lease = LlamaAdmissionLease(self)
+            slot = self._take_slot_locked(len(self._unpark_tickets))
+            lease = LlamaAdmissionLease(self, slot)
             waiter.granted_lease = lease
-            waiter.loop.call_soon_threadsafe(self._deliver_lease, waiter, lease)
+            try:
+                waiter.loop.call_soon_threadsafe(self._deliver_lease, waiter, lease)
+            except RuntimeError:
+                # Waiter's loop is gone. Reclaim the slot; leaving the bit set
+                # would strand it, since _free is rebuilt from the bitmask.
+                waiter.granted_lease = None
+                self._release_slot_locked(slot)
 
     def _deliver_lease(self, waiter: _Waiter, lease: LlamaAdmissionLease) -> None:
+        # Runs on the waiter's own loop thread, which is also the only thread that
+        # cancels that reservation, so waiter state is safe to touch unlocked here.
+        # release() may be called from any thread, but only reaches this via
+        # call_soon_threadsafe. Cancelling off-loop would need this under _lock.
         if waiter.cancelled or waiter.future.done():
             waiter.granted_lease = None
             if not waiter.future.done():
@@ -331,16 +635,32 @@ class LlamaAdmissionQueue:
             lease.release()
 
     def _prune_waiters_locked(self) -> None:
+        # Rebuilding the deque on every reserve/release dominated the hot path, so
+        # only pay it when a waiter actually died out of band (an externally
+        # cancelled future); cancel() already drops its own waiter eagerly.
+        for waiter in self._waiters:
+            if waiter.cancelled or waiter.future.done():
+                break
+        else:
+            return
         self._waiters = deque(
             waiter for waiter in self._waiters if not waiter.cancelled and not waiter.future.done()
         )
 
+    def _live_waiters_locked(self) -> int:
+        self._prune_waiters_locked()
+        return len(self._waiters)
+
     def _snapshot_locked(self) -> LlamaAdmissionSnapshot:
         return LlamaAdmissionSnapshot(
             key = self.key,
             capacity = self._capacity,
-            active = self._active,
+            active = self._held,
             queued = len(self._waiters),
+            # What another caller could actually take, so the admission log never
+            # shows free slots next to queued requests: after a shrink, ids below
+            # the new capacity can be free while holdovers still fill the ceiling.
+            free = min(len(self._free), max(0, self._capacity - self._held)),
         )
 
 
diff --git a/studio/backend/core/inference/llama_cpp.py b/studio/backend/core/inference/llama_cpp.py
index 27cd10e033..9b74fb050d 100644
--- a/studio/backend/core/inference/llama_cpp.py
+++ b/studio/backend/core/inference/llama_cpp.py
@@ -98,6 +98,7 @@ from core.inference.tool_call_parser import (
 from core.inference.tool_loop_controller import (
     ToolLoopController,
     append_deferred_nudges,
+    awaiting_approval_status,
     tool_event_provenance,
 )
 from state.tool_approvals import (
@@ -3135,8 +3136,9 @@ class LlamaCppBackend:
         prefer_rocr masks at the ROCr/HSA layer instead (clearing HIP). A HIP mask
         filters only AFTER the HSA runtime enumerates every agent, and that
         enumeration segfaults at startup on a GPU the build has no kernels for
-        (e.g. a gfx1103 iGPU under a gfx110X prebuilt), before llama-server logs a
-        line. ROCR drops the device at the driver layer, consuming physical ids.
+        (e.g. a gfx1036 iGPU under a gfx103X prebuilt: that bundle maps only
+        gfx1030/1031/1032/1034), before llama-server logs a line. ROCR drops the
+        device at the driver layer, consuming physical ids.
         The CPU-only sentinel ("-1") has no portable ROCR spelling, so it keeps
         the HIP mask. Windows keeps the HIP mask too: ROCR_VISIBLE_DEVICES is a
         Linux ROCr variable (Windows HIP has no ROCr layer), so the ROCR pin
@@ -3520,18 +3522,17 @@ class LlamaCppBackend:
             return []
 
     @staticmethod
-    def _get_gpu_free_memory_vulkan(binary: Optional[str] = None) -> list[tuple[int, int, int]]:
-        """Query free (and total) VRAM per device via the bundled ggml Vulkan backend.
+    def _run_vulkan_probe(binary: Optional[str] = None) -> list[dict]:
+        """Run ``_vulkan_probe.py`` and parse its per-device lines.
 
-        Loads ``libggml-vulkan`` in a short-lived subprocess (no Vulkan instance
-        in this process) and returns (device_index, free_mib, total_mib) sorted
-        by index. The index is ggml's compact Vulkan ordinal -- the one the
-        registry names ``Vulkan<index>`` and load_model pins with ``--device``,
-        NOT the raw ``GGML_VK_VISIBLE_DEVICES`` space. A user-set
-        ``GGML_VK_VISIBLE_DEVICES`` is honored by ggml (passed through), so the
-        list already reflects it. iGPUs leave a host-RAM margin (see
-        ``_apply_igpu_host_reserve_mib``) and report total 0; discrete cards pass
-        their real total through. [] when no Vulkan build or device is reachable.
+        Returns raw (uncapped) rows sorted by index:
+        ``{"index", "free_mib", "total_mib", "is_igpu", "name"}``. The index is
+        ggml's compact Vulkan ordinal -- the one the registry names
+        ``Vulkan<index>`` and load_model pins with ``--device``, NOT the raw
+        ``GGML_VK_VISIBLE_DEVICES`` space. A user-set ``GGML_VK_VISIBLE_DEVICES``
+        is honored by ggml (passed through), so the list already reflects it.
+        ``name`` is ggml's device description; "" from an older 4-column probe.
+        [] when no Vulkan build or device is reachable.
         """
         binary = binary or LlamaCppBackend._find_llama_server_binary()
         if not binary:
@@ -3556,10 +3557,13 @@ class LlamaCppBackend:
             )
         probe_script = Path(__file__).with_name("_vulkan_probe.py")
         try:
+            # UTF-8 to match the probe's stdout reconfigure: device names can be
+            # non-ASCII, and the platform-default decode (cp1252) could throw.
             result = subprocess.run(
                 [sys.executable, str(probe_script), str(binary_dir)],
                 capture_output = True,
-                text = True,
+                encoding = "utf-8",
+                errors = "replace",
                 timeout = 15,
                 env = env,
                 **_windows_hidden_subprocess_kwargs(),
@@ -3573,21 +3577,56 @@ class LlamaCppBackend:
             logger.debug(f"vulkan GPU probe failed: {e}")
             return []
 
-        gpus: list[tuple[int, int, int]] = []
+        rows: list[dict] = []
         for line in result.stdout.strip().splitlines():
             parts = line.split("\t")
-            if len(parts) != 4:
+            # 4 columns from an older probe (no name); 5 with the name column.
+            if len(parts) not in (4, 5):
                 continue
             try:
-                idx = int(parts[0])
-                free_mib = int(parts[1]) // (1024 * 1024)
-                is_igpu = parts[2] == "1"
-                # iGPU "total" is shared RAM, not a VRAM budget -> keep 0 so the
-                # fit stays on free*frac (the host reserve below is its
-                # headroom); a discrete card passes its real total through.
-                total_mib = 0 if is_igpu else int(parts[3]) // (1024 * 1024)
+                rows.append(
+                    {
+                        "index": int(parts[0]),
+                        "free_mib": int(parts[1]) // (1024 * 1024),
+                        "is_igpu": parts[2] == "1",
+                        "total_mib": int(parts[3]) // (1024 * 1024),
+                        "name": parts[4].strip() if len(parts) == 5 else "",
+                    }
+                )
             except ValueError:
                 continue
+        rows.sort(key = lambda r: r["index"])
+        return rows
+
+    @staticmethod
+    def vulkan_device_inventory(binary: Optional[str] = None) -> list[dict]:
+        """UI-facing Vulkan device list: the devices llama-server will actually
+        use, with real totals (an iGPU keeps its shared-RAM total here -- the
+        caller labels it, unlike the fit which zeroes it). Same rows as
+        ``_run_vulkan_probe``; names fall back to ``Vulkan<i>``.
+        """
+        rows = LlamaCppBackend._run_vulkan_probe(binary)
+        for row in rows:
+            if not row["name"]:
+                row["name"] = f"Vulkan{row['index']}"
+        return rows
+
+    @staticmethod
+    def _get_gpu_free_memory_vulkan(binary: Optional[str] = None) -> list[tuple[int, int, int]]:
+        """Query free (and total) VRAM per device via the bundled ggml Vulkan backend.
+
+        Fit-oriented view of ``_run_vulkan_probe``: returns (device_index,
+        free_mib, total_mib) sorted by index. iGPUs leave a host-RAM margin (see
+        ``_apply_igpu_host_reserve_mib``) and report total 0; discrete cards pass
+        their real total through. [] when no Vulkan build or device is reachable.
+        """
+        gpus: list[tuple[int, int, int]] = []
+        for row in LlamaCppBackend._run_vulkan_probe(binary):
+            idx, free_mib, is_igpu = row["index"], row["free_mib"], row["is_igpu"]
+            # iGPU "total" is shared RAM, not a VRAM budget -> keep 0 so the
+            # fit stays on free*frac (the host reserve below is its
+            # headroom); a discrete card passes its real total through.
+            total_mib = 0 if is_igpu else row["total_mib"]
             capped = _apply_igpu_host_reserve_mib(free_mib, is_igpu)
             if capped < free_mib:
                 logger.info(
@@ -3596,7 +3635,6 @@ class LlamaCppBackend:
                     f"({free_mib}->{capped}MiB usable)"
                 )
             gpus.append((idx, capped, total_mib))
-        gpus.sort(key = lambda g: g[0])
         if gpus:
             logger.info(
                 "Vulkan GPU memory detected: "
@@ -6534,10 +6572,10 @@ class LlamaCppBackend:
             binary = self._find_llama_server_binary()
             is_vulkan_backend = self._is_vulkan_backend(binary)
 
-            # Without --kv-unified an explicit --parallel N splits -c into windows of -c/N, so a
-            # build lacking the flag would shrink every context window for a feature it cannot
-            # serve: use one slot. After the requested count is captured (the echo still reports
-            # it), before the KV estimates (the fit matches what launches).
+            # Without --kv-unified an explicit --parallel N splits -c into windows of -c/N, so on a
+            # build lacking the flag the default of 4 would quarter every context window for a
+            # feature it cannot serve: fall back to one slot. Ahead of the KV estimates so the
+            # fit matches what launches.
             if (
                 n_parallel > 1
                 and binary
@@ -6674,12 +6712,23 @@ class LlamaCppBackend:
             # Block-diffusion GGUFs (DiffusionGemma) cannot run on llama-server;
             # serve them with the diffusion runner (same OpenAI-compat interface).
             if self._is_diffusion:
-                # Final defense: route and pre-teardown preflights reject before Phase 1.
-                if is_vulkan_backend and gpu_ids:
-                    raise ValueError(_VULKAN_DIFFUSION_GPU_IDS_ERROR)
                 # Not a tensor/layer GGUF: clear any preserved-fallback flag from a
                 # prior load (this path skips the command builder that clears it).
                 self._layer_preserves_tensor_intent = False
+                # On a Vulkan build gpu_ids are ggml Vulkan ordinals, but the diffusion
+                # runner selects its device by CUDA physical index (_diffusion_gpu_arg
+                # forwards gpu_ids[0] as a CUDA/DG_GPU token) with no mapping to them.
+                # The route rejects a CONFIRMED-diffusion pick up front; an uncached GGUF
+                # only classified as diffusion post-download still reaches here with a
+                # pin, so drop it and serve on the default device (like an unpinned load).
+                if gpu_ids and is_vulkan_backend:
+                    logger.warning(
+                        "Ignoring gpu_ids %s for diffusion GGUF on a Vulkan build: "
+                        "the diffusion runner cannot map ggml Vulkan ordinals; "
+                        "serving on the default device.",
+                        gpu_ids,
+                    )
+                    gpu_ids = None
                 with self._lock:
                     if self._cancel_event.is_set():
                         logger.info("Load cancelled before diffusion server start")
@@ -8275,7 +8324,7 @@ class LlamaCppBackend:
                         env["CUDA_DEVICE_ORDER"] = "PCI_BUS_ID"
                     # Mask on AMD at the ROCr/HSA layer: HIP-only masking still
                     # enumerates every agent first, which segfaults on a deselected
-                    # unsupported GPU (e.g. gfx1103 iGPU under a gfx110X prebuilt).
+                    # unsupported GPU (e.g. gfx1036 iGPU under a gfx103X prebuilt).
                     self._emit_child_gpu_visibility(
                         env, ",".join(str(i) for i in gpu_indices), prefer_rocr = True
                     )
@@ -11101,6 +11150,7 @@ class LlamaCppBackend:
         from core.inference.tools import (
             build_rag_autoinject,
             execute_tool,
+            has_text_only_provisional_card,
             is_always_safe_tool,
             is_high_risk_tool_call,
         )
@@ -11527,6 +11577,9 @@ class LlamaCppBackend:
                                                 permission_mode == "auto"
                                                 and is_always_safe_tool(current_name)
                                             )
+                                            # A text-preview card still streams while gated;
+                                            # hiding it blanks the chat.
+                                            and not has_text_only_provisional_card(current_name)
                                         )
                                         # Keep small-argument tools on the normal path.
                                         _args_len = len(
@@ -11628,20 +11681,27 @@ class LlamaCppBackend:
                                         # TEXT call to a provisional card. Gated on an enabled-name
                                         # sniff + size floor so prose/small calls spawn no pane; id
                                         # matches the first call so the final tool_start reconciles.
-                                        if (
-                                            not has_structured_tc
-                                            and not _confirm_gated_iteration
-                                            and _text_args_call_start >= 0
-                                        ):
+                                        if not has_structured_tc and _text_args_call_start >= 0:
                                             if not _text_args_id:
                                                 _call_text = content_accum[_text_args_call_start:]
                                                 _sniffed = _sniff_text_tool_name(
                                                     _call_text, _enabled_tool_names
                                                 )
-                                                if _sniffed and (
-                                                    _sniffed == "render_html"
-                                                    or len(_call_text)
-                                                    >= _PROVISIONAL_ARGS_MIN_CHARS
+                                                # Structured-path rule: gated calls
+                                                # stream only from a text-preview card.
+                                                if (
+                                                    _sniffed
+                                                    and not (
+                                                        _confirm_gated_iteration
+                                                        and not has_text_only_provisional_card(
+                                                            _sniffed
+                                                        )
+                                                    )
+                                                    and (
+                                                        _sniffed == "render_html"
+                                                        or len(_call_text)
+                                                        >= _PROVISIONAL_ARGS_MIN_CHARS
+                                                    )
                                                 ):
                                                     _text_args_id = "call_0"
                                                     _text_args_name = _sniffed
@@ -12230,18 +12290,31 @@ class LlamaCppBackend:
                     start_event["awaiting_confirmation"] = needs_confirm
 
                     try:
-                        yield {"type": "status", "text": decision.status_text}
+                        # Gated calls are not running yet; a "Running ..." badge
+                        # counting up while it waits on a human reads as a hang.
+                        yield {
+                            "type": "status",
+                            "text": (
+                                awaiting_approval_status(decision.tool_name)
+                                if needs_confirm
+                                else decision.status_text
+                            ),
+                        }
                         yield start_event
 
-                        if (
-                            decision_slot is not None
-                            and wait_tool_decision(
+                        _decision = (
+                            wait_tool_decision(
                                 decision_slot,
                                 approval_id,
                                 cancel_event = cancel_event,
                             )
-                            == "deny"
-                        ):
+                            if decision_slot is not None
+                            else None
+                        )
+                        if _decision is not None and _decision != "deny":
+                            # Approved: now it really is running.
+                            yield {"type": "status", "text": decision.status_text}
+                        if _decision == "deny":
                             decision_slot = None
                             resolved_provisional_tool_call_ids.add(decision.tool_call_id)
                             yield {
@@ -12809,10 +12882,15 @@ class LlamaCppBackend:
         min_p: float = 0.0,
         max_new_tokens: int = 2048,
         repetition_penalty: float = 1.1,
+        cancel_event: Optional[threading.Event] = None,
     ) -> tuple:
         """
         Generate TTS audio via llama-server /completion + codec decode.
         Returns (wav_bytes, sample_rate).
+
+        ``cancel_event`` lets a Stop or a forced model swap end the request: the
+        decode is one blocking POST, so a watcher closes the client out from under
+        it rather than polling. Raises RuntimeError once cancelled.
         """
         if audio_type not in self._TTS_PROMPTS:
             raise RuntimeError(f"GGUF TTS does not support '{audio_type}' codec.")
@@ -12834,15 +12912,47 @@ class LlamaCppBackend:
         if need_ids:
             payload["n_probs"] = 1
 
+        if cancel_event is not None and cancel_event.is_set():
+            raise RuntimeError("Audio generation cancelled")
+
         with httpx.Client(
             timeout = httpx.Timeout(300, connect = 10),
             headers = self._auth_headers,
             trust_env = False,
         ) as client:
-            resp = client.post(f"{self.base_url}/completion", json = payload)
+            finished = threading.Event()
+            watcher: Optional[threading.Thread] = None
+            if cancel_event is not None:
+
+                def _close_when_cancelled() -> None:
+                    while not finished.wait(0.05):
+                        if cancel_event.is_set():
+                            # Closing mid-request makes the blocking post raise
+                            # httpx.RequestError, the only way out of it.
+                            with contextlib.suppress(Exception):
+                                client.close()
+                            return
+
+                watcher = threading.Thread(target = _close_when_cancelled, daemon = True)
+                watcher.start()
+            try:
+                resp = client.post(f"{self.base_url}/completion", json = payload)
+            except httpx.RequestError:
+                if cancel_event is not None and cancel_event.is_set():
+                    raise RuntimeError("Audio generation cancelled") from None
+                raise
+            finally:
+                finished.set()
+                if watcher is not None:
+                    watcher.join(timeout = 0.5)
             if resp.status_code != 200:
                 raise RuntimeError(f"llama-server returned {resp.status_code}: {resp.text}")
 
+        # The codec decode below is GPU work with no interruption point, so check here:
+        # cancelling after this only wastes the decode it cannot stop.
+        if cancel_event is not None and cancel_event.is_set():
+            raise RuntimeError("Audio generation cancelled")
+
         data = resp.json()
         token_ids = (
             [p["id"] for p in data.get("completion_probabilities", []) if "id" in p]
diff --git a/studio/backend/core/inference/llama_keepwarm.py b/studio/backend/core/inference/llama_keepwarm.py
index 3380ebf5f5..05b1271b27 100644
--- a/studio/backend/core/inference/llama_keepwarm.py
+++ b/studio/backend/core/inference/llama_keepwarm.py
@@ -345,6 +345,22 @@ def _loaded_identity(backend):
     return (backend.model_identifier, getattr(backend, "hf_variant", None), advertised)
 
 
+def _note_idle_unload_event(freed) -> None:
+    """Monitor row for an idle auto-unload. Best-effort; uses the stash's
+    advertised repo id so the row never shows the on-disk load path."""
+    try:
+        from core.inference.api_monitor import api_monitor
+        from core.inference.model_ids import public_model_id
+
+        identifier, variant, advertised = (list(freed) + [None, None, None])[:3]
+        label = public_model_id(advertised or identifier) or "model"
+        if variant and ":" not in label:
+            label = f"{label}:{variant}"
+        api_monitor.record_lifecycle(event = "unload", model = label, reason = "idle")
+    except Exception as exc:
+        logger.debug("idle unload monitor event failed: %s", exc)
+
+
 async def idle_unload_loop(poll_seconds: float = 15.0) -> None:
     """Unload the loaded GGUF once idle past the configured TTL. Inert when off."""
     from utils.openai_auto_switch_settings import (
@@ -407,6 +423,8 @@ async def idle_unload_loop(poll_seconds: float = 15.0) -> None:
                     elif manifest:
                         _delete_resume_files(manifest)
                     logger.info("Idle auto-unload: freed GGUF after %ss idle", ttl)
+                    # An idle unload stashes for reload and skips note_model_unloaded.
+                    _note_idle_unload_event(freed)
                     seen_model = None
         except Exception as exc:
             logger.debug("idle_unload_loop iteration failed: %s", exc)
diff --git a/studio/backend/core/inference/llama_server_args.py b/studio/backend/core/inference/llama_server_args.py
index d1b9ea276f..74fdc6bcd4 100644
--- a/studio/backend/core/inference/llama_server_args.py
+++ b/studio/backend/core/inference/llama_server_args.py
@@ -128,6 +128,7 @@ def validate_extra_args(args: Optional[Iterable[str]]) -> list[str]:
     parse_ctx_override(out)
     parse_cache_override(out)
     parse_split_mode_override(out)
+    parse_gpu_layers_override(out)
     return out
 
 
@@ -203,9 +204,8 @@ _SPLIT_SHADOWING_FLAGS: frozenset[str] = _SPLIT_MODE_FLAGS | _TENSOR_SPLIT_FLAGS
 # inherited -ngl is respected (the offload_overridden path), so this group is
 # opt-in, not default. Layer flags are shared with llama_cpp's override
 # detection; the MoE flags are strip-only (manual's --n-cpu-moe slider owns them).
-_LAYER_OFFLOAD_FLAGS: frozenset[str] = frozenset(
-    {"-ngl", "--gpu-layers", "--n-gpu-layers", "-fit", "--fit"}
-)
+_GPU_LAYER_FLAGS: frozenset[str] = frozenset({"-ngl", "--gpu-layers", "--n-gpu-layers"})
+_LAYER_OFFLOAD_FLAGS: frozenset[str] = _GPU_LAYER_FLAGS | frozenset({"-fit", "--fit"})
 _MOE_OFFLOAD_FLAGS: frozenset[str] = frozenset({"-ncmoe", "--n-cpu-moe", "-cmoe", "--cpu-moe"})
 _OFFLOAD_SHADOWING_FLAGS: frozenset[str] = _LAYER_OFFLOAD_FLAGS | _MOE_OFFLOAD_FLAGS
 
@@ -316,6 +316,26 @@ def parse_cache_override(args: Optional[Iterable[str]]) -> Optional[str]:
     return _last_flag_value(args, _CACHE_FLAGS)
 
 
+def parse_gpu_layers_override(args: Optional[Iterable[str]]) -> Optional[int]:
+    """Return the last user-supplied GPU layer count from extras.
+
+    Manual GPU memory mode strips llama.cpp offload flags because the
+    first-class load fields own them. Callers use this parser first to preserve
+    an explicit ``-ngl`` / ``--gpu-layers`` / ``--n-gpu-layers`` value when
+    translating the extras into those fields.
+    """
+    raw_value = _last_flag_value(args, _GPU_LAYER_FLAGS)
+    if raw_value is None:
+        return None
+    try:
+        value = int(raw_value)
+    except ValueError as exc:
+        raise ValueError("llama-server GPU layers flag requires an integer value") from exc
+    if value < -1:
+        raise ValueError("llama-server GPU layers flag requires an integer value of at least -1")
+    return value
+
+
 def parse_cache_override_per_axis(
     args: Optional[Iterable[str]],
 ) -> tuple[Optional[str], Optional[str]]:
diff --git a/studio/backend/core/inference/local_model_resolver.py b/studio/backend/core/inference/local_model_resolver.py
index e6014f442d..5d2a9e9c87 100644
--- a/studio/backend/core/inference/local_model_resolver.py
+++ b/studio/backend/core/inference/local_model_resolver.py
@@ -34,6 +34,15 @@ class _LocalGgufEntry:
 _CACHE_TTL_S = 5.0
 _lock = threading.Lock()
 _scan: tuple[float, dict[str, _LocalGgufEntry]] = (0.0, {})
+# Not _lock: that is held for the whole scan, so the request path would wait on it.
+_warm_lock = threading.Lock()
+# Repos that finished downloading but are not in the published index yet: nothing
+# else covers them until the next scan, and the request path must not call them absent.
+_just_downloaded: set[str] = set()
+_warming = False
+_last_scan_s = 0.0
+# Rescan at most a tenth of the time: on the TTL alone a slow scan would run continuously.
+_WARM_DUTY = 10.0
 
 
 def _is_abs_path_id(value: str) -> bool:
@@ -103,17 +112,26 @@ def _local_gguf_entry(loader_id: str, info) -> Optional[_LocalGgufEntry]:
         load_dir = _resolve_load_dir(p)
         variants, _ = list_local_gguf_variants(str(load_dir))
         quants = tuple(v.quant for v in variants if getattr(v, "quant", None))
-        return _LocalGgufEntry(loader_id, str(load_dir), quants) if quants else None
+        if not quants:
+            return None
+        # That call orders by descending size, so the head is the biggest quant (often
+        # F16). Downstream reads [0], and a bare id must mean whichever quant a plain
+        # load would take: answering with the largest can evict a model and then OOM.
+        from core.inference.openai_auto_download import preferred_quant
+
+        best = preferred_quant(quants)
+        if best and quants[0] != best:
+            quants = (best, *(q for q in quants if q != best))
+        return _LocalGgufEntry(loader_id, str(load_dir), quants)
     except Exception:
         return None
 
 
-def info_has_local_gguf(info) -> bool:
-    """True when *info* (a LocalModelInfo) points to on-disk GGUF weights the
-    auto-switch path can load. Read from the files, not ``info.model_format``: the
-    HF-cache scanner leaves model_format unset for GGUF snapshots, so a
-    model_format filter would drop every cached GGUF. Lets /v1/models advertise
-    exactly what /v1 can serve."""
+def local_gguf_quants(info) -> Optional[tuple[str, ...]]:
+    """On-disk quant labels for *info*, or None when it is not a servable local
+    GGUF. Read from the files, not ``info.model_format``: the HF-cache scanner
+    leaves that unset for GGUF snapshots, so filtering on it drops every cached
+    GGUF. One scan tells /v1/models what it can serve and which quant to name."""
     from pathlib import Path
 
     path = getattr(info, "path", None)
@@ -123,8 +141,14 @@ def info_has_local_gguf(info) -> bool:
     if isinstance(path, str) and any(
         seg in (".studio_links", "ollama_links") for seg in Path(path).parts
     ):
-        return False
-    return _local_gguf_entry(getattr(info, "id", "") or "", info) is not None
+        return None
+    entry = _local_gguf_entry(getattr(info, "id", "") or "", info)
+    return entry.variants if entry is not None else None
+
+
+def info_has_local_gguf(info) -> bool:
+    """True when *info* points to on-disk GGUF weights the auto-switch path can load."""
+    return local_gguf_quants(info) is not None
 
 
 def _build_index() -> dict[str, _LocalGgufEntry]:
@@ -287,6 +311,36 @@ def _sibling_revision_entries(raw_id: str, loader_id: str):
             yield sibling.name, entry
 
 
+def note_downloaded(repo_id: Optional[str]) -> None:
+    """Record a repo as present ahead of the scan that will index it."""
+    if not repo_id:
+        return
+    with _lock:
+        _just_downloaded.add(repo_id.strip().lower())
+
+
+def recently_downloaded(repo_id: str) -> bool:
+    """Whether *repo_id* finished downloading since the last completed scan."""
+    if not isinstance(repo_id, str) or not repo_id.strip():
+        return False
+    return repo_id.strip().lower() in _just_downloaded
+
+
+def invalidate_index() -> None:
+    """Mark the cached scan stale so the next resolve sees a just-finished download
+    instead of waiting out the TTL.
+
+    Keeps the entries: the request path reads this cache without scanning, so
+    emptying it would leave it with no evidence about any local model until the
+    rebuild lands, and a bare request for one would be answered by whatever is
+    resident. Only a completed download invalidates, and that only adds, so the
+    retained entries stay true.
+    """
+    global _scan
+    with _lock:
+        _scan = (0.0, _scan[1])
+
+
 def _index() -> dict[str, _LocalGgufEntry]:
     global _scan
     # Build under the lock so concurrent callers with an expired cache don't all
@@ -301,23 +355,74 @@ def _index() -> dict[str, _LocalGgufEntry]:
         # an install with many local models can itself exceed the TTL, which would
         # store the cache already expired and make every request rebuild the index.
         _scan = (time.monotonic(), fresh)
+        # The scan supersedes the notes: whatever landed is in the index now.
+        _just_downloaded.clear()
         return fresh
 
 
-def resolve_local_gguf(requested: str) -> Optional[tuple[str, Optional[str], str]]:
+def index_is_built() -> bool:
+    """Whether a scan has ever completed, freshness aside.
+
+    Lock-free on purpose: ``_lock`` is held for the whole scan, so taking it would
+    park the request path on the scan it is trying to stay off. Safe because
+    ``_scan`` is only ever rebound, never mutated.
+    """
+    return bool(_scan[0])
+
+
+def warm_index_soon() -> None:
+    """(Re)build the index off the request path when it is missing or past its TTL.
+
+    The only refresh for callers using ``allow_scan=False``. Covers a stale index,
+    not just an absent one: a model downloaded through the Hub UI or dropped into a
+    scan folder has no invalidation hook and would otherwise stay invisible to them
+    for the life of the process. Never blocks, and never touches ``_lock``.
+    """
+    global _warming
+    if time.monotonic() - _scan[0] < max(_CACHE_TTL_S, _last_scan_s * _WARM_DUTY):
+        return
+    with _warm_lock:
+        if _warming:
+            return
+        _warming = True
+
+    def _run() -> None:
+        global _warming, _last_scan_s
+        started = time.monotonic()
+        try:
+            _index()
+        except Exception:
+            pass
+        finally:
+            _last_scan_s = time.monotonic() - started
+            with _warm_lock:
+                _warming = False
+
+    threading.Thread(target = _run, name = "local-model-index-warm", daemon = True).start()
+
+
+def resolve_local_gguf(
+    requested: str, *, allow_scan: bool = True
+) -> Optional[tuple[str, Optional[str], str]]:
     """Return ``(load_path, gguf_variant, loader_id)`` for a local match, else None.
 
     ``load_path`` is the concrete on-disk path to hand /load (so it never fetches
     a remote), ``loader_id`` is the advertised id used as the launch-override key.
     ``requested`` is ``repo`` or ``repo:VARIANT``. An exact id match wins first
     (so ids containing a colon still resolve); else the last ``:VARIANT`` is split
-    off and resolves only when that quant is on disk.
+    off and resolves only when that quant is on disk, unless it names no quant at
+    all (an Ollama-style ":latest"), which means the repo.
+
+    ``allow_scan=False`` answers from the last built index and never rebuilds, for
+    the request path: the scan walks several model dirs and HF caches, takes seconds
+    on a large install, and holds a lock everyone queues behind. Stale is fine there,
+    since disk barely moves and a finished download calls :func:`invalidate_index`.
     """
     if not isinstance(requested, str) or not requested.strip():
         return None
     requested = requested.strip()
     try:
-        index = _index()
+        index = _index() if allow_scan else _scan[1]
         entry = index.get(requested.lower())
         if entry is not None:
             variant = entry.variants[0] if entry.variants else None
@@ -333,8 +438,44 @@ def resolve_local_gguf(requested: str) -> Optional[tuple[str, Optional[str], str
         for v in entry.variants:
             if v.lower() == wanted:
                 return entry.load_path, v, entry.loader_id
-        return None
+        from core.inference.openai_auto_download import looks_like_quant
+
+        if looks_like_quant(variant):
+            return None
+        # ":latest" or ":8b" names no file, so it means the repo; a real quant that
+        # is not on disk still misses, or a swap would serve the wrong weights.
+        return entry.load_path, (entry.variants[0] if entry.variants else None), entry.loader_id
     except Exception:
         # Best-effort: any resolver failure falls through to the loaded model,
         # so a malformed name can never turn a servable request into a 500.
         return None
+
+
+MISS_MODEL_NOT_FOUND = "model_not_found"
+MISS_VARIANT_NOT_FOUND = "variant_not_found"
+
+
+def describe_local_miss(requested: str) -> tuple[str, tuple[str, ...]]:
+    """Why :func:`resolve_local_gguf` missed, so an error can say "wrong quant"
+    instead of "no such model".
+
+    ``(MISS_VARIANT_NOT_FOUND, <local quants>)`` when the repo is downloaded but the
+    requested ``:VARIANT`` is not, else ``(MISS_MODEL_NOT_FOUND, ())``. Fail-safe: a
+    scan failure reports the generic miss rather than raising into the handler.
+    """
+    if not isinstance(requested, str) or not requested.strip():
+        return MISS_MODEL_NOT_FOUND, ()
+    base, sep, variant = requested.strip().rpartition(":")
+    from core.inference.openai_auto_download import looks_like_quant
+
+    # Split like the resolver or the two disagree: a tag naming no quant means the
+    # repo there, so reporting a missing quant for it would name one nobody asked for.
+    if not sep or not looks_like_quant(variant):
+        return MISS_MODEL_NOT_FOUND, ()
+    try:
+        entry = _index().get(base.strip().lower())
+    except Exception:
+        return MISS_MODEL_NOT_FOUND, ()
+    if entry is None or not entry.variants:
+        return MISS_MODEL_NOT_FOUND, ()
+    return MISS_VARIANT_NOT_FOUND, entry.variants
diff --git a/studio/backend/core/inference/mlx_inference.py b/studio/backend/core/inference/mlx_inference.py
index d19c67a01a..2b300a32b1 100644
--- a/studio/backend/core/inference/mlx_inference.py
+++ b/studio/backend/core/inference/mlx_inference.py
@@ -1189,7 +1189,8 @@ class MLXInferenceBackend:
             **gen_kwargs,
         )
 
-    def reset_generation_state(self):
+    def reset_generation_state(self, caller_cancel_event = None):
+        # caller_cancel_event: signature parity with the orchestrator; unused here.
         import mlx.core as mx
         import gc
 
diff --git a/studio/backend/core/inference/model_ids.py b/studio/backend/core/inference/model_ids.py
index 548cc60f94..3886307ae2 100644
--- a/studio/backend/core/inference/model_ids.py
+++ b/studio/backend/core/inference/model_ids.py
@@ -39,10 +39,29 @@ def _looks_like_path(identifier: str) -> bool:
     return False
 
 
+def hf_cache_repo_id(path: Optional[str]) -> Optional[str]:
+    """``.../models--org--name/snapshots/<sha>`` -> ``org/name``, else None.
+
+    A model loaded from the HF cache is identified by its snapshot dir, whose
+    basename is a commit hash; recover the repo id so callers don't show that.
+    """
+    if not path:
+        return None
+    parts = str(path).replace("\\", "/").split("/")
+    for index, part in enumerate(parts):
+        # Only inside the real cache layout: a "models--" name alone is not a repo id.
+        if part.startswith("models--") and parts[index + 1 : index + 2] == ["snapshots"]:
+            return part[len("models--") :].replace("--", "/")
+    return None
+
+
 def public_model_id(identifier: Optional[str]) -> Optional[str]:
     """Return a clean, path-free public id for *identifier*.
 
-    - Local GGUF path -> the file stem with ``.gguf`` stripped, e.g.
+    - HF cache path -> the repo id it came from, e.g.
+      ``~/.cache/huggingface/hub/models--unsloth--X-GGUF/snapshots/<sha>`` ->
+      ``unsloth/X-GGUF``.
+    - Other local GGUF path -> the file stem with ``.gguf`` stripped, e.g.
       ``/srv/models/Qwen3-30B-A3B-Q4_K_M.gguf`` -> ``Qwen3-30B-A3B-Q4_K_M``.
     - HF repo id (``org/model``) and already-clean names -> returned unchanged.
     - ``None`` / empty -> returned unchanged.
@@ -51,6 +70,9 @@ def public_model_id(identifier: Optional[str]) -> Optional[str]:
         return identifier
     if not _looks_like_path(identifier):
         return identifier
+    repo_id = hf_cache_repo_id(identifier)
+    if repo_id:
+        return repo_id
     name = os.path.basename(identifier.replace("\\", "/").rstrip("/"))
     if name.lower().endswith(_GGUF_SUFFIX):
         name = name[: -len(_GGUF_SUFFIX)]
diff --git a/studio/backend/core/inference/openai_auto_download.py b/studio/backend/core/inference/openai_auto_download.py
new file mode 100644
index 0000000000..cad5e40d14
--- /dev/null
+++ b/studio/backend/core/inference/openai_auto_download.py
@@ -0,0 +1,812 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Opt-in: fetch a GGUF a /v1 request names but this server doesn't have.
+
+Auto-switch only loads models already on disk. With
+``openai_api_auto_download_model`` on, a miss that looks like a real Hub repo is
+fetched in the background and the request is told to retry rather than held
+open: a quant is routinely tens of GB, far longer than any client (or the
+Cloudflare edge on ``--secure``) will wait, and the inference lifecycle gate must
+not be held meanwhile. The resident model keeps serving, and the retry that lands
+after the download goes through the ordinary auto-switch path.
+
+Admission is deliberately narrow, since a request only needs an API key:
+- ``namespace/name`` only, and only when the Hub confirms GGUF weights. A
+  namespace is not evidence of intent (LiteLLM and OpenRouter address every
+  provider that way), so ``gpt-4`` and ``anthropic/claude-3.5-sonnet`` alike
+  fall through to the resident model as before.
+- GGUF only, decided from the remote file list, not the repo name: GGUF runs
+  under llama.cpp, which never imports repo Python.
+- ``auto_map`` is refused, so ``trust_remote_code`` is only ever granted
+  deliberately in the UI, never by an API call.
+- One download at a time, so a key holder cannot fan out fetches.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import shutil
+import threading
+import time
+from dataclasses import dataclass
+from typing import Optional
+
+from loggers import get_logger
+
+logger = get_logger(__name__)
+
+# Keep the Hub probe short so a slow Hub can't stall the request path.
+_MODEL_INFO_TIMEOUT_S = 8.0
+# auth_check and hf_hub_download take no timeout of their own and run while the
+# provisional slot is held, so an unresponsive Hub would pin the single flight. The
+# code probe fetches up to three configs, so it gets more room than the auth call.
+_CODE_PROBE_TIMEOUT_S = 20.0
+# Headroom left free after the download, so filling the disk can't wedge the box.
+_DISK_RESERVE_BYTES = 5 * 1024**3
+_WATCH_POLL_S = 2.0
+# A stalled watcher must not pin the single-flight slot forever.
+_MAX_WATCH_S = 24 * 60 * 60
+# Past the watch window the row is resolved, so poll only to see whether the
+# worker is still alive and still owns the slot.
+_TIMED_OUT_POLL_S = 60.0
+_RETRY_AFTER_S = 30
+# Long enough for a client honouring Retry-After to come back and be told, short
+# enough that one that never returns cannot hold the slot.
+_FAILED_HOLD_S = 3 * _RETRY_AFTER_S
+_MAX_LISTED_VARIANTS = 8
+
+
+@dataclass(frozen = True)
+class AutoDownloadRefusal:
+    """Why this request cannot be served yet; the route raises it in the
+    surface's own error envelope."""
+
+    status: int
+    code: str
+    message: str
+    retry_after: Optional[int] = None
+
+
+@dataclass
+class _Active:
+    repo_id: str
+    # None while the Hub probe is still deciding which quant to fetch.
+    variant: Optional[str] = None
+    expected_bytes: int = 0
+    monitor_id: Optional[str] = None
+    started_at: float = 0.0
+    # Set when the worker failed. Held until a retry surfaces it: Retry-After is far
+    # longer than the watcher poll, so the client would restart the same failing download.
+    error: Optional[str] = None
+    failed_at: float = 0.0
+
+
+_lock = threading.Lock()
+_active: Optional[_Active] = None
+
+# Repos the Hub says are not servable, so a "vendor/model" miss doesn't re-probe every request.
+_NOT_SERVABLE_TTL_S = 10 * 60
+_NOT_SERVABLE_MAX = 256
+_cache_lock = threading.Lock()
+_not_servable: dict[str, float] = {}
+
+
+def _public_label(repo_id: str, variant: Optional[str]) -> str:
+    return f"{repo_id}:{variant}" if variant else repo_id
+
+
+def split_model_ref(requested: str) -> tuple[str, Optional[str]]:
+    """``org/repo:QUANT`` -> ``("org/repo", "QUANT")``; no suffix -> variant None.
+
+    Splits on the last colon. A slash-bearing suffix is only a variant when a real
+    Hub repo precedes it: "build/llama-13b" is a subdirectory GGUF key the catalog
+    advertises, while "C:/models/x.gguf" leaves a drive letter that is no repo id.
+    """
+    text = (requested or "").strip()
+    base, sep, suffix = text.rpartition(":")
+    if not sep or not base or not suffix:
+        return text, None
+    stripped = base.strip()
+    if "/" in suffix:
+        from hub.utils.paths import is_valid_repo_id
+        if "/" not in stripped or not is_valid_repo_id(stripped):
+            return text, None
+    return stripped, suffix.strip()
+
+
+def is_downloadable_ref(requested: str) -> bool:
+    """Whether *requested* is shaped like a Hub repo we may fetch.
+
+    Requires an explicit namespace: keeps ``gpt-4`` and other foreign ids falling
+    through, and stops ModelConfig.from_identifier's bare-name ``unsloth/``
+    prefixing from turning an unrelated label into a real repo.
+    """
+    from hub.utils.paths import is_valid_repo_id
+
+    repo_id, variant = split_model_ref(requested)
+    if "/" not in repo_id or not is_valid_repo_id(repo_id):
+        return False
+    if variant is not None:
+        from hub.utils.paths import is_valid_gguf_variant
+        return is_valid_gguf_variant(variant)
+    return True
+
+
+def looks_like_quant(variant: Optional[str]) -> bool:
+    """Whether a ``:suffix`` names a GGUF quant rather than a foreign tag.
+
+    Neither a namespace nor a colon proves a request was meant for this server
+    (``vendor/model`` is LiteLLM/OpenRouter, ``name:latest`` is Ollama). A real
+    quant label does.
+    """
+    import re
+
+    from utils.models.model_config import _GGUF_KNOWN_QUANT_RE
+
+    if not variant:
+        return False
+    # _extract_quant_label can append a bpw modifier (IQ4_XS-3.53bpw); still a quant.
+    label = re.sub(r"-[0-9]+(?:\.[0-9]+)?bpw$", "", variant.strip(), flags = re.IGNORECASE)
+    return _GGUF_KNOWN_QUANT_RE.fullmatch(label) is not None
+
+
+def _hub_token(hf_token: Optional[str]):
+    """The caller's token, or an explicit False. None makes huggingface_hub fall
+    back to a cached login (here the server owner's); only False is anonymous."""
+    return hf_token or False
+
+
+def _servable_key(repo_id: str, hf_token: Optional[str]) -> str:
+    """Cache key, per credential.
+
+    The Hub 404s a private repo the caller cannot see, so a tokenless verdict says
+    nothing about a caller who has one. Digested, so no token is held here.
+    """
+    import hashlib
+
+    seen_as = hashlib.sha256(hf_token.encode()).hexdigest()[:16] if hf_token else "anon"
+    return f"{repo_id.lower()}\n{seen_as}"
+
+
+def _mark_not_servable(repo_id: str, hf_token: Optional[str]) -> None:
+    with _cache_lock:
+        if len(_not_servable) >= _NOT_SERVABLE_MAX:
+            _not_servable.clear()
+        _not_servable[_servable_key(repo_id, hf_token)] = time.monotonic() + _NOT_SERVABLE_TTL_S
+
+
+def _is_not_servable(repo_id: str, hf_token: Optional[str]) -> bool:
+    key = _servable_key(repo_id, hf_token)
+    with _cache_lock:
+        expires = _not_servable.get(key)
+        if expires is None:
+            return False
+        if expires <= time.monotonic():
+            del _not_servable[key]
+            return False
+        return True
+
+
+def _gated_refusal(repo_id: str) -> AutoDownloadRefusal:
+    return AutoDownloadRefusal(
+        status = 403,
+        code = "model_access_denied",
+        message = (
+            f"'{repo_id}' is gated on Hugging Face. Accept its licence, then retry with "
+            "your own token in the X-Unsloth-HF-Token header: automatic download never "
+            "uses this server's Hugging Face identity."
+        ),
+    )
+
+
+async def _bounded_probe(fn, *args, timeout: float, default):
+    """Run a blocking Hub probe off the loop, bounding only the wait.
+
+    The thread is left to finish (a blocking socket read cannot be cancelled); the
+    caller takes *default*, chosen per call site so a timeout errs the safe way.
+    """
+    try:
+        return await asyncio.wait_for(asyncio.to_thread(fn, *args), timeout)
+    except (TimeoutError, asyncio.TimeoutError):
+        logger.debug("hub probe %s timed out after %ss", getattr(fn, "__name__", fn), timeout)
+        return default
+
+
+def _auth_denied(repo_id: str, hf_token: Optional[str]) -> bool:
+    """Whether this token lacks file access to a gated repo. False when the
+    check is inconclusive: the download's own auth is the real gate."""
+    from hub.utils.hf_errors import hf_error_status
+
+    try:
+        from huggingface_hub import auth_check
+        auth_check(repo_id, token = _hub_token(hf_token))
+    except Exception as exc:
+        return hf_error_status(exc) in (401, 403)
+    return False
+
+
+def _gguf_variants(siblings) -> dict[str, int]:
+    """Quant label -> bytes the download will actually fetch.
+
+    Mirrors list_gguf_variants for the selectable labels: companions (mmproj/MTP)
+    and big-endian builds are not quants, and sharded quants sum across shards.
+    Bytes come from the download plan, which folds companions back into every
+    quant, so the disk reserve is measured against what the worker fetches.
+    """
+    from hub.utils.gguf import extract_quant_label as canonical_quant_label
+    from hub.utils.gguf_plan import build_gguf_variant_plans
+    from utils.models.model_config import (
+        _extract_quant_label,
+        _is_big_endian_gguf_path,
+        _is_mmproj,
+        _is_mtp_drafter,
+    )
+
+    siblings = list(siblings or [])
+    plans = build_gguf_variant_plans(siblings)
+    sizes: dict[str, int] = {}
+    for sibling in siblings:
+        name = getattr(sibling, "rfilename", "") or ""
+        if not name.lower().endswith(".gguf"):
+            continue
+        quant = _extract_quant_label(name)
+        if not looks_like_quant(quant):
+            # With no recognized quant token the extractors part ways: this one takes
+            # the last hyphenated segment ("7b" of llama-7b) while the plan and worker
+            # key the whole stem, so advertising ours dispatches an unresolvable variant.
+            quant = canonical_quant_label(name) or quant
+        if _is_mmproj(name) or _is_mtp_drafter(name) or _is_big_endian_gguf_path(name, quant):
+            continue
+        plan = plans.get(quant.lower())
+        if plan is not None:
+            sizes[quant] = plan.download_size_bytes
+        else:
+            sizes[quant] = sizes.get(quant, 0) + int(getattr(sibling, "size", 0) or 0)
+    return sizes
+
+
+def _remaining_bytes(repo_id: str, plan, expected_bytes: int) -> int:
+    """Bytes still to fetch: a resumed quant or a companion shared with another
+    quant is already on disk, and charging for it can 507 a download that fits."""
+    try:
+        from hub.utils.download_registry import existing_blob_bytes
+
+        hashes = frozenset(
+            file.sha256 for file in getattr(plan, "expected_files", ()) or () if file.sha256
+        )
+        if not hashes:
+            return expected_bytes
+        return max(0, expected_bytes - existing_blob_bytes("model", repo_id, hashes))
+    except Exception:
+        return expected_bytes
+
+
+def _enough_disk(need_bytes: int) -> tuple[bool, int]:
+    """(fits, free_bytes). Fail-open on an unreadable cache root: the download
+    worker runs its own preflight, this only adds the reserve margin."""
+    try:
+        from hub.utils.hf_cache_state import hf_cache_root
+
+        root = hf_cache_root(create = True)
+        if root is None:
+            return True, 0
+        free = shutil.disk_usage(root).free
+    except Exception:
+        return True, 0
+    return free >= need_bytes + _DISK_RESERVE_BYTES, free
+
+
+def _gb(num_bytes: int) -> str:
+    return f"{num_bytes / 1024**3:.1f} GB"
+
+
+async def _job_state(repo_id: str, variant: Optional[str]) -> tuple[str, Optional[str]]:
+    from hub.services.models import downloads
+    try:
+        status = await downloads.get_download_status_response(repo_id, variant or "")
+        return status.state, status.error
+    except Exception as exc:
+        # "unknown", not "idle": idle ends the watch, and a failed probe proves nothing.
+        logger.debug("auto-download: status probe failed for %r: %s", repo_id, exc)
+        return "unknown", None
+
+
+async def _progress_percent(
+    repo_id: str, variant: Optional[str], expected_bytes: int, hf_token: Optional[str]
+) -> Optional[float]:
+    """0-100, or None. The hub service reports a 0-1 fraction, so scale it."""
+    from hub.services.models import downloads
+    try:
+        payload = await downloads.get_gguf_download_progress_response(
+            repo_id, variant or "", expected_bytes, hf_token
+        )
+        fraction = payload.get("progress")
+        if not isinstance(fraction, (int, float)):
+            return None
+        return min(100.0, max(0.0, float(fraction) * 100.0))
+    except Exception:
+        return None
+
+
+def _release(active: Optional[_Active]) -> None:
+    """Free the single-flight slot, but only while *active* still owns it.
+
+    Keying on ``repo_id`` alone let a stale operation clear a newer one: variant A
+    errors, an adopting request frees the slot, a retry starts B, then A's watcher
+    matches the repo and clears B, admitting a second download alongside it.
+    """
+    global _active
+    if active is None:
+        return
+    with _lock:
+        if _active is active:
+            _active = None
+
+
+async def _watch(active: _Active, hf_token: Optional[str]) -> None:
+    """Poll a dispatched job so the monitor row resolves and the resolver cache
+    is dropped the moment the weights land."""
+    from core.inference import api_monitor as monitor_module
+
+    api_monitor = monitor_module.api_monitor
+    deadline = time.monotonic() + _MAX_WATCH_S
+    timed_out = False
+    try:
+        while True:
+            await asyncio.sleep(_TIMED_OUT_POLL_S if timed_out else _WATCH_POLL_S)
+            state, error = await _job_state(active.repo_id, active.variant)
+            if state in ("running", "cancelling", "unknown"):
+                if timed_out:
+                    # A running worker still owns the slot: releasing on the clock alone
+                    # would admit a second multi-GB download beside it. "unknown" cannot
+                    # confirm it is alive, so release then, or a broken probe wedges us.
+                    if state == "unknown":
+                        return
+                    continue
+                if time.monotonic() >= deadline:
+                    api_monitor.fail_open(active.monitor_id, "Download timed out")
+                    timed_out = True
+                    continue
+                # Only "running" has progress; the others are still in flight, so keep the slot.
+                if state == "running":
+                    api_monitor.set_progress(
+                        active.monitor_id,
+                        await _progress_percent(
+                            active.repo_id, active.variant, active.expected_bytes, hf_token
+                        ),
+                    )
+                continue
+            if state == "cancelled":
+                api_monitor.finish(active.monitor_id, status = "cancelled")
+                return
+            if state == "complete":
+                # No invalidate here: finalize_worker_exit already dropped the cache and
+                # warmed it; a second would mark that fresh scan stale and push a
+                # synchronous rescan onto the client's retry.
+                api_monitor.finish(active.monitor_id, status = "completed")
+            elif state == "idle":
+                # The job vanished without a terminal state (worker killed).
+                api_monitor.fail_open(active.monitor_id, "Download did not complete")
+            else:
+                api_monitor.fail_open(active.monitor_id, error or f"Download {state}")
+                # Keep the slot so the next retry is told it failed instead of
+                # silently restarting the same download.
+                active.error = error or f"Download {state}"
+                active.failed_at = time.monotonic()
+                return
+            return
+    except asyncio.CancelledError:
+        raise
+    except Exception as exc:
+        logger.warning("auto-download: watcher failed for %r: %s", active.repo_id, exc)
+        api_monitor.fail_open(active.monitor_id, "Download tracking failed")
+    finally:
+        if not active.failed_at:
+            _release(active)
+
+
+def _downloading_refusal(label: str, percent: Optional[float]) -> AutoDownloadRefusal:
+    progress = f" ({percent:.0f}% done)" if percent is not None else ""
+    return AutoDownloadRefusal(
+        status = 503,
+        code = "model_downloading",
+        message = (f"Downloading '{label}'{progress}. Retry shortly. Track it in Unsloth Studio."),
+        retry_after = _RETRY_AFTER_S,
+    )
+
+
+async def _is_downloadable_model(repo_id: str, hf_token: Optional[str]) -> bool:
+    """Whether the Hub has this repo with GGUF weights we could fetch.
+
+    Only asked while another download holds the slot, to tell a second download
+    apart from an ordinary foreign label. Any failure answers False: refusing
+    would strand normal traffic for the length of the download.
+    """
+    if _is_not_servable(repo_id, hf_token):
+        return False
+
+    def _probe():
+        from huggingface_hub import HfApi
+        return HfApi(token = _hub_token(hf_token)).model_info(repo_id, timeout = _MODEL_INFO_TIMEOUT_S)
+
+    try:
+        info = await asyncio.to_thread(_probe)
+    except Exception:
+        return False
+    # The same filter admission uses, not a bare .gguf test: mmproj, MTP drafters and
+    # big-endian builds are companions, not quants. Answering otherwise would hold an
+    # ordinary foreign label at model_download_busy for an unrelated download.
+    servable = bool(_gguf_variants(getattr(info, "siblings", None)))
+    if not servable:
+        _mark_not_servable(repo_id, hf_token)
+    return servable
+
+
+async def maybe_auto_download(
+    requested_model: str,
+    *,
+    hf_token: Optional[str] = None,
+    require_vision: bool = False,
+) -> Optional[AutoDownloadRefusal]:
+    """Start (or report on) a background fetch of *requested_model*.
+
+    Returns None when the request should carry on unchanged, or a refusal the
+    caller must raise. Only called after the local resolver has already missed.
+
+    ``require_vision`` refuses a target with no mmproj companion rather than spend
+    gigabytes on weights that cannot answer the request; the local capability guard
+    only ever sees an already-downloaded model.
+    """
+    global _active
+
+    repo_id, wanted_variant = split_model_ref(requested_model)
+    if not is_downloadable_ref(requested_model):
+        return None
+    if _is_not_servable(repo_id, hf_token) and not looks_like_quant(wanted_variant):
+        return None
+
+    # Settle the single-flight slot before the network, so retries during a download stay cheap.
+    busy: Optional[_Active] = None
+    with _lock:
+        current = _active
+        if current is not None and current.failed_at:
+            # A held failure only owns the slot until someone is told about it.
+            if current.repo_id != repo_id and time.monotonic() - current.failed_at > _FAILED_HOLD_S:
+                _active = current = None
+        if current is not None and current.repo_id == repo_id:
+            adopted = current
+        elif current is not None:
+            adopted = None
+            busy = current
+        else:
+            adopted = None
+            provisional = _Active(repo_id = repo_id, started_at = time.time())
+            _active = provisional
+
+    if busy is not None:
+        # Refusing before the probe blocks ordinary drop-in traffic: a namespaced label
+        # that is no downloadable GGUF repo (LiteLLM/OpenRouter style) would be told to
+        # wait out a multi-hour download. Only a downloadable label is a 2nd download.
+        if not await _is_downloadable_model(repo_id, hf_token):
+            return None
+        return AutoDownloadRefusal(
+            status = 503,
+            code = "model_download_busy",
+            message = (
+                f"Already downloading '{_public_label(busy.repo_id, busy.variant)}'. "
+                f"Retry '{requested_model}' once it finishes."
+            ),
+            retry_after = _RETRY_AFTER_S,
+        )
+
+    if adopted is not None:
+        if adopted.variant is None:
+            # Still probing: no job yet, and a stale whole-repo error would free the probe's slot.
+            return _downloading_refusal(adopted.repo_id, None)
+        state, error = await _job_state(adopted.repo_id, adopted.variant)
+        if state in ("running", "cancelling", "unknown"):
+            return _downloading_refusal(
+                _public_label(adopted.repo_id, adopted.variant),
+                await _progress_percent(
+                    adopted.repo_id, adopted.variant, adopted.expected_bytes, hf_token
+                ),
+            )
+        if state == "error" or adopted.error:
+            error = error or adopted.error
+            # Surface once, then free the slot so a retry can start over.
+            _release(adopted)
+            return AutoDownloadRefusal(
+                status = 502,
+                code = "model_download_failed",
+                message = f"Downloading '{requested_model}' failed: {error or 'unknown error'}",
+            )
+        # complete/idle/cancelled: the watcher is about to free the slot, so retry once more.
+        return _downloading_refusal(
+            _public_label(adopted.repo_id, adopted.variant),
+            100.0 if state == "complete" else None,
+        )
+
+    try:
+        return await _admit_and_start(
+            repo_id, wanted_variant, requested_model, hf_token, provisional, require_vision
+        )
+    except BaseException:
+        # Not `except Exception`: a cancel mid-probe would otherwise wedge the provisional slot.
+        _release(provisional)
+        raise
+
+
+async def _admit_and_start(
+    repo_id: str,
+    wanted_variant: Optional[str],
+    requested_model: str,
+    hf_token: Optional[str],
+    active: _Active,
+    require_vision: bool = False,
+) -> Optional[AutoDownloadRefusal]:
+    from hub.utils.hf_errors import hf_error_status
+
+    def _probe():
+        from huggingface_hub import HfApi
+        return HfApi(token = _hub_token(hf_token)).model_info(
+            repo_id, files_metadata = True, timeout = _MODEL_INFO_TIMEOUT_S
+        )
+
+    try:
+        info = await asyncio.to_thread(_probe)
+    except Exception as exc:
+        _release(active)
+        status = hf_error_status(exc)
+        if status == 401:
+            return AutoDownloadRefusal(
+                status = 401,
+                code = "model_access_denied",
+                message = (
+                    f"Hugging Face rejected the token sent for '{repo_id}'. Replace the "
+                    "X-Unsloth-HF-Token header with a valid token; retrying will not help."
+                ),
+            )
+        if status == 403:
+            return _gated_refusal(repo_id)
+        if status == 404:
+            _mark_not_servable(repo_id, hf_token)
+            # Unknown to the Hub reads as a foreign label; only an explicit quant makes it ours.
+            if not looks_like_quant(wanted_variant):
+                return None
+            # A private repo reads as absent without a token; don't confirm either way.
+            return AutoDownloadRefusal(
+                status = 404,
+                code = "model_not_found",
+                message = (
+                    f"'{repo_id}' was not found on Hugging Face, or is not accessible. "
+                    "If it is private, send a token in the X-Unsloth-HF-Token header."
+                ),
+            )
+        logger.warning("auto-download: Hub lookup failed for %r: %s", repo_id, exc)
+        return AutoDownloadRefusal(
+            status = 503,
+            code = "model_lookup_failed",
+            message = f"Could not reach Hugging Face to look up '{repo_id}'. Retry shortly.",
+            retry_after = _RETRY_AFTER_S,
+        )
+
+    # Inconclusive on timeout: the download's own auth is the real gate.
+    if getattr(info, "gated", False) and await _bounded_probe(
+        _auth_denied, repo_id, hf_token, timeout = _MODEL_INFO_TIMEOUT_S, default = False
+    ):
+        # Metadata for a gated repo is not file access; unchecked, the config read below lies.
+        _release(active)
+        return _gated_refusal(repo_id)
+
+    variants = _gguf_variants(getattr(info, "siblings", None))
+    if not variants:
+        _release(active)
+        _mark_not_servable(repo_id, hf_token)
+        if not looks_like_quant(wanted_variant):
+            return None
+        return AutoDownloadRefusal(
+            status = 400,
+            code = "model_not_supported",
+            message = (
+                f"'{repo_id}' has no GGUF weights. Automatic download serves GGUF only; "
+                "load other formats from Unsloth Studio."
+            ),
+        )
+
+    # trust_remote_code gate: _config_has_auto_map is tri-state, so refuse on True and on None.
+    from utils.security.consent import _config_has_auto_map
+
+    # _hub_token, not the raw token: None lets huggingface_hub fall back to a cached
+    # server login, so a caller-named repo would be probed with this server's identity.
+    # Defaults to None on timeout, which refuses: unchecked is not cleared.
+    has_auto_map = await _bounded_probe(
+        _config_has_auto_map,
+        repo_id,
+        _hub_token(hf_token),
+        timeout = _CODE_PROBE_TIMEOUT_S,
+        default = None,
+    )
+    if has_auto_map is not False:
+        _release(active)
+        unknown = has_auto_map is None
+        return AutoDownloadRefusal(
+            status = 403,
+            code = "remote_code_consent_required",
+            message = (
+                f"'{repo_id}' "
+                + (
+                    "could not be checked for custom code"
+                    if unknown
+                    else "ships custom code that runs on load"
+                )
+                + ". Load it once in Unsloth Studio to review and approve it, then retry."
+            ),
+        )
+
+    variant = _match_variant(wanted_variant, variants)
+    if variant is None:
+        _release(active)
+        listed = sorted(variants)
+        shown = ", ".join(listed[:_MAX_LISTED_VARIANTS])
+        extra = len(listed) - _MAX_LISTED_VARIANTS
+        return AutoDownloadRefusal(
+            status = 404,
+            code = "model_not_found",
+            message = (
+                f"'{repo_id}' has no quant '{wanted_variant}'. Available quants: "
+                f"{shown}{f' and {extra} more' if extra > 0 else ''}."
+            ),
+        )
+
+    expected_bytes = variants[variant]
+    from hub.utils.gguf_plan import build_gguf_variant_plans
+
+    plan = build_gguf_variant_plans(list(getattr(info, "siblings", None) or [])).get(
+        variant.lower()
+    )
+    if require_vision and not (plan and plan.mmproj_filenames):
+        _release(active)
+        return AutoDownloadRefusal(
+            status = 400,
+            code = "invalid_value",
+            message = (
+                f"'{_public_label(repo_id, variant)}' ships no mmproj companion, so it "
+                "cannot answer the image or audio input in this request. It was not "
+                "downloaded."
+            ),
+        )
+
+    need_bytes = _remaining_bytes(repo_id, plan, expected_bytes)
+    fits, free = _enough_disk(need_bytes)
+    if not fits:
+        _release(active)
+        return AutoDownloadRefusal(
+            status = 507,
+            code = "insufficient_disk_space",
+            message = (
+                f"'{_public_label(repo_id, variant)}' needs {_gb(need_bytes)} plus "
+                f"{_gb(_DISK_RESERVE_BYTES)} headroom, but only {_gb(free)} is free."
+            ),
+        )
+
+    return await _dispatch(repo_id, variant, expected_bytes, requested_model, hf_token, active)
+
+
+def preferred_quant(labels) -> Optional[str]:
+    """The quant a plain load would pick from *labels*, or None.
+
+    The one ranking for "which quant did they mean": local resolution, remote
+    admission and /v1/models must agree, or a bare id means a different quant
+    depending on which of them answered it.
+    """
+    from utils.models.model_config import _pick_best_gguf
+
+    # _pick_best_gguf ranks filenames and matches upper-case tokens, so feed "<LABEL>.gguf".
+    synthetic: dict[str, str] = {}
+    for name in labels:
+        synthetic.setdefault(f"{name.upper()}.gguf", name)
+    best = _pick_best_gguf(list(synthetic))
+    return synthetic.get(best) if best else None
+
+
+def _match_variant(wanted: Optional[str], variants: dict[str, int]) -> Optional[str]:
+    """Resolve the requested quant against what the repo actually has.
+
+    An explicit quant matches case-insensitively and must exist: never quietly
+    substitute another, unlike the loader's low-disk fallback. A bare repo id, or a
+    tag that names no quant (":latest", ":8b"), uses the same preference order as a
+    manual load, matching what the local resolver does with the same tag.
+    """
+    if wanted:
+        # Exact first, whatever shape: a repo of generically named GGUFs has real
+        # variants like "llama-13b" that are valid worker keys but not quant-shaped,
+        # and defaulting past one would fetch a model nobody asked for.
+        lowered = {name.lower(): name for name in variants}
+        exact = lowered.get(wanted.strip().lower())
+        if exact is not None or looks_like_quant(wanted):
+            # A quant-shaped suffix that matches nothing is a miss, never a swap.
+            return exact
+    return preferred_quant(variants)
+
+
+async def _dispatch(
+    repo_id: str,
+    variant: str,
+    expected_bytes: int,
+    requested_model: str,
+    hf_token: Optional[str],
+    active: _Active,
+) -> AutoDownloadRefusal:
+    global _active
+
+    from core.inference.api_monitor import api_monitor
+    from hub.schemas.downloads import DownloadModelRequest
+    from hub.services.models import downloads
+
+    label = _public_label(repo_id, variant)
+    busy = AutoDownloadRefusal(
+        status = 503,
+        code = "model_download_busy",
+        message = f"'{repo_id}' is already being downloaded or loaded. Retry shortly.",
+        retry_after = _RETRY_AFTER_S,
+    )
+    try:
+        dispatched = await downloads.download_model_response(
+            DownloadModelRequest(repo_id = repo_id, gguf_variant = variant),
+            hf_token,
+            allow_ambient_token = False,
+        )
+    except Exception as exc:
+        _release(active)
+        status = getattr(exc, "status_code", None)
+        if status == 409:
+            # A manual load or hub download already owns this repo.
+            return busy
+        logger.warning("auto-download: could not start %r: %s", label, exc)
+        return AutoDownloadRefusal(
+            status = 502,
+            code = "model_download_failed",
+            message = f"Could not start downloading '{requested_model}'.",
+        )
+
+    # accepted=False means no worker launched, so report the conflict instead of taking the slot.
+    if isinstance(dispatched, dict) and not dispatched.get("accepted", True):
+        _release(active)
+        logger.info("auto-download: dispatch refused for %s (%s)", label, dispatched.get("state"))
+        return busy
+
+    monitor_id = api_monitor.record_lifecycle(
+        event = "download", model = label, reason = "api", running = True
+    )
+    with _lock:
+        if _active is active:
+            active.variant = variant
+            active.expected_bytes = expected_bytes
+            active.monitor_id = monitor_id
+            tracked = active
+        else:
+            # Released underneath us: track the job we started, but never stomp a newer owner.
+            tracked = _Active(repo_id, variant, expected_bytes, monitor_id, time.time())
+            if _active is None:
+                _active = tracked
+
+    asyncio.create_task(_watch(tracked, hf_token))
+    logger.info("auto-download: started %s (%s)", label, _gb(expected_bytes))
+    return AutoDownloadRefusal(
+        status = 503,
+        code = "model_downloading",
+        message = (
+            f"Downloading '{label}' ({_gb(expected_bytes)}). Retry shortly. "
+            "Track it in Unsloth Studio."
+        ),
+        retry_after = _RETRY_AFTER_S,
+    )
+
+
+def reset_for_tests() -> None:
+    global _active
+    with _lock:
+        _active = None
+    with _cache_lock:
+        _not_servable.clear()
diff --git a/studio/backend/core/inference/orchestrator.py b/studio/backend/core/inference/orchestrator.py
index 616384386d..4699148a08 100644
--- a/studio/backend/core/inference/orchestrator.py
+++ b/studio/backend/core/inference/orchestrator.py
@@ -104,6 +104,14 @@ class InferenceOrchestrator:
         # so a generate queued behind the cancelled one is skipped, not run.
         self._drain_event: Any = None
         self._gen_lock = threading.Lock()  # Serializes generation
+        # Cancel event of the request holding _gen_lock: lets a Stop tell whether it owns the
+        # running generation or is queued behind it (the worker's event is shared).
+        self._active_cancel_events: list = []
+        self._executing_cancel_events: list = []
+        self._active_cancel_lock = threading.Lock()
+        # Held across claim + _send_cmd so claim order matches the subprocess dequeue order,
+        # which _owns_worker relies on.
+        self._send_order_lock = threading.Lock()
         # Set during a switch so a generation winning the _gen_lock handoff bails
         # instead of starting on the outgoing model.
         self._unload_pending = False
@@ -112,6 +120,13 @@ class InferenceOrchestrator:
         # bypass _gen_lock, send commands directly, read from per-request
         # mailboxes routed by a dispatcher thread on request_id.
         self._mailboxes: dict[str, queue.Queue] = {}
+        # request_id -> cancel event, so the dispatcher can move worker ownership as it routes.
+        # Consumers read their mailbox whenever they get to it, so only the dispatcher sees
+        # responses in the order the worker produced them.
+        self._request_cancel_events: dict[str, object] = {}
+        # Mailboxes for the _gen_lock generations. Kept apart from _mailboxes because that map
+        # means "compare requests are in flight" to the unload and distributed paths.
+        self._direct_mailboxes: dict[str, queue.Queue] = {}
         self._mailbox_lock = threading.Lock()
         self._dispatcher_thread: Optional[threading.Thread] = None
         self._dispatcher_stop = threading.Event()
@@ -321,9 +336,27 @@ class InferenceOrchestrator:
         self._resp_queue = None
         self._cancel_event = None
         self._drain_event = None
+        self._reset_worker_scoped_state()
         logger.info("Inference subprocess shut down")
         return True
 
+    def _reset_worker_scoped_state(self) -> None:
+        """Drop bookkeeping that only means anything for the worker that just died.
+
+        Ownership is scoped by cancel-event identity alone, so a consumer still blocked
+        on its mailbox when the process was replaced stayed recorded as the executor. A
+        generation on the fresh worker then failed _owns_worker and could not be stopped.
+        Mailboxes go too: nothing will ever route to them, and a stale one reads as
+        compare activity to the unload path.
+        """
+        with self._active_cancel_lock:
+            self._active_cancel_events.clear()
+            self._executing_cancel_events.clear()
+        with self._mailbox_lock:
+            self._mailboxes.clear()
+            self._direct_mailboxes.clear()
+            self._request_cancel_events.clear()
+
     def _cleanup(self):
         """atexit handler."""
         self._shutdown_subprocess(timeout = 5.0)
@@ -463,6 +496,74 @@ class InferenceOrchestrator:
             except (EOFError, OSError, ValueError):
                 return events
 
+    def _direct_reader(self, request_id: str):
+        """Response reader for a _gen_lock generation, safe once compare exists.
+
+        The dispatcher and this reader would otherwise both consume _resp_queue. A
+        dispatcher started mid-stream took our responses and dropped them as
+        unaddressed (truncating or hanging the chat), and this reader, already blocked
+        on the queue, could take a compare request's response before that dispatcher
+        saw it. Registering a mailbox fixes the first; handing foreign responses to
+        their own mailbox fixes the second.
+
+        Returns (read_one, drain, release).
+        """
+        mailbox: queue.Queue = queue.Queue()
+        with self._mailbox_lock:
+            self._direct_mailboxes[request_id] = mailbox
+
+        def read_one(timeout: float = 1.0):
+            try:
+                return mailbox.get_nowait()
+            except queue.Empty:
+                pass
+            thread = self._dispatcher_thread
+            if thread is not None and thread.is_alive():
+                # It owns the queue now, and it routes to us.
+                try:
+                    return mailbox.get(timeout = timeout)
+                except queue.Empty:
+                    return None
+            resp = self._read_resp(timeout = timeout)
+            if resp is None:
+                return None
+            rid = resp.get("request_id")
+            if rid and rid != request_id:
+                with self._mailbox_lock:
+                    other = self._mailboxes.get(rid) or self._direct_mailboxes.get(rid)
+                    owner = self._request_cancel_events.get(rid)
+                if other is not None:
+                    # We beat the dispatcher to this response, so make its ownership move here
+                    # too. The compare consumer opts out of marking, so nothing else promotes
+                    # or retires that request: skipping it left this one recorded as the
+                    # executor, ignoring its Stop and letting a late reset cancel it.
+                    if owner is not None:
+                        if resp.get("type", "") in ("gen_done", "gen_error"):
+                            self._release_worker(owner)
+                        else:
+                            self._mark_worker_started(owner)
+                    other.put(resp)
+                    return None
+            return resp
+
+        def drain(timeout: float = 5.0) -> None:
+            deadline = time.monotonic() + timeout
+            while time.monotonic() < deadline:
+                resp = read_one(timeout = min(0.5, deadline - time.monotonic()))
+                if resp is None:
+                    if not self._ensure_subprocess_alive():
+                        return
+                    continue
+                if resp.get("type", "") in ("gen_done", "gen_error"):
+                    return
+            logger.warning("Timed out waiting for gen_done after cancel")
+
+        def release() -> None:
+            with self._mailbox_lock:
+                self._direct_mailboxes.pop(request_id, None)
+
+        return read_one, drain, release
+
     def _drain_until_gen_done(self, timeout: float = 5.0) -> None:
         """Consume resp_queue events until gen_done/gen_error, discarding them.
 
@@ -542,6 +643,7 @@ class InferenceOrchestrator:
         cancel_event = None,
         stats_holder: Optional[dict] = None,
         read_timeout: float = 30.0,
+        mark_started: bool = True,
     ) -> Generator[str, None, None]:
         """Yield tokens from a response stream until gen_done/gen_error.
 
@@ -578,6 +680,11 @@ class InferenceOrchestrator:
             rtype = resp.get("type", "")
             if rtype == "status":
                 continue
+            # The worker is answering THIS request, so it is the one executing: only now may its
+            # cancel event speak for the shared worker one. The dispatched path opts out: its
+            # dispatcher already did this in worker order, which a mailbox read can lag behind.
+            if mark_started:
+                self._mark_worker_started(cancel_event)
             # Subprocess-level error (no request_id); request-scoped failures
             # arrive as gen_error below.
             if rtype == "error" and not resp.get("request_id"):
@@ -587,7 +694,13 @@ class InferenceOrchestrator:
             if rtype == "token":
                 # Cancel from route (e.g. SSE connection closed).
                 if cancel_event is not None and cancel_event.is_set():
-                    self._cancel_generation()
+                    # Same rule as reset_generation_state: the shared worker event may only be set by
+                    # the generation the worker is running. A dispatched request can still be draining
+                    # stale mailbox tokens after the dispatcher retired it, and signalling from here
+                    # would end the next one instead. Tearing this stream down is always safe, so the
+                    # local drain happens either way.
+                    if self._owns_worker(cancel_event):
+                        self._cancel_generation()
                     drain_on_cancel()
                     return
                 yield resp.get("text", "")
@@ -681,8 +794,17 @@ class InferenceOrchestrator:
                 # Route to mailbox if a matching request_id exists
                 if rid:
                     with self._mailbox_lock:
-                        mbox = self._mailboxes.get(rid)
+                        mbox = self._mailboxes.get(rid) or self._direct_mailboxes.get(rid)
+                        owner = self._request_cancel_events.get(rid)
                     if mbox is not None:
+                        # Worker order, not consumer order: retire a request the moment its last response
+                        # is routed. Waiting for the consumer's finally left it owning the worker after
+                        # the worker moved on, so a late Stop for it cancelled whichever request started next.
+                        if owner is not None:
+                            if rtype in ("gen_done", "gen_error"):
+                                self._release_worker(owner)
+                            else:
+                                self._mark_worker_started(owner)
                         mbox.put(resp)
                         continue
 
@@ -798,6 +920,8 @@ class InferenceOrchestrator:
             )
             if not unloading:
                 self._mailboxes[request_id] = mailbox
+                if cancel_event is not None:
+                    self._request_cancel_events[request_id] = cancel_event
             # When bailing without a mailbox, note whether any OTHER compare request still
             # routes through the dispatcher; if none and this call started it, stop it below.
             orphaned_dispatcher = unloading and not dispatcher_preexisting and not self._mailboxes
@@ -813,11 +937,19 @@ class InferenceOrchestrator:
             yield GenStreamError("Error: model is being unloaded", public = True)
             return
 
+        # Claim before sending, like the locked path: dispatched runs are concurrent by design,
+        # so without this a Stop on one saw no owner and reset the worker, ending its siblings.
+        # Claim and enqueue under one lock, or two dispatcher threads interleave and claim order
+        # stops matching the subprocess's command order, which _owns_worker reads.
         try:
-            self._send_cmd(cmd)
+            with self._send_order_lock:
+                self._claim_worker(cancel_event)
+                self._send_cmd(cmd)
         except RuntimeError as exc:
+            self._release_worker(cancel_event)
             with self._mailbox_lock:
                 self._mailboxes.pop(request_id, None)
+                self._request_cancel_events.pop(request_id, None)
             yield GenStreamError(f"Error: {exc}")
             return
 
@@ -836,10 +968,15 @@ class InferenceOrchestrator:
                 cancel_event = cancel_event,
                 stats_holder = stats_holder,
                 read_timeout = _DISPATCH_READ_TIMEOUT,
+                mark_started = False,
             )
         finally:
+            # Normally already retired by the dispatcher at gen_done; this covers streams that
+            # end without one (cancel, disconnect, a dead subprocess).
+            self._release_worker(cancel_event)
             with self._mailbox_lock:
                 self._mailboxes.pop(request_id, None)
+                self._request_cancel_events.pop(request_id, None)
 
     def _drain_mailbox(
         self,
@@ -1578,6 +1715,11 @@ class InferenceOrchestrator:
                 # Won the lock handoff during a switch; don't start on the outgoing model.
                 yield GenStreamError("Error: model is being unloaded", public = True)
                 return
+            if cancel_event is not None and cancel_event.is_set():
+                # Stopped while queued on the lock. Sending anyway occupied the worker with a
+                # run the user ended: the cancel is only seen on a token, so a long prefill
+                # (or a generation that reaches gen_done without one) held up its siblings.
+                return
             request_id = str(uuid.uuid4())
             image_b64 = self._pil_to_base64(image) if image is not None else None
             cmd = self._build_generate_cmd(
@@ -1599,22 +1741,95 @@ class InferenceOrchestrator:
                 preserve_thinking = preserve_thinking,
             )
 
+            # Claim the worker BEFORE sending, so a Stop on some OTHER chat -- still queued on the
+            # lock above, having generated nothing -- cannot reset the generation this is starting.
+            # Claiming after the send left the command running unclaimed. Released in the finally.
+            # Own mailbox: a compare request can start the dispatcher while this is streaming,
+            # and it would otherwise consume our responses and drop them.
+            read_one, drain, release_mailbox = self._direct_reader(request_id)
             try:
-                self._send_cmd(cmd)
-            except RuntimeError as exc:
-                yield GenStreamError(f"Error: {exc}")
-                return
+                try:
+                    with self._send_order_lock:
+                        self._claim_worker(cancel_event)
+                        self._send_cmd(cmd)
+                except RuntimeError as exc:
+                    yield GenStreamError(f"Error: {exc}")
+                    return
 
-            yield from self._consume_token_stream(
-                self._read_resp,
-                lambda: self._drain_until_gen_done(timeout = 5.0),
-                crash_context = "generation",
-                cancel_event = cancel_event,
-                stats_holder = stats_holder,
-            )
+                yield from self._consume_token_stream(
+                    read_one,
+                    lambda: drain(timeout = 5.0),
+                    crash_context = "generation",
+                    cancel_event = cancel_event,
+                    stats_holder = stats_holder,
+                )
+            finally:
+                self._release_worker(cancel_event)
+                release_mailbox()
 
-    def reset_generation_state(self):
-        """Cancel any ongoing generation and reset state."""
+    def _claim_worker(self, cancel_event) -> None:
+        """Record this request as one the worker will run.
+
+        Admission only. The subprocess executes generations one at a time, so a
+        dispatched request sitting behind another in the command queue is claimed
+        but not executing, and must not be able to signal the shared cancel event
+        (that would end whichever request IS executing). _mark_worker_started
+        promotes it once the worker answers it.
+        """
+        with self._active_cancel_lock:
+            self._active_cancel_events.append(cancel_event)
+
+    def _mark_worker_started(self, cancel_event) -> None:
+        """Promote a claimed request to executing, on its first worker response.
+
+        Sole executor: the subprocess runs one generation at a time, so answering
+        this one means it has left the previous one behind.
+        """
+        if cancel_event is None:
+            return
+        with self._active_cancel_lock:
+            if self._executing_cancel_events[:1] != [cancel_event]:
+                self._executing_cancel_events[:] = [cancel_event]
+
+    def _release_worker(self, cancel_event) -> None:
+        with self._active_cancel_lock:
+            for bucket in (self._active_cancel_events, self._executing_cancel_events):
+                try:
+                    bucket.remove(cancel_event)
+                except ValueError:
+                    pass
+
+    def _owns_worker(self, cancel_event) -> bool:
+        """Whether a reset from this request may signal the shared cancel event.
+
+        True when it is one of the EXECUTING generations, and when nothing is in
+        flight at all: an error path that resets before anything started has no
+        one else to interrupt, so it must not become a silent no-op. Claimed but
+        queued does not count, or a Stop on a queued request would end the
+        running one, including during the prefill before any response arrives.
+        """
+        with self._active_cancel_lock:
+            if not self._active_cancel_events:
+                # Nothing in flight at all, so there is no one to protect.
+                return True
+            if self._executing_cancel_events:
+                return any(ev is cancel_event for ev in self._executing_cancel_events)
+            # Claimed but nothing has answered yet (A is in prefill). The worker takes commands
+            # in order, so the oldest claim is the executor; anyone else here is queued behind it.
+            return self._active_cancel_events[0] is cancel_event
+
+    def reset_generation_state(self, caller_cancel_event = None):
+        """Cancel any ongoing generation and reset state.
+
+        ``caller_cancel_event`` scopes the reset to one request. The worker has a
+        single cancel event and generation is serialized on _gen_lock, so a chat
+        that is still queued has no generation of its own to reset: calling this
+        from its Stop handler would kill whichever chat currently holds the lock.
+        Pass the request's own event and the reset is dropped unless that request
+        is the one running. Omit it for genuinely global resets (unload, switch).
+        """
+        if caller_cancel_event is not None and not self._owns_worker(caller_cancel_event):
+            return
         self._cancel_generation()
         if not self._ensure_subprocess_alive():
             return
@@ -1673,35 +1888,40 @@ class InferenceOrchestrator:
             if use_adapter is not None:
                 cmd["use_adapter"] = use_adapter
 
-            self._send_cmd(cmd)
+            # Same shared-queue hazard as _generate_inner: see _direct_reader.
+            read_one, _drain, release_mailbox = self._direct_reader(request_id)
+            try:
+                self._send_cmd(cmd)
 
-            deadline = time.monotonic() + 120.0
-            while time.monotonic() < deadline:
-                remaining = max(0.1, deadline - time.monotonic())
-                resp = self._read_resp(timeout = min(remaining, 1.0))
+                deadline = time.monotonic() + 120.0
+                while time.monotonic() < deadline:
+                    remaining = max(0.1, deadline - time.monotonic())
+                    resp = read_one(timeout = min(remaining, 1.0))
 
-                if resp is None:
-                    if not self._ensure_subprocess_alive():
-                        raise RuntimeError(self._subprocess_crash_message("audio generation"))
-                    continue
+                    if resp is None:
+                        if not self._ensure_subprocess_alive():
+                            raise RuntimeError(self._subprocess_crash_message("audio generation"))
+                        continue
 
-                rtype = resp.get("type", "")
+                    rtype = resp.get("type", "")
 
-                if rtype == "audio_done":
-                    wav_bytes = base64.b64decode(resp["wav_base64"])
-                    sample_rate = resp["sample_rate"]
-                    return wav_bytes, sample_rate
+                    if rtype == "audio_done":
+                        wav_bytes = base64.b64decode(resp["wav_base64"])
+                        sample_rate = resp["sample_rate"]
+                        return wav_bytes, sample_rate
 
-                if rtype == "audio_error":
-                    raise RuntimeError(resp.get("error", "Audio generation failed"))
+                    if rtype == "audio_error":
+                        raise RuntimeError(resp.get("error", "Audio generation failed"))
 
-                if rtype == "error":
-                    raise RuntimeError(resp.get("error", "Unknown error"))
+                    if rtype == "error":
+                        raise RuntimeError(resp.get("error", "Unknown error"))
 
-                if rtype == "status":
-                    continue
+                    if rtype == "status":
+                        continue
 
-            raise RuntimeError("Timeout waiting for audio generation (120s)")
+                raise RuntimeError("Timeout waiting for audio generation (120s)")
+            finally:
+                release_mailbox()
 
     def generate_whisper_response(
         self,
@@ -1775,6 +1995,9 @@ class InferenceOrchestrator:
                 # Won the lock handoff during a switch; don't start on the outgoing model.
                 yield GenStreamError("Error: model is being unloaded", public = True)
                 return
+            if cancel_event is not None and cancel_event.is_set():
+                # Stopped while queued on the lock, same as _generate_inner.
+                return
             request_id = str(uuid.uuid4())
 
             # numpy array -> list for mp.Queue serialization
@@ -1797,18 +2020,28 @@ class InferenceOrchestrator:
                 "repetition_penalty": repetition_penalty,
             }
 
+            # Same shared-queue hazard as _generate_inner: see _direct_reader.
+            read_one, drain, release_mailbox = self._direct_reader(request_id)
             try:
-                self._send_cmd(cmd)
-            except RuntimeError as exc:
-                yield GenStreamError(f"Error: {exc}")
-                return
+                try:
+                    # Claim under the send lock, like _generate_inner: unclaimed, a compare request queued
+                    # behind this looked like the oldest owner, so stopping it killed this one.
+                    with self._send_order_lock:
+                        self._claim_worker(cancel_event)
+                        self._send_cmd(cmd)
+                except RuntimeError as exc:
+                    yield GenStreamError(f"Error: {exc}")
+                    return
 
-            yield from self._consume_token_stream(
-                self._read_resp,
-                lambda: self._drain_until_gen_done(timeout = 5.0),
-                crash_context = "audio input generation",
-                cancel_event = cancel_event,
-            )
+                yield from self._consume_token_stream(
+                    read_one,
+                    lambda: drain(timeout = 5.0),
+                    crash_context = "audio input generation",
+                    cancel_event = cancel_event,
+                )
+            finally:
+                self._release_worker(cancel_event)
+                release_mailbox()
 
     # ------------------------------------------------------------------
     # Local helpers (no subprocess needed)
diff --git a/studio/backend/core/inference/safetensors_agentic.py b/studio/backend/core/inference/safetensors_agentic.py
index 9345ce3f87..b593bc119b 100644
--- a/studio/backend/core/inference/safetensors_agentic.py
+++ b/studio/backend/core/inference/safetensors_agentic.py
@@ -59,6 +59,7 @@ from core.tool_healing import (
 from core.inference.tool_loop_controller import (
     ToolLoopController,
     append_deferred_nudges,
+    awaiting_approval_status,
     coerce_tool_arguments,
     status_for_tool,
     tool_event_provenance,
@@ -1209,18 +1210,30 @@ def run_safetensors_tool_loop(
             start_event["awaiting_confirmation"] = needs_confirm
 
             try:
-                yield {"type": "status", "text": decision.status_text}
+                # A gated call has not started: say waiting, not "Running" (GGUF parity).
+                yield {
+                    "type": "status",
+                    "text": (
+                        awaiting_approval_status(decision.tool_name)
+                        if needs_confirm
+                        else decision.status_text
+                    ),
+                }
                 yield start_event
 
-                if (
-                    decision_slot is not None
-                    and wait_tool_decision(
+                _decision = (
+                    wait_tool_decision(
                         decision_slot,
                         approval_id,
                         cancel_event = cancel_event,
                     )
-                    == "deny"
-                ):
+                    if decision_slot is not None
+                    else None
+                )
+                if _decision is not None and _decision != "deny":
+                    # Approved: now it really is running.
+                    yield {"type": "status", "text": decision.status_text}
+                if _decision == "deny":
                     decision_slot = None
                     if provisional_match:
                         provisional_resolved = True
diff --git a/studio/backend/core/inference/tool_loop_controller.py b/studio/backend/core/inference/tool_loop_controller.py
index 361f4b20e3..feedae5874 100644
--- a/studio/backend/core/inference/tool_loop_controller.py
+++ b/studio/backend/core/inference/tool_loop_controller.py
@@ -238,6 +238,19 @@ def status_for_tool(tool_name: str, arguments: Mapping[str, Any]) -> str:
     return f"Calling: {tool_name}"
 
 
+def awaiting_approval_status(tool_name: str) -> str:
+    """Status text for a call parked on the approval prompt.
+
+    It has not started, so reporting "Running ..." with a climbing timer reads
+    as a hang.
+    """
+    if tool_name == "python":
+        return "Waiting for approval: Python"
+    if tool_name == "terminal":
+        return "Waiting for approval: command"
+    return f"Waiting for approval: {tool_name}"
+
+
 def is_tool_error(result: str) -> bool:
     return isinstance(result, str) and result.lstrip().startswith(TOOL_ERROR_PREFIXES)
 
diff --git a/studio/backend/core/inference/tools.py b/studio/backend/core/inference/tools.py
index bd5322819e..0c6e2292bc 100644
--- a/studio/backend/core/inference/tools.py
+++ b/studio/backend/core/inference/tools.py
@@ -3105,6 +3105,22 @@ def is_always_safe_tool(name: str) -> bool:
     return name in _ALWAYS_SAFE_TOOLS
 
 
+# Tools whose provisional card is only a text preview of the arguments, so it can stream
+# while awaiting approval.
+_TEXT_PREVIEW_TOOLS = frozenset({"python", "terminal"})
+
+
+def has_text_only_provisional_card(name: str) -> bool:
+    """True when streaming this tool's arguments before approval shows only text.
+
+    A large code payload takes a minute or more to write, and suppressing the
+    card until the call completes leaves the chat blank the whole time. Nothing
+    runs before the decision either way, and you have to read the code to make
+    it.
+    """
+    return name in _TEXT_PREVIEW_TOOLS
+
+
 def is_potentially_unsafe_tool_call(name: str, arguments: dict) -> bool:
     """Whether a tool call must still pause for approval in auto mode.
 
diff --git a/studio/backend/core/inference/worker.py b/studio/backend/core/inference/worker.py
index 254eda40a3..3f32b3bd57 100644
--- a/studio/backend/core/inference/worker.py
+++ b/studio/backend/core/inference/worker.py
@@ -25,7 +25,7 @@ from pathlib import Path
 from typing import Any
 
 logger = get_logger(__name__)
-from utils.hardware import apply_gpu_ids
+from utils.hardware import apply_gpu_ids, is_apple_silicon
 
 _SHARE_OBJECT_MAX_BYTES = 1 << 20
 _SHARE_OBJECT_ERROR_SIZE = -1
@@ -801,10 +801,7 @@ def run_inference_process(
     # ── 0. MLX fast-path — skip torch/transformers ──
     _ensure_backend_on_path()
 
-    from utils.hardware import hardware as _hw
-
-    _hw.detect_hardware()
-    if _hw.DEVICE == _hw.DeviceType.MLX:
+    if is_apple_silicon():
         # Non-fatal: fall through with the installed version, but log the cause
         # instead of swallowing it (issue #6103).
         try:
@@ -816,6 +813,11 @@ def run_inference_process(
                 model_name,
                 exc,
             )
+
+    from utils.hardware import hardware as _hw
+
+    _hw.detect_hardware()
+    if _hw.DEVICE == _hw.DeviceType.MLX:
         try:
             from core.inference.mlx_inference import MLXInferenceBackend, _init_mlx_distributed
 
diff --git a/studio/backend/hub/services/download_lifecycle.py b/studio/backend/hub/services/download_lifecycle.py
index 8e14427a56..f431f4497e 100644
--- a/studio/backend/hub/services/download_lifecycle.py
+++ b/studio/backend/hub/services/download_lifecycle.py
@@ -58,6 +58,7 @@ def spawn_worker(
     use_xet: bool,
     protected_blob_hashes: Optional[frozenset[str]] = None,
     cache_env: Optional[Mapping[str, str]] = None,
+    allow_ambient_token: bool = True,
 ) -> subprocess.Popen:
     """Spawn the download worker.
 
@@ -83,7 +84,8 @@ def spawn_worker(
     env["HF_HUB_DISABLE_XET"] = "0" if use_xet else "1"
     # No token in Unsloth settings: fall back to the backend's own HF_TOKEN so
     # private repos stay downloadable (needed while inkling repos are private).
-    if not hf_token:
+    # Not for a repo an API caller named: that would lend them the owner's identity.
+    if not hf_token and allow_ambient_token:
         hf_token = os.environ.get("HF_TOKEN") or None
     env["HF_HUB_DISABLE_IMPLICIT_TOKEN"] = "0" if hf_token else "1"
     # hf_transfer's parallel Range chunks can leave sparse partials even in
@@ -239,13 +241,31 @@ def finalize_worker_exit(
     state = classify_exit(rc, cancel_requested = cancel_requested)
     if state == "complete":
         registry.set_job(key, "complete")
+        # Where /v1 learns a new model exists: its resolver answers from a cached scan
+        # with no watcher, so it would report the model absent and serve whatever is
+        # resident. Models only: noting a dataset id as a local model would refuse a
+        # bare request naming it instead of letting a foreign id fall through.
+        if repo_type == "model":
+            try:
+                from core.inference.local_model_resolver import (
+                    invalidate_index,
+                    note_downloaded,
+                    warm_index_soon,
+                )
+
+                note_downloaded(repo_id)
+                invalidate_index()
+                # Rebuild here, not on the first request, to keep the scan off the
+                # request path.
+                warm_index_soon()
+            except Exception:
+                pass
         if transport == download_registry.TRANSPORT_HTTP:
             registry.update_job_transport(key, download_registry.TRANSPORT_HTTP)
         if stderr_text:
             if download_manifest.MANIFEST_DEGRADED_MARKER in stderr_text:
                 logger.warning(
-                    f"{log_prefix} complete with degraded diagnostics for "
-                    f"{label}: {stderr_text}"
+                    f"{log_prefix} complete with degraded diagnostics for {label}: {stderr_text}"
                 )
             else:
                 logger.info(f"{log_prefix} worker diagnostics for {label}: {stderr_text}")
diff --git a/studio/backend/hub/services/models/downloads.py b/studio/backend/hub/services/models/downloads.py
index c93b21c082..5dc4ebef37 100644
--- a/studio/backend/hub/services/models/downloads.py
+++ b/studio/backend/hub/services/models/downloads.py
@@ -91,6 +91,7 @@ def _spawn_download_worker(
     use_xet: bool = True,
     protected_blob_hashes: Optional[frozenset[str]] = None,
     cache_env: Optional[dict[str, str]] = None,
+    allow_ambient_token: bool = True,
 ) -> subprocess.Popen:
     args = ["--repo-id", repo_id]
     if variant:
@@ -101,11 +102,21 @@ def _spawn_download_worker(
         use_xet = use_xet,
         protected_blob_hashes = protected_blob_hashes,
         cache_env = cache_env,
+        allow_ambient_token = allow_ambient_token,
     )
 
 
-async def download_model_response(body: DownloadModelRequest, hf_token: Optional[str] = None):
-    """Start a background download for a HuggingFace model."""
+async def download_model_response(
+    body: DownloadModelRequest,
+    hf_token: Optional[str] = None,
+    *,
+    allow_ambient_token: bool = True,
+):
+    """Start a background download for a HuggingFace model.
+
+    ``allow_ambient_token=False`` keeps the worker anonymous when the caller sent
+    no token, for repos named over the API rather than chosen here.
+    """
     repo_id = body.repo_id.strip()
     if not _is_valid_repo_id(repo_id):
         raise HTTPException(
@@ -218,6 +229,7 @@ async def download_model_response(body: DownloadModelRequest, hf_token: Optional
             use_xet = use_xet,
             protected_blob_hashes = protected_blob_hashes,
             cache_env = cache_env,
+            allow_ambient_token = allow_ambient_token,
         ),
         hf_token = hf_token,
         label = label,
diff --git a/studio/backend/loggers/handlers.py b/studio/backend/loggers/handlers.py
index 716c4f40d2..5d99ca85c6 100644
--- a/studio/backend/loggers/handlers.py
+++ b/studio/backend/loggers/handlers.py
@@ -8,12 +8,19 @@ filter_sensitive_data (structlog processor for sanitization), and
 get_logger (factory for structured loggers).
 """
 
+from __future__ import annotations
+
 import os
 import re
 import time
+from typing import TYPE_CHECKING
 
 import structlog
-from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+# Annotations only: a runtime import makes the ASGI stack a hard dependency of
+# every CLI command.
+if TYPE_CHECKING:
+    from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
 from utils.native_path_leases import redact_native_paths
 
diff --git a/studio/backend/main.py b/studio/backend/main.py
index e632c9525b..02f5a20106 100644
--- a/studio/backend/main.py
+++ b/studio/backend/main.py
@@ -1075,7 +1075,9 @@ async def liveness_check():
         "status": "alive",
         "service": "Unsloth UI Backend",
         "desktop_protocol_version": 1,
-        "desktop_manageability_version": 1,
+        # Lockstep with DESKTOP_MANAGEABILITY_VERSION in
+        # studio/src-tauri/src/preflight/version.rs and `desktop-capabilities`.
+        "desktop_manageability_version": 2,
         "supports_desktop_auth": True,
         "supports_desktop_backend_ownership": True,
         "studio_root_id": _studio_root_id(),
@@ -1098,7 +1100,8 @@ async def health_check(request: Request):
         "service": "Unsloth UI Backend",
         "chat_only": _hw_module.CHAT_ONLY,
         "desktop_protocol_version": 1,
-        "desktop_manageability_version": 1,
+        # Lockstep: see the note in /api/liveness above.
+        "desktop_manageability_version": 2,
         "supports_desktop_auth": True,
         "supports_desktop_backend_ownership": True,
         # Opaque per-install id; launchers reject sibling Studios on the same port.
@@ -1249,16 +1252,18 @@ def _get_cached_system_gpu_info(logger) -> tuple[dict[str, Any], dict[str, Any]]
             )
             enriched_devices.append(enriched_dev)
 
-        # Whether GGUF loads accept an explicit gpu_ids pick: /load and
-        # /validate 400 picks on XPU hosts (no visibility mask speaks torch-xpu
-        # ordinals) and on Vulkan-only builds (--device pins ggml's own
-        # ordinals), so the picker must not offer them.
+        # Whether GGUF loads accept an explicit gpu_ids pick. /load and /validate
+        # 400 picks on XPU hosts, where no visibility mask speaks torch-xpu
+        # ordinals. A Vulkan build IS pinnable: its picks are ggml ordinals, the
+        # same space `--device Vulkan<i>` uses, so check it first and let it
+        # through even on an XPU host (the XPU ban is about torch ordinals).
+        is_vulkan_build = False
         try:
             from core.inference.llama_cpp import LlamaCppBackend
             from utils.hardware import DeviceType, get_device
-            gpu_ids_supported = (
-                get_device() != DeviceType.XPU and not LlamaCppBackend._is_vulkan_backend()
-            )
+
+            is_vulkan_build = LlamaCppBackend._is_vulkan_backend()
+            gpu_ids_supported = is_vulkan_build or get_device() != DeviceType.XPU
         except Exception as e:
             logger.debug(f"Could not resolve gpu_ids support: {e}")
             gpu_ids_supported = True
@@ -1284,7 +1289,9 @@ def _get_cached_system_gpu_info(logger) -> tuple[dict[str, Any], dict[str, Any]]
             inference_gpu_info = (
                 {
                     **vulkan_info,
-                    "gguf_gpu_ids_supported": False,
+                    # Pinnable only once the probe actually enumerated devices:
+                    # without ordinals the frontend has nothing valid to offer.
+                    "gguf_gpu_ids_supported": bool(vulkan_info.get("devices")),
                 }
                 if vulkan_info is not None
                 else gpu_info
diff --git a/studio/backend/models/inference.py b/studio/backend/models/inference.py
index 50ace01052..60a63bfea0 100644
--- a/studio/backend/models/inference.py
+++ b/studio/backend/models/inference.py
@@ -204,12 +204,26 @@ class LoadRequest(BaseModel):
             "auth, UI/server mode) are rejected. Ignored for non-GGUF models."
         ),
     )
+    force_cancel_active: bool = Field(
+        False,
+        description = (
+            "Stop chats still generating instead of refusing with 409. A load "
+            "replaces the llama-server every open conversation decodes on."
+        ),
+    )
 
 
 class UnloadRequest(BaseModel):
     """Request to unload a model"""
 
     model_path: str = Field(..., description = "Model identifier to unload")
+    force_cancel_active: bool = Field(
+        False,
+        description = (
+            "Stop chats still generating instead of refusing with 409. An "
+            "unload takes away the llama-server they are decoding on."
+        ),
+    )
 
 
 class TranscribeRequest(BaseModel):
@@ -373,6 +387,14 @@ class InstallLatestTransformersRequest(BaseModel):
         description = "Exact transformers version to install; must match the current "
         "latest PyPI release reported by /validate.",
     )
+    force_cancel_active: bool = Field(
+        False,
+        description = (
+            "Stop chats still generating instead of refusing with 409. The install "
+            "is a step of the model swap that raised the same prompt, so a client "
+            "that already got consent for that swap can carry it through here."
+        ),
+    )
 
 
 class InstallLatestTransformersResponse(BaseModel):
@@ -2088,7 +2110,8 @@ class AnthropicMessage(BaseModel):
 
 
 class AnthropicTool(BaseModel):
-    # Client tools have input_schema; server tools may only have type/name.
+    # User-defined client tools have input_schema; Anthropic-schema client tools
+    # and server tools use type/name.
     type: Optional[str] = None
     name: Optional[str] = None
     description: Optional[str] = None
diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py
index 8ce7de070f..43e8768eaf 100644
--- a/studio/backend/routes/inference.py
+++ b/studio/backend/routes/inference.py
@@ -28,7 +28,7 @@ import re as _re
 # Model size extraction (shared with core/inference/llama_cpp.py)
 from utils.models import extract_model_size_b as _extract_model_size_b
 
-from utils.api_errors import openai_error_body, anthropic_error_body
+from utils.api_errors import openai_error_body, anthropic_error_body, error_body_for_path
 from utils.upload_limits import STT_AUDIO_B64_MAX_CHARS, STT_AUDIO_RAW_MAX_BYTES
 from hub.dependencies import get_hf_token
 from core.inference.orchestrator import GenStreamError, GenStreamErrorRaised
@@ -387,7 +387,7 @@ def _raise_unsupported_n(path_label: str) -> None:
     _raise_unsupported_openai_parameter("n", f"n > 1 is not supported for {path_label}.")
 
 
-def _sse_streaming_response(content) -> StreamingResponse:
+def _sse_streaming_response(content, *, unstarted_cleanup = None) -> StreamingResponse:
     """A ``text/event-stream`` response with the standard SSE headers used by
     every streaming path here: no client/proxy caching, no proxy buffering, and
     a one-shot connection. Two callers build their response inline instead: the
@@ -409,6 +409,7 @@ def _sse_streaming_response(content) -> StreamingResponse:
             "Connection": "close",
             "X-Accel-Buffering": "no",
         },
+        unstarted_cleanup = unstarted_cleanup,
     )
 
 
@@ -1011,6 +1012,7 @@ try:
         _effective_tensor_parallel,
         _tensor_parallel_matches_loaded,
         extra_args_disable_mmproj,
+        parse_gpu_layers_override,
         parse_split_mode_override,
         resolve_tensor_parallel,
         strip_shadowing_flags,
@@ -1049,6 +1051,7 @@ except ImportError:
         _effective_tensor_parallel,
         _tensor_parallel_matches_loaded,
         extra_args_disable_mmproj,
+        parse_gpu_layers_override,
         parse_split_mode_override,
         resolve_tensor_parallel,
         strip_shadowing_flags,
@@ -1141,7 +1144,7 @@ def _openai_admission_request_path(request: Optional[Request]) -> Optional[str]:
         return None
 
 
-def _openai_admission_log(
+def _llama_admission_log(
     event: str,
     reservation: Optional[LlamaAdmissionReservation] = None,
     *,
@@ -1159,13 +1162,15 @@ def _openai_admission_log(
         wait_ms = int(max(0.0, time.monotonic() - wait_started_at) * 1000)
     log = getattr(logger, level, logger.debug)
     log(
-        "openai admission %s: mode=%s path=%s completion_id=%s capacity=%s active=%s queued=%s wait_ms=%s",
+        "llama admission %s: mode=%s path=%s completion_id=%s "
+        "pool=%s/%s free=%s queued=%s wait_ms=%s",
         event,
         mode,
         _openai_admission_request_path(request),
         completion_id,
-        getattr(snapshot, "capacity", None),
         getattr(snapshot, "active", None),
+        getattr(snapshot, "capacity", None),
+        getattr(snapshot, "free", None),
         getattr(snapshot, "queued", None),
         wait_ms,
     )
@@ -1189,6 +1194,23 @@ def _openai_admission_http_exception(exc: Exception, *, status_code: int) -> HTT
     )
 
 
+def _anthropic_admission_http_exception(exc: Exception, *, status_code: int) -> HTTPException:
+    """Anthropic-shaped error for an admission reject/timeout/cancel (429/503/499)."""
+    snapshot = getattr(exc, "snapshot", None)
+    message = str(exc)
+    if snapshot is not None:
+        message = (
+            f"{message} "
+            f"(active={snapshot.active}, queued={snapshot.queued}, capacity={snapshot.capacity})"
+        )
+    # Types come from ANTHROPIC_TYPE_BY_STATUS (429 -> rate_limit_error, which is
+    # what Anthropic SDKs back off on); overloaded_error is reserved for 529.
+    return HTTPException(
+        status_code = status_code,
+        detail = anthropic_error_body(message, status = status_code),
+    )
+
+
 def _openai_admission_timeout_error(
     reservation: LlamaAdmissionReservation,
 ) -> LlamaAdmissionTimeout:
@@ -1494,6 +1516,24 @@ class _SameTaskStreamingResponse(StreamingResponse):
             await self.background()
 
 
+async def _release_unstarted_anthropic_stream(iterator, prior_cleanup) -> None:
+    """Close a stream whose body never started, running the response's own
+    pre-start hook. aclose() on an unstarted async generator is a no-op, so its
+    finally never runs and anything the builder acquired eagerly (the passthrough
+    cancel tracker) would leak without the hook."""
+    aclose = getattr(iterator, "aclose", None)
+    if aclose is not None:
+        try:
+            await aclose()
+        except Exception:
+            pass
+    if prior_cleanup is not None:
+        try:
+            await prior_cleanup()
+        except Exception:
+            pass
+
+
 def _tracked_cancel_unstarted_cleanup(tracker):
     """unstarted_cleanup that exits ``tracker`` on a pre-start disconnect, when
     the generator's finally (which normally exits it) never runs."""
@@ -1746,6 +1786,7 @@ from models.inference import (
 )
 from core.inference.anthropic_compat import (
     anthropic_messages_to_openai,
+    anthropic_schema_client_tool_kind,
     anthropic_tools_to_openai,
     anthropic_tool_choice_to_openai,
     openai_finish_to_anthropic_stop,
@@ -1755,6 +1796,7 @@ from core.inference.anthropic_compat import (
     AnthropicPassthroughEmitter,
 )
 from auth.authentication import get_current_subject
+from state import active_generations
 from state.tool_approvals import resolve_tool_decision
 
 from core.inference.key_exchange import decrypt_api_key
@@ -2205,11 +2247,38 @@ def _prune_pending(now: float) -> None:
 
 
 class _TrackedCancel:
-    """Register cancel_event in _CANCEL_REGISTRY for the block's duration."""
+    """Register cancel_event in _CANCEL_REGISTRY for the block's duration.
 
-    def __init__(self, event: threading.Event, *keys):
+    Also records the run in state.active_generations so /load and /unload can
+    see which chats a reload would interrupt. Both registries share this event,
+    so either one cancels down the same per-request path.
+    """
+
+    def __init__(
+        self,
+        event: threading.Event,
+        *keys,
+        thread_id = None,
+        model = None,
+        kind = "chat",
+    ):
         self.event = event
         self.keys = tuple(k for k in keys if k)
+        # kind reaches the swap prompt: embeddings and raw completions have no conversation, so
+        # naming them chats would offer to stop something the user never started from a thread.
+        self._active = active_generations.ActiveGeneration(
+            event, thread_id = thread_id, model = model, kind = kind
+        )
+
+    @classmethod
+    def for_payload(cls, event: threading.Event, payload, *keys):
+        """Track the run against the conversation its request names."""
+        return cls(
+            event,
+            *keys,
+            thread_id = getattr(payload, "thread_id", None),
+            model = getattr(payload, "model", None),
+        )
 
     def __enter__(self):
         # Register + consume-pending in one critical section to close the
@@ -2223,6 +2292,7 @@ class _TrackedCancel:
             for k in self.keys:
                 if k and _PENDING_CANCELS.pop(k, None) is not None:
                     should_cancel = True
+        self._active.__enter__()
         if should_cancel:
             self.event.set()
         return self.event
@@ -2236,6 +2306,7 @@ class _TrackedCancel:
                 bucket.discard(self.event)
                 if not bucket:
                     _CANCEL_REGISTRY.pop(k, None)
+        self._active.__exit__(*exc)
         return False
 
 
@@ -3069,12 +3140,36 @@ def _monitor_context_length() -> Optional[int]:
     return None
 
 
+def _lifecycle_model_label(model: Optional[str], variant: Optional[str] = None) -> str:
+    """A path-free ``repo`` / ``repo:QUANT`` label for a monitor lifecycle row."""
+    clean = public_model_id(model) or model or "model"
+    return f"{clean}:{variant}" if variant and ":" not in clean else clean
+
+
+def _close_load_event(
+    entry_id: Optional[str], model: Optional[str], variant: Optional[str]
+) -> None:
+    """Close a monitor load row, relabelled with the id the load resolved: the row
+    opened on the request's model_path, which may be an HF snapshot dir."""
+    api_monitor.relabel(entry_id, _lifecycle_model_label(model, variant))
+    api_monitor.finish(entry_id)
+
+
 def _monitor_active_model() -> Optional[str]:
+    """The loaded model as a client-facing id, quant included when known.
+
+    Cleaned like /v1/models: rendered in the settings UI and served over the public
+    --secure tunnel, so it must never be the on-disk load path.
+    """
     llama_backend = get_llama_cpp_backend()
     if getattr(llama_backend, "is_loaded", False):
-        return getattr(llama_backend, "model_identifier", None)
+        model_id = _llama_public_model_id(llama_backend)
+        variant = getattr(llama_backend, "hf_variant", None)
+        if model_id and variant and ":" not in model_id:
+            return f"{model_id}:{variant}"
+        return model_id
     backend = get_inference_backend()
-    return backend.active_model_name
+    return public_model_id(backend.active_model_name) or backend.active_model_name
 
 
 def _validate_native_gguf_companion(
@@ -3466,15 +3561,38 @@ def _switch_waiter_count() -> int:
         return sum(max(0, count) for count in _auto_switch_waiters.values())
 
 
-async def _wait_for_model_switch_idle(*, current_request_counted: bool) -> None:
+async def _wait_for_model_switch_idle(
+    *,
+    current_request_counted: bool,
+    cancel_pending: bool = False,
+    timeout_s: Optional[float] = None,
+) -> None:
     """Wait until a model replacement cannot interrupt active inference.
 
     The caller holds ``inference_lifecycle_gate``, which prevents new inference
     from starting while existing requests drain. Auto-switch requests that have
     resolved their targets are scheduler waiters, not active generations, so
     exclude them to avoid a queue deadlock.
+
+    ``cancel_pending`` is set by a forced swap that has NOT cancelled yet: the
+    registered generations are the ones it is about to stop, so waiting on them
+    would wait out exactly what the force exists to end. Excluding them lets the
+    drain finish ahead of the cancel, which keeps every check that can still
+    reject the swap in front of the destructive step. Recomputed each poll (not
+    snapshotted) so a generation that ends on its own stops being discounted and
+    the remaining, non-cancellable requests are still waited out.
+
+    ``timeout_s`` bounds the wait and returns rather than raising. Only the
+    post-cancel drains pass it: what they wait on may never observe its cancel
+    (TTS on the subprocess backend has no observer), and they hold the lifecycle
+    gate, so an unbounded wait pins every load and unload behind one
+    uninterruptible generation. Expiring there just proceeds, which is what they
+    do anyway once drained. Pre-cancel drains stay unbounded -- the swap can
+    still be refused, so they must not shorten the protection they provide.
     """
     from core.inference.llama_keepwarm import other_inference_request_count
+
+    deadline = None if timeout_s is None else time.monotonic() + timeout_s
     while True:
         queued_switches = _switch_waiter_count()
         if current_request_counted and queued_switches > 0:
@@ -3483,8 +3601,19 @@ async def _wait_for_model_switch_idle(*, current_request_counted: bool) -> None:
             current_request_counted = current_request_counted,
             include_pending = False,
         )
+        if cancel_pending:
+            active_others -= min(active_others, active_generations.count())
         if active_others <= queued_switches:
             return
+        if deadline is not None and time.monotonic() >= deadline:
+            logger.warning(
+                "model_switch_drain_timed_out",
+                extra = {
+                    "event": "inference.switch_drain_timeout",
+                    "remaining": active_others - queued_switches,
+                },
+            )
+            return
         await asyncio.sleep(0.02)
 
 
@@ -3505,6 +3634,9 @@ _DISABLE_OPENAI_AUTO_SWITCH_SCOPE_KEY = "_unsloth_disable_openai_auto_switch"
 # only restore an idle-freed model, never run the resolver (so a downloaded GGUF
 # literally named "default" can't be swapped to). The NUL keeps it off any index.
 _RELOAD_ONLY_MODEL = "\x00reload-only"
+# One cold scan is worth paying to avoid answering a named model with another,
+# bounded so a pathological install cannot hang the request behind it.
+_COLD_INDEX_WAIT_S = 10.0
 
 
 def _switch_model_for_payload(payload) -> str:
@@ -3590,6 +3722,467 @@ def _no_model_loaded_detail(base: str) -> str:
     )
 
 
+# Cap on ids listed by a "not downloaded" error, so it stays readable in a terminal.
+_MAX_LISTED_AVAILABLE_MODELS = 8
+
+
+def _raw_body_model(body) -> Optional[str]:
+    """The ``model`` a raw-body endpoint was given, else None (same value
+    :func:`_auto_switch_from_request_body` fed the switch hook)."""
+    return body.get("model") if isinstance(body, dict) else None
+
+
+async def _available_model_ids() -> list[str]:
+    """Sorted ids a /v1 request may name, from the catalog ``GET /v1/models``
+    serves, so an error and the listing can't disagree."""
+    return sorted(
+        mid
+        for mid in (m.get("id") for m in await _openai_catalog_objects())
+        if isinstance(mid, str) and mid
+    )
+
+
+def _format_available_models(ids: list[str]) -> str:
+    if not ids:
+        return ""
+    shown = ", ".join(ids[:_MAX_LISTED_AVAILABLE_MODELS])
+    extra = len(ids) - _MAX_LISTED_AVAILABLE_MODELS
+    return f"{shown} and {extra} more" if extra > 0 else shown
+
+
+async def _unavailable_model_message(requested_model: str) -> str:
+    """Why a named model can't serve this request, and what can.
+
+    Auto-switch only loads downloaded GGUFs, so a request naming a real model
+    usually fails because it is not on this machine, which /inference/load cannot
+    fix; say what is actually wrong.
+    """
+    from core.inference.local_model_resolver import (
+        MISS_VARIANT_NOT_FOUND,
+        describe_local_miss,
+    )
+
+    reason, variants = await asyncio.to_thread(describe_local_miss, requested_model)
+    if reason == MISS_VARIANT_NOT_FOUND:
+        # Repo downloaded, only the quant missing: sibling quants beat the catalog.
+        base_id, _, wanted = requested_model.strip().rpartition(":")
+        return (
+            f"The model '{base_id}' is downloaded, but the quant '{wanted}' is not. "
+            f"Available quants: {', '.join(variants)}."
+        )
+    available = _format_available_models(await _available_model_ids())
+    if not available:
+        return (
+            f"The model '{requested_model}' is not downloaded on this server, and no "
+            "models are downloaded yet. Download one in Unsloth Studio."
+        )
+    return (
+        f"The model '{requested_model}' is not downloaded on this server. "
+        f"Available models: {available}. Download more in Unsloth Studio, "
+        "or list them with GET /v1/models."
+    )
+
+
+async def _no_model_loaded_error(
+    base: str, requested_model: Optional[str], fastapi_request: Optional[Request], *, status: int
+):
+    """``(status, detail)`` for the /v1 sites that fail because nothing is loaded.
+
+    Changes only the case the generic text gets wrong (auto-switch on, a model
+    named, that name resolving to nothing local, so the switch silently did
+    nothing) into a 404 model_not_found. Everything else keeps ``status`` and the
+    :func:`_no_model_loaded_detail` text verbatim.
+    """
+    from utils.openai_auto_switch_settings import get_openai_auto_switch_enabled
+    from core.inference.local_model_resolver import resolve_local_gguf
+
+    named = (
+        requested_model
+        if isinstance(requested_model, str)
+        and requested_model.strip()
+        and requested_model != _RELOAD_ONLY_MODEL
+        else None
+    )
+    if named is None or not get_openai_auto_switch_enabled():
+        return status, _no_model_loaded_detail(base)
+    try:
+        if _loaded_satisfies(named):
+            # Resident but on a backend this endpoint can't use, so "not downloaded" is false.
+            return status, _no_model_loaded_detail(base)
+        if await asyncio.to_thread(resolve_local_gguf, named) is not None:
+            # Resolvable but unloaded: the switch failed, which the generic text covers.
+            return status, _no_model_loaded_detail(base)
+        message = await _unavailable_model_message(named)
+    except Exception as exc:
+        # The diagnosis is a nicety; never let it turn a 4xx into a 500.
+        logger.debug("no-model-loaded diagnosis failed for %r: %s", named, exc)
+        return status, _no_model_loaded_detail(base)
+    path = getattr(getattr(fastapi_request, "url", None), "path", None)
+    if not isinstance(path, str):
+        # No request in hand: let the global /v1/* handler pick the envelope.
+        return 404, message
+    return 404, error_body_for_path(
+        path,
+        message,
+        status = 404,
+        code = "model_not_found",
+        param = "model",
+    )
+
+
+def _auto_download_hf_token(fastapi_request: Optional[Request]) -> Optional[str]:
+    """The token to fetch with: only one the caller sent themselves.
+
+    Never the server's ambient token, and never the OpenAI bearer key. The repo is
+    named by whoever holds an API key, so borrowing the owner's Hub identity would
+    let that key pull the owner's private repos and publish them in /v1/models.
+    """
+    from hub.dependencies import HUB_HF_TOKEN_HEADER, HUB_HF_TOKEN_MAX_LENGTH
+
+    headers = getattr(fastapi_request, "headers", None)
+    if headers is None:
+        return None
+    supplied = (headers.get(HUB_HF_TOKEN_HEADER) or "").strip()
+    if supplied and len(supplied) <= HUB_HF_TOKEN_MAX_LENGTH:
+        return supplied
+    return None
+
+
+async def _maybe_auto_download_model(
+    requested_model: str,
+    fastapi_request: Optional[Request],
+    *,
+    require_vision: bool = False,
+) -> None:
+    """Opt-in: start fetching a named GGUF this server doesn't have.
+
+    Raises to stop the request while the model is downloading or cannot be fetched.
+    Off by default, and never fires on a name not shaped like a Hub repo, so an
+    unknown id like "gpt-4" still falls through to the resident model.
+    """
+    from utils.openai_auto_switch_settings import get_openai_auto_download_enabled
+    from core.inference.openai_auto_download import is_downloadable_ref, maybe_auto_download
+
+    if not requested_model or not get_openai_auto_download_enabled():
+        return
+    if not is_downloadable_ref(requested_model):
+        return
+    # An Ollama-style tag (":latest") names no quant, so the resolver misses a servable model.
+    if _loaded_satisfies(requested_model):
+        return
+    try:
+        refusal = await maybe_auto_download(
+            requested_model,
+            hf_token = _auto_download_hf_token(fastapi_request),
+            require_vision = require_vision,
+        )
+    except Exception as exc:
+        # Never turn a servable request into a 500 over the download attempt.
+        logger.warning("auto-download failed for %r: %s", requested_model, exc)
+        return
+    if refusal is None:
+        return
+    path = getattr(getattr(fastapi_request, "url", None), "path", None)
+    detail = (
+        error_body_for_path(
+            path,
+            refusal.message,
+            status = refusal.status,
+            code = refusal.code,
+            param = "model",
+        )
+        if isinstance(path, str)
+        else refusal.message
+    )
+    raise HTTPException(
+        status_code = refusal.status,
+        detail = detail,
+        headers = ({"Retry-After": str(refusal.retry_after)} if refusal.retry_after else None),
+    )
+
+
+def _loaded_satisfies(requested: str) -> bool:
+    """Whether what is serving right now actually answers to *requested*.
+
+    A bare ``org/model`` is satisfied by any loaded quant of that repo; an explicit
+    ``:QUANT`` must match the loaded one.
+    """
+    from core.inference.openai_auto_download import looks_like_quant, split_model_ref
+
+    base, variant = split_model_ref(requested)
+    llama_backend = get_llama_cpp_backend()
+    if getattr(llama_backend, "is_loaded", False):
+        candidates = [
+            candidate
+            for candidate in (
+                getattr(llama_backend, "model_identifier", None),
+                getattr(llama_backend, "_openai_advertised_id", None),
+                _llama_public_model_id(llama_backend),
+            )
+            if candidate
+        ]
+        if not _matches_any(base, candidates):
+            return False
+        if not looks_like_quant(variant):
+            # An Ollama-style tag (":latest", ":8b") names no file, so the repo is enough.
+            return True
+        return (getattr(llama_backend, "hf_variant", None) or "").lower() == variant.lower()
+    active = getattr(get_inference_backend(), "active_model_name", None)
+    if not active:
+        return False
+    # Only llama.cpp carries a quant identity, so this backend can only match on the repo.
+    if looks_like_quant(variant):
+        return False
+    return _matches_any(base, [active, public_model_id(active)])
+
+
+def _raise_still_indexing(requested_model: str, fastapi_request) -> None:
+    """Refuse a name we cannot yet place, rather than answer it with another model."""
+    path = getattr(getattr(fastapi_request, "url", None), "path", None)
+    message = (
+        f"This server is still indexing its local models, so it cannot confirm "
+        f"'{requested_model}' yet. Retry shortly."
+    )
+    raise HTTPException(
+        status_code = 503,
+        detail = (
+            error_body_for_path(path, message, status = 503, code = "model_indexing")
+            if isinstance(path, str)
+            else message
+        ),
+        headers = {"Retry-After": "5"},
+    )
+
+
+def _matches_any(requested: str, candidates) -> bool:
+    """Whether *requested* names any of *candidates*.
+
+    A repo alias is case-insensitive, a filesystem path is not: lowercasing both
+    made /srv/models/foo.gguf and /srv/models/Foo.gguf the same weights.
+    """
+    lowered = requested.strip().lower()
+    for candidate in candidates:
+        if not candidate:
+            continue
+        if _looks_like_local_path(requested) or _looks_like_local_path(candidate):
+            if _norm_path(requested) == _norm_path(candidate):
+                return True
+            continue
+        if lowered == str(candidate).strip().lower():
+            return True
+    return False
+
+
+def _looks_like_local_path(value: str) -> bool:
+    """A filesystem path rather than a repo id, so case matters."""
+    text = str(value)
+    return text.startswith("/") or text.startswith("~") or ":\\" in text or "\\" in text
+
+
+def _norm_path(value: str) -> str:
+    """Compare-ready path. normcase, not lower: on a case-sensitive filesystem
+    /srv/models/Foo and /srv/models/foo are different models."""
+    import os
+
+    # normcase after, not before: on Windows it folds case *and* rewrites "/" to a
+    # backslash, leaving the descendant checks below comparing against a path with none.
+    return os.path.normcase(str(value)).replace("\\", "/").rstrip("/")
+
+
+def _resident_quant_is(variant: Optional[str]) -> bool:
+    """Whether the loaded GGUF is that exact quant."""
+    resident = getattr(get_llama_cpp_backend(), "hf_variant", None) or ""
+    return bool(variant) and resident.lower() == variant.strip().lower()
+
+
+def _resolves_to_resident(load_path: Optional[str], *, llama_only: bool = False) -> bool:
+    """Whether a resolved on-disk path is what is already loaded.
+
+    ``llama_only`` drops the Transformers backend: only llama.cpp carries a quant
+    identity, so a Transformers model active from a directory that also holds GGUF
+    exports would otherwise answer a request for one of those quants.
+    """
+    if not load_path:
+        return False
+    target = _norm_path(load_path)
+    llama_backend = get_llama_cpp_backend()
+    for candidate in (
+        getattr(llama_backend, "gguf_path", None)
+        if getattr(llama_backend, "is_loaded", False)
+        else None,
+        getattr(llama_backend, "model_identifier", None)
+        if getattr(llama_backend, "is_loaded", False)
+        else None,
+        None if llama_only else getattr(get_inference_backend(), "active_model_name", None),
+    ):
+        if not candidate:
+            continue
+        current = _norm_path(candidate)
+        if current == target:
+            return True
+        if current.startswith(f"{target}/"):
+            # A model directory holding the weights loaded from it. Nested entries
+            # (/models/A alongside /models/A/sub/B) matched too, so a request for A was
+            # answered with B. The innermost indexed model owns the file; with none
+            # indexed there is no nesting to tell apart, so keep matching.
+            owner = _innermost_indexed_owner(current)
+            if owner is None or owner == target:
+                return True
+            continue
+        if target.startswith(f"{current}/"):
+            return True
+    return False
+
+
+def _innermost_indexed_owner(path: str) -> Optional[str]:
+    """Longest catalog-listed model path containing *path*, or None if none does."""
+    best = None
+    for info in _CATALOG_CACHE["models"] or ():
+        listed = getattr(info, "path", None)
+        if not listed:
+            continue
+        normalized = _norm_path(listed)
+        if path == normalized or path.startswith(f"{normalized}/"):
+            if best is None or len(normalized) > len(best):
+                best = normalized
+    return best
+
+
+async def _reject_unservable_model(
+    requested_model: Optional[str], fastapi_request: Optional[Request]
+) -> None:
+    """Refuse rather than answer a named model with a different one.
+
+    Only for a reference this server can tell was meant for it: an explicit GGUF
+    quant, or a model that is actually here. A namespace decides nothing either way
+    (``vendor/model`` is how LiteLLM and OpenRouter name every provider, and a
+    standalone GGUF is advertised without one), so a slashless id that resolves
+    locally is still a concrete reference. Only runs while something is serving:
+    with nothing loaded, :func:`_no_model_loaded_error` already says the right thing.
+    """
+    from core.inference.openai_auto_download import looks_like_quant, split_model_ref
+
+    if (
+        not isinstance(requested_model, str)
+        or not requested_model.strip()
+        or requested_model == _RELOAD_ONLY_MODEL
+    ):
+        return
+    base, variant = split_model_ref(requested_model)
+    quantified = looks_like_quant(variant)
+    from core.inference.local_model_resolver import (
+        index_is_built,
+        recently_downloaded,
+        resolve_local_gguf,
+        warm_index_soon,
+    )
+    from utils.openai_auto_switch_settings import get_openai_auto_switch_enabled
+
+    still_indexing = False
+    try:
+        if _loaded_satisfies(requested_model):
+            return
+        if not (
+            get_llama_cpp_backend().is_loaded
+            or getattr(get_inference_backend(), "active_model_name", None)
+        ):
+            return
+        # Refresh in the background and read the index as-is: scanning here would stall the
+        # request, and a cold index only costs evidence (the gate below fails safe without it).
+        if index_is_built():
+            warm_index_soon()
+            resolved = resolve_local_gguf(requested_model, allow_scan = False)
+        else:
+            # Nothing cached to reason from yet, and falling through would answer a
+            # named model with the resident one. Pay the scan once, off the loop and
+            # bounded, rather than read "not scanned yet" as "not here".
+            try:
+                resolved = await asyncio.wait_for(
+                    asyncio.to_thread(resolve_local_gguf, requested_model),
+                    _COLD_INDEX_WAIT_S,
+                )
+            except (TimeoutError, asyncio.TimeoutError):
+                # Still scanning, so nothing is known about this name: say "not yet"
+                # rather than guess and put the resident model behind it.
+                warm_index_soon()
+                still_indexing = True
+                resolved = None
+        # A manual load stores the on-disk path the resolver advertises under an alias,
+        # so match on the path too. Quants of one repo share a directory, so the path
+        # alone cannot tell them apart: without the variant check an explicit :Q8_0
+        # would be answered by a resident Q4_K_M.
+        if (
+            resolved is not None
+            and _resolves_to_resident(resolved[0], llama_only = quantified)
+            and (not quantified or _resident_quant_is(variant))
+        ):
+            return
+        downloaded = resolved is not None
+        # /v1/models may have advertised this id off its own scan while the index is cold.
+        advertised = _advertised_local_path(base)
+        if (
+            advertised is not None
+            and _resolves_to_resident(advertised, llama_only = quantified)
+            and (not quantified or _resident_quant_is(variant))
+        ):
+            return
+        # The exact ref may miss on the quant alone, so ask about the repo too.
+        here = (
+            downloaded
+            or advertised is not None
+            # Just landed, so no scan has indexed it yet and neither of the above sees it.
+            or recently_downloaded(base)
+            or (variant is not None and resolve_local_gguf(base, allow_scan = False) is not None)
+        )
+        switchable = downloaded and get_openai_auto_switch_enabled()
+    except HTTPException:
+        # A refusal decided above is the answer, not a failure to decide: without this
+        # the handler below logs it and falls through to the resident model.
+        raise
+    except Exception as exc:
+        # Can't verify: an explicit quant still proves intent, so refuse; let anything else by.
+        logger.debug("unservable-model check failed for %r: %s", requested_model, exc)
+        if not quantified:
+            return
+        downloaded = here = switchable = False
+    if still_indexing:
+        _raise_still_indexing(requested_model, fastapi_request)
+    if not (quantified or here):
+        return
+    if switchable:
+        # On disk and switching allowed, so the swap failed: the resident model is wrong weights.
+        status_code, code = 503, "model_switch_failed"
+        message = (
+            f"The model '{requested_model}' is downloaded, but this server could not "
+            "switch to it. Retry shortly, or load it in Unsloth Studio."
+        )
+    elif downloaded:
+        status_code, code = 404, "model_not_found"
+        message = (
+            f"The model '{requested_model}' is downloaded but not loaded, and "
+            "'Switch model by request' is off, so this server can only serve the "
+            "loaded model. Turn it on in Unsloth Studio under Settings > API."
+        )
+    else:
+        status_code, code = 404, "model_not_found"
+        try:
+            message = await _unavailable_model_message(requested_model)
+        except Exception as exc:
+            # Only the wording is uncertain; the mismatch is already established.
+            logger.debug("unavailable-model diagnosis failed for %r: %s", requested_model, exc)
+            message = f"The model '{requested_model}' is not the model this server is serving."
+    path = getattr(getattr(fastapi_request, "url", None), "path", None)
+    raise HTTPException(
+        status_code = status_code,
+        detail = (
+            error_body_for_path(path, message, status = status_code, code = code, param = "model")
+            if isinstance(path, str)
+            else message
+        ),
+        headers = {"Retry-After": "5"} if status_code == 503 else None,
+    )
+
+
 async def _maybe_auto_switch_model(
     requested_model: Optional[str],
     fastapi_request: Request,
@@ -3601,7 +4194,8 @@ async def _maybe_auto_switch_model(
 
     No-op unless enabled and ``requested_model`` resolves to a downloaded local
     model different from the loaded one. Unknown names fall through (drop-in
-    compat) and no remote download is triggered. ``require_vision`` rejects a swap
+    compat); a miss only reaches the network when auto-download is also on, and
+    even then only for ``namespace/name`` ids. ``require_vision`` rejects a swap
     to a text-only target before it runs, so an image request can't evict the
     resident vision model only to 400 afterwards.
     """
@@ -3631,6 +4225,8 @@ async def _maybe_auto_switch_model(
     # loop freed is restored on the next request. The resolver-based switch still
     # requires the auto-switch toggle.
     if not auto_switch_on and get_auto_unload_idle_seconds() <= 0:
+        # No switching to do, but a named model must still not be answered by another.
+        await _reject_unservable_model(requested_model, fastapi_request)
         return
 
     async def _resolve_and_switch() -> None:
@@ -3644,6 +4240,11 @@ async def _maybe_auto_switch_model(
             else None
         )
         if resolved is None:
+            # Not on disk. Opt-in: fetch in the background and ask the caller to retry.
+            if auto_switch_on and not reload_only:
+                await _maybe_auto_download_model(
+                    requested_model, fastapi_request, require_vision = require_vision
+                )
             # Idle-unload may have freed the model; reload exactly what it freed
             # (path + quant + advertised id) so an alias/unknown name stays servable
             # and keeps the override keyed by the advertised id, not the load path.
@@ -3670,7 +4271,13 @@ async def _maybe_auto_switch_model(
         backend = get_llama_cpp_backend()
         # A bare model id (no :VARIANT) is satisfied by any loaded quant of that
         # repo, so it never reloads a different local quant that already serves it.
-        bare = ":" not in requested_model
+        from core.inference.openai_auto_download import looks_like_quant, split_model_ref
+
+        # A tag that names no quant (":latest", ":8b") means the repo, as
+        # _loaded_satisfies and the resolver read it. Treating it as a quant tears down
+        # a serving Q8 to load the preferred Q4 for a request either satisfies.
+        _, _requested_variant = split_model_ref(requested_model)
+        bare = not looks_like_quant(_requested_variant)
 
         def _already_serving() -> bool:
             # Match against both the concrete load path and the advertised repo id,
@@ -3774,6 +4381,8 @@ async def _maybe_auto_switch_model(
                 _note_switch_waiter(key, -1)
 
     await _resolve_and_switch()
+    # The switch may have missed, so refuse rather than answer as whatever is resident.
+    await _reject_unservable_model(requested_model, fastapi_request)
 
 
 async def _auto_switch_from_request_body(request: Request, current_subject: str):
@@ -4280,6 +4889,214 @@ def _raise_if_sidecar_swap_in_progress() -> None:
         )
 
 
+def _raise_or_cancel_active_generations(
+    *,
+    force: bool,
+    action: str,
+    cancel: bool = True,
+) -> int:
+    """Gate a model swap on the chats currently generating.
+
+    Every open conversation decodes on the single llama-server this route is
+    about to replace, so refuse with 409 and name them. force_cancel_active
+    instead stops them through the same events an explicit Stop uses. Returns
+    how many were cancelled. The frontend guard is bypassable from a second tab
+    or curl; this one is not.
+
+    ``cancel = False`` runs the refusal half only. /load calls it that way once
+    up front, so a non-forced swap still fails fast, and again with cancel just
+    before teardown: cancelling is destructive and unrecoverable, so it must not
+    run ahead of preflight checks that can still reject the load (see
+    _load_model_impl).
+    """
+    if not active_generations.count():
+        return 0
+    if not force:
+        thread_ids = active_generations.active_thread_ids()
+        running = active_generations.count()
+        raise HTTPException(
+            status_code = 409,
+            detail = {
+                "error": "active_generations",
+                "message": (
+                    f"{action} would stop {running} chat"
+                    f"{'s' if running != 1 else ''} that "
+                    f"{'are' if running != 1 else 'is'} still generating. "
+                    "Stop them first, or retry with force_cancel_active."
+                ),
+                "running": running,
+                "thread_ids": thread_ids,
+            },
+        )
+    if not cancel:
+        # Refusal-only pass: the caller cancels later, once nothing can still reject the load.
+        return 0
+    cancelled = active_generations.cancel_all()
+    if cancelled:
+        logger.info(
+            "model_swap_cancelled_active_generations",
+            extra = {"event": "inference.reload_cancelled_generations", "count": cancelled},
+        )
+    return cancelled
+
+
+_POST_CANCEL_DRAIN_TIMEOUT_S = 5.0
+
+
+async def _cancel_and_drain_for_sidecar_swap(timeout_s: Optional[float] = None) -> None:
+    """Clear the way for a confirmed sidecar swap, then stop the chats it interrupts.
+
+    The installer gates on the middleware's in-flight count, not on
+    active_generations, so it also sees requests the cancel cannot stop. Drain
+    those FIRST, discounting the registered chats (they are what the cancel is
+    for, so waiting on them would wait out the point of the force). Only then
+    cancel, and let the survivors unwind. Cancelling first meant an unrelated
+    counted request -- a /v1/messages/count_tokens, say -- was still there for
+    the caller's recheck, which then refused an install that had already stopped
+    every chat for nothing.
+
+    Bounded on both halves: the requests being waited on may never observe a
+    cancel, and this holds the lifecycle gate and the sidecar reservation inside
+    ``asyncio.shield``, so an unbounded wait would wedge the process. Expiring in
+    the first half returns without cancelling, so the caller's recheck refuses
+    with the chats untouched.
+    """
+    from core.inference.llama_keepwarm import other_inference_request_count
+
+    budget = _POST_CANCEL_DRAIN_TIMEOUT_S if timeout_s is None else timeout_s
+
+    async def _drain(deadline: float, *, discount_registered: bool) -> bool:
+        while True:
+            counted = other_inference_request_count(
+                current_request_counted = False, include_pending = False
+            )
+            if discount_registered:
+                counted -= min(counted, active_generations.count())
+            if counted <= 0:
+                return True
+            if time.monotonic() >= deadline:
+                return False
+            await asyncio.sleep(0.02)
+
+    # Weighted, not halved, so the total wait under the gate is unchanged. The first drain only
+    # asks whether unrelated inference is in flight; cutting the second short refused installs
+    # whose chats had already been stopped for nothing.
+    if not await _drain(time.monotonic() + budget / 5, discount_registered = True):
+        return
+    _raise_or_cancel_active_generations(force = True, action = "Installing a new transformers version")
+    await _drain(time.monotonic() + budget * 4 / 5, discount_registered = False)
+
+
+async def _drain_and_recancel_before_teardown(*, force: bool, action: str) -> None:
+    """Wait out inference the registry cannot see, then stop anything new.
+
+    A request that passed the keep-warm middleware but has not reached its
+    ``_TrackedCancel`` yet is counted in-flight and absent from the registry, so
+    cancelling on the registry alone lets a teardown land on an already-admitted
+    request. Drain on the middleware count instead, which covers both the runs
+    just cancelled and the ones still in that window, then cancel again for
+    anything that registered while waiting.
+
+    Bounded and non-raising: an unload is a deliberate user action, so the worst
+    case stays what it is today rather than becoming a refusal.
+    """
+    await _wait_for_model_switch_idle(
+        current_request_counted = False,
+        timeout_s = _POST_CANCEL_DRAIN_TIMEOUT_S,
+    )
+    if force:
+        _raise_or_cancel_active_generations(force = True, action = action)
+
+
+_UNRESOLVED_BACKEND_STATE = object()
+
+
+def _unload_evicts_standard_backend(backend, model_path: str) -> bool:
+    """Whether ``backend.unload_model(model_path)`` will really evict something.
+
+    The standard backend refuses to unload a name it never loaded ("don't unload
+    a stale model") and returns success, so /unload for a model another tab has
+    already replaced is a no-op. That must not count as a teardown: cancelling
+    the running chats for it would end them and leave the resident model up.
+
+    Mirrors the backend's own guard (case-insensitive on the active name, since
+    the load path canonicalizes casing). A backend that exposes neither field is
+    reported as a real unload, which keeps the previous behaviour.
+    """
+    active = getattr(backend, "active_model_name", _UNRESOLVED_BACKEND_STATE)
+    loaded = getattr(backend, "models", _UNRESOLVED_BACKEND_STATE)
+    if active is _UNRESOLVED_BACKEND_STATE and loaded is _UNRESOLVED_BACKEND_STATE:
+        return True
+    if isinstance(active, str) and active and active.lower() == (model_path or "").lower():
+        return True
+    return isinstance(loaded, dict) and model_path in loaded
+
+
+def _unload_may_evict(model_path: str) -> bool:
+    """Whether POST /unload for ``model_path`` can still tear something down.
+
+    The refusal passes gate on this. A request naming a model another tab has
+    already replaced reaches none of the teardown branches and returns the
+    documented idempotent no-op (see _unload_evicts_standard_backend), so
+    refusing it counts a teardown that cannot happen and leaves a stale tab
+    unable to clear its selection. Each disjunct mirrors one teardown branch, so
+    True means "some branch may fire", never "this unload succeeds".
+
+    Attribute reads only, no lifecycle gate, so the pre-gate pass still fails
+    fast on a swap that would really stop chats. A stale answer is safe in both
+    directions: the gated pass re-runs this under the gate, and every branch
+    re-runs the refusal at its own point of no return, so a False here can never
+    let a teardown through unrefused.
+    """
+    backend = get_inference_backend()
+    loading = getattr(backend, "get_loading_model", lambda: None)()
+    if (
+        loading is not None
+        and hasattr(backend, "cancel_load")
+        and (model_path == loading or model_path.lower() == loading.lower())
+    ):
+        return True
+    llama_backend = get_llama_cpp_backend()
+    if llama_backend.is_active and (
+        llama_backend.model_identifier == model_path
+        or is_registered_native_path_label(llama_backend.model_identifier, model_path)
+        # Up but not serving is mid-load, evicted whatever model was named.
+        or not llama_backend.is_loaded
+    ):
+        return True
+    return _unload_evicts_standard_backend(backend, model_path)
+
+
+@studio_router.get("/active-generations")
+async def get_active_generations(
+    fastapi_request: Request, current_subject: str = Depends(get_current_subject)
+):
+    """Conversations currently generating, plus how many can decode at once.
+
+    Lets a model swap name the chats it would interrupt, including runs this tab
+    cannot see (another tab, or a reload behind a proxy). parallel_slots is the
+    slot count actually in use, which the VRAM fit may have cut below the
+    requested --parallel; chats beyond it queue rather than fail.
+    """
+    entries = active_generations.snapshot()
+    # A tracker's model can be a native local path (the legacy stream records active_model_name
+    # verbatim); redact here, the one place that serialises it.
+    for _entry in entries:
+        if isinstance(_entry.get("model"), str):
+            _entry["model"] = redact_native_paths(_entry["model"])
+    slots = 1
+    try:
+        slots = _openai_llama_admission_capacity(fastapi_request, get_llama_cpp_backend())
+    except Exception:
+        slots = int(getattr(fastapi_request.app.state, "llama_parallel_slots", 1) or 1)
+    return {
+        "active": entries,
+        "count": len(entries),
+        "thread_ids": active_generations.active_thread_ids(),
+        "parallel_slots": max(1, int(slots)),
+    }
+
+
 @router.post("/load", response_model = LoadResponse)
 async def load_model(
     request: LoadRequest,
@@ -4307,7 +5124,18 @@ async def load_model(
     # holds this gate.
     async with inference_lifecycle_gate():
         _raise_if_sidecar_swap_in_progress()
-        return await _load_model_impl(request, fastapi_request, current_subject)
+        # The active-generation gate runs inside _load_model_impl, once it knows this is a real
+        # reload, and still under the lifecycle gate so the check stays atomic with the teardown.
+        return await _load_model_impl(
+            request,
+            fastapi_request,
+            current_subject,
+            on_reload_confirmed = lambda *, cancel: _raise_or_cancel_active_generations(
+                force = request.force_cancel_active,
+                action = "Loading a model",
+                cancel = cancel,
+            ),
+        )
 
 
 async def _load_model_impl(
@@ -4316,6 +5144,7 @@ async def _load_model_impl(
     current_subject: str,
     *,
     current_request_counted: bool = False,
+    on_reload_confirmed = None,
 ):
     from core.inference.llama_cpp import LlamaServerNotFoundError
 
@@ -4323,6 +5152,13 @@ async def _load_model_impl(
     # sampled step logs even if it reports 100% immediately (cached/small load).
     _reset_load_progress_step()
 
+    # Live "loading" row: discarded if already loaded, relabelled on the real id, closed on exit.
+    _load_event = api_monitor.record_lifecycle(
+        event = "load",
+        model = _lifecycle_model_label(request.model_path, request.gguf_variant),
+        running = True,
+    )
+
     native_grant_backed = False
     model_log_label = request.model_path
     gguf_load_stack = ExitStack()
@@ -4344,11 +5180,16 @@ async def _load_model_impl(
             None if request.llama_extra_args is None else extra_llama_args
         )
 
-        # Manual mode owns the offload flags: strip them from EXPLICIT extras
-        # too (the inherited path already does), or a last-wins --gpu-layers /
-        # --fit in extras re-enables GPU offload on a load status reports as
-        # CPU-only. Manual + per-GPU ratio owns --tensor-split the same way.
+        # Manual mode owns the offload flags. Preserve an explicit layer count
+        # by translating its last-wins value into the first-class field before
+        # stripping the raw flags. This keeps CLI pass-through such as
+        # ``-ngl 20`` from being silently replaced by the manual default (-1).
+        # The inherited path already strips offload flags. Manual + per-GPU
+        # ratio owns --tensor-split the same way.
         if request.gpu_memory_mode == "manual" and extra_llama_args:
+            _gpu_layers_override = parse_gpu_layers_override(extra_llama_args)
+            if _gpu_layers_override is not None:
+                request = request.model_copy(update = {"gpu_layers": _gpu_layers_override})
             _stripped_explicit = strip_shadowing_flags(
                 extra_llama_args,
                 strip_context = False,
@@ -4398,11 +5239,13 @@ async def _load_model_impl(
         # server-wide --parallel launch default. Used by the dedupe below, the
         # training-coexistence guard, and the GGUF load kwargs, so every sizing
         # path sees the value the launch will use. app.state itself is never
-        # mutated: it stays the launch intent / admission fallback.
+        # mutated: it stays the launch intent / admission fallback. Reached via
+        # getattr because direct callers pass a request without an app.
+        _app_state = getattr(getattr(fastapi_request, "app", None), "state", None)
         _n_parallel = (
             request.n_parallel
             if request.n_parallel is not None
-            else getattr(fastapi_request.app.state, "llama_parallel_slots", 1)
+            else getattr(_app_state, "llama_parallel_slots", 1)
         )
 
         is_direct_gguf_request = model_identifier.lower().endswith(".gguf")
@@ -4428,6 +5271,8 @@ async def _load_model_impl(
                 and getattr(llama_backend, "_audio_probed", True)
             ):
                 llama_backend._record_matching_gpu_request(request.gpu_ids)
+                # Nothing was loaded, so the monitor must not show a load row.
+                api_monitor.discard(_load_event)
                 logger.info(
                     "Model already loaded (GGUF): "
                     f"{model_log_label} variant={request.gguf_variant or llama_backend.hf_variant}, skipping reload"
@@ -4482,6 +5327,7 @@ async def _load_model_impl(
                 backend.active_model_name
                 and backend.active_model_name.lower() == model_identifier.lower()
             ):
+                api_monitor.discard(_load_event)  # nothing loaded, no monitor row
                 logger.info(f"Model already loaded (Unsloth): {model_log_label}, skipping reload")
                 inference_config = load_inference_config(backend.active_model_name)
                 _model_info = backend.models.get(backend.active_model_name, {})
@@ -4523,6 +5369,19 @@ async def _load_model_impl(
                     chat_template = _chat_template,
                 )
 
+        # Past every already_loaded fast return, so this really will replace the running model: gate
+        # it on the chats that would stop. Refusal only, so a non-forced swap fails fast; the checks
+        # between here and the teardown (identifier, GPU, training guard, downloads) can still
+        # reject the load, and cancelling now would stop every chat for a model that never loads.
+        # Auto-switch passes no hook and keeps its current behaviour.
+        if on_reload_confirmed is not None:
+            on_reload_confirmed(cancel = False)
+
+        # Destructive cancel still owed at the teardown below, so it can be deferred past every
+        # remaining check; the drains key off this. Only a forced swap cancels: unforced already
+        # 409'd above, auto-switch has no hook.
+        cancel_pending = on_reload_confirmed is not None and bool(request.force_cancel_active)
+
         # is_lora auto-detected from adapter_config.json on disk/HF.
         # DNS-probe wrap so offline loads skip 30-60s of soft-failed network
         # checks before the worker starts.
@@ -4636,13 +5495,33 @@ async def _load_model_impl(
                         ),
                     )
 
-            # Keep the resident model alive until every active generation finishes;
-            # the caller's lifecycle gate blocks new starts.
-            await _wait_for_model_switch_idle(current_request_counted = current_request_counted)
-            # A sidecar install can reserve the gate while inference drains, after the
-            # route-level checks above, so recheck before replacing either backend.
+            # Fast path only: a swap can still be reserved during the drain.
             _raise_if_sidecar_swap_in_progress()
 
+            # Drain active generations first (the lifecycle gate blocks new starts); a forced swap
+            # excludes the ones it is about to cancel rather than waiting them out.
+            await _wait_for_model_switch_idle(
+                current_request_counted = current_request_counted,
+                cancel_pending = cancel_pending,
+            )
+            # Decisive recheck, and the last thing that can reject this load, so it runs BEFORE the
+            # cancel: rejecting after would stop every chat for nothing.
+            _raise_if_sidecar_swap_in_progress()
+
+            # Point of no return for the GGUF path: nothing left can reject this load, so stop the
+            # chats the swap interrupts (or refuse, if the caller never opted in).
+            if on_reload_confirmed is not None:
+                on_reload_confirmed(cancel = True)
+
+            # Let the cancelled generations unwind before the teardown; no check follows, so this cannot
+            # strand a cancelled chat behind a 409. Bounded: TTS observes no cancel event, so an
+            # unbounded wait would hold the gate for a whole audio run.
+            if cancel_pending:
+                await _wait_for_model_switch_idle(
+                    current_request_counted = current_request_counted,
+                    timeout_s = _POST_CANCEL_DRAIN_TIMEOUT_S,
+                )
+
             # Unload any active Unsloth model only after every hub conflict check.
             if unsloth_backend.active_model_name:
                 logger.info(
@@ -4793,6 +5672,11 @@ async def _load_model_impl(
             logger.info(
                 f"Loaded GGUF model via llama-server: {model_log_label if native_grant_backed else config.identifier}"
             )
+            _close_load_event(
+                _load_event,
+                model_log_label if native_grant_backed else config.identifier,
+                request.gguf_variant or getattr(llama_backend, "hf_variant", None),
+            )
             # Clear any idle-unload reload stash now, not only on the next poll.
             from core.inference.llama_keepwarm import note_model_loaded
 
@@ -4853,10 +5737,27 @@ async def _load_model_impl(
         # ── Standard path: load via Unsloth/transformers ──────────
         backend = get_inference_backend()
 
-        # Unload any active GGUF model first
-        llama_backend = get_llama_cpp_backend()
-        await _wait_for_model_switch_idle(current_request_counted = current_request_counted)
+        # Same sidecar rejection as GGUF: fast path ahead of the drain, rechecked after.
         _raise_if_sidecar_swap_in_progress()
+
+        llama_backend = get_llama_cpp_backend()
+        await _wait_for_model_switch_idle(
+            current_request_counted = current_request_counted,
+            cancel_pending = cancel_pending,
+        )
+        _raise_if_sidecar_swap_in_progress()
+
+        # Point of no return for the Unsloth path: cancel only once nothing can still reject the load.
+        if on_reload_confirmed is not None:
+            on_reload_confirmed(cancel = True)
+
+        # Let the cancelled generations unwind before the teardown; no check follows. Bounded like GGUF.
+        if cancel_pending:
+            await _wait_for_model_switch_idle(
+                current_request_counted = current_request_counted,
+                timeout_s = _POST_CANCEL_DRAIN_TIMEOUT_S,
+            )
+        # Unload any active GGUF model first
         if llama_backend.is_loaded:
             logger.info("Unloading GGUF model before loading Unsloth model")
             llama_backend.unload_model()
@@ -4912,6 +5813,9 @@ async def _load_model_impl(
         logger.info(
             f"Loaded model: {model_log_label if native_grant_backed else config.identifier}"
         )
+        _close_load_event(
+            _load_event, model_log_label if native_grant_backed else config.identifier, None
+        )
         # Clear any idle-unload reload stash: a manual load supersedes an idle-freed
         # GGUF, so the next /v1 request must not resurrect it. Mirror the GGUF branch
         # above; without this a non-GGUF load leaves a stale stash until the idle
@@ -5034,6 +5938,8 @@ async def _load_model_impl(
         raise HTTPException(status_code = 500, detail = f"Failed to load model: {msg}")
     finally:
         gguf_load_stack.close()
+        # Catch-all: an error or cancelled load would otherwise leave the row "loading".
+        api_monitor.fail_open(_load_event, "Load did not complete")
 
 
 def _requires_trust_remote_code_for_model(
@@ -5228,10 +6134,11 @@ async def validate_model(
                 n_parallel = (
                     request.n_parallel
                     if request.n_parallel is not None
-                    else (
-                        getattr(fastapi_request.app.state, "llama_parallel_slots", 1)
-                        if fastapi_request is not None
-                        else 1
+                    # Same getattr chain as the load path: preflight must size like the load.
+                    else getattr(
+                        getattr(getattr(fastapi_request, "app", None), "state", None),
+                        "llama_parallel_slots",
+                        1,
                     )
                 ),
                 gpu_memory_mode = request.gpu_memory_mode,
@@ -5454,7 +6361,13 @@ async def install_latest_transformers_route(
             other_inference_request_count,
         )
 
-        if other_inference_request_count(current_request_counted = False, include_pending = False) > 0:
+        # A confirmed swap skips only this fast path; the recheck under the gate still has to pass,
+        # so the guard is unchanged for anyone who did not confirm.
+        if (
+            not request.force_cancel_active
+            and other_inference_request_count(current_request_counted = False, include_pending = False)
+            > 0
+        ):
             raise HTTPException(
                 status_code = 409,
                 detail = (
@@ -5548,9 +6461,16 @@ async def install_latest_transformers_route(
                             "Retry the install."
                         ),
                     )
+                # Carry a confirmed swap's decision through: the user already accepted the "stop N
+                # chats" prompt, and refusing here would make that answer unactionable (Retry
+                # cannot succeed while the same chats run). Deliberately LAST, after every check
+                # that can still reject the install, so the cancel is spent only once nothing can
+                # turn this request away -- /load's rule.
+                if request.force_cancel_active:
+                    await _cancel_and_drain_for_sidecar_swap()
                 # Recheck under the gate: new streams bump their in-flight count while
-                # holding it, so once held nothing slips past (the pre-gate check is only
-                # a fast path and can be outlasted by a wait on a long /load).
+                # holding it, so once held nothing slips past. A forced install that could
+                # not drain in time lands here too, for the same 409 as without the flag.
                 if (
                     other_inference_request_count(
                         current_request_counted = False, include_pending = False
@@ -5602,9 +6522,9 @@ async def unload_model(request: UnloadRequest, current_subject: str = Depends(ge
     from core.inference.llama_keepwarm import inference_lifecycle_gate, note_model_unloaded
     try:
         # "Stop loading" (frontend cancelLoading -> /unload) must abort a still-loading
-        # model promptly. /load holds the lifecycle gate for the whole (multi-minute) load,
-        # so gating first would make the cancel wait it out. cancel_load only tears the
-        # loading subprocess down (no unload command), so it is safe off-gate.
+        # model promptly, and /load holds the lifecycle gate for the whole load. cancel_load only
+        # tears the loading subprocess down, so it is safe off-gate -- and ahead of the
+        # active-generation refusal below, which it can never need (see there).
         backend = get_inference_backend()
         loading = getattr(backend, "get_loading_model", lambda: None)()
         if (
@@ -5617,13 +6537,11 @@ async def unload_model(request: UnloadRequest, current_subject: str = Depends(ge
                 logger.info(f"Cancelled in-flight load: {request.model_path}")
                 return UnloadResponse(status = "unloaded", model = request.model_path)
 
-        # Same "stop loading" fast path for a still-loading GGUF (llama-server spawned,
-        # health check not yet passed). A gated unload would wait out the multi-minute
-        # load; unload_model() sets the cancel_event load_model polls off its own lock and
-        # kills the child, sending no worker command, so it is safe off-gate like
-        # cancel_load. The gated GGUF branch below handles the already-loaded case. Gate on
-        # the loading model (identifier or native label): the single llama-server loads one
-        # GGUF at a time, so an unload for a different model must not cancel this load.
+        # Same "stop loading" fast path for a still-loading GGUF (spawned, health check not passed).
+        # unload_model() sets the cancel_event load_model polls and kills the child without a
+        # worker command, so it is safe off-gate like cancel_load; the gated branch below handles
+        # the already-loaded case. Gated on the loading model so an unload for a different model
+        # cannot cancel this load.
         llama_backend = get_llama_cpp_backend()
         if (
             llama_backend.is_active
@@ -5640,11 +6558,35 @@ async def unload_model(request: UnloadRequest, current_subject: str = Depends(ge
             logger.info(f"Cancelled in-flight GGUF load: {request.model_path}")
             return UnloadResponse(status = "unloaded", model = request.model_path)
 
+        # Same gate as /load: refusal only, so a non-forced unload fails fast before queueing on the
+        # lifecycle gate. Skipped when no teardown branch can fire, or a request naming a model
+        # another tab already replaced would 409 on chats it cannot interrupt.
+        #
+        # BEHIND the two "stop loading" fast paths above: both cancel a load that has not replaced
+        # anything yet, so neither can interrupt a chat, and refusing them counted a teardown that
+        # cannot happen (unretryably -- the frontend's Cancel sends this unload unforced and drops
+        # the error). Any other name still falls through here.
+        if _unload_may_evict(request.model_path):
+            _raise_or_cancel_active_generations(
+                force = request.force_cancel_active,
+                action = "Unloading the model",
+                cancel = False,
+            )
+
         # Serialize with /load under the same lifecycle gate: the Unsloth unload now runs
         # off the event loop (asyncio.to_thread), so without this a concurrent /load could
         # swap in a fresh subprocess mid-unload and the unload command would land on the
         # new worker. The gate makes load and unload exclusive.
         async with inference_lifecycle_gate():
+            # Rechecked under the gate, like /load: a chat can register while this one queues here (the
+            # middleware takes and releases the same gate). Still refusal only, and re-read rather
+            # than carried down, since a load may have finished meanwhile.
+            if _unload_may_evict(request.model_path):
+                _raise_or_cancel_active_generations(
+                    force = request.force_cancel_active,
+                    action = "Unloading the model",
+                    cancel = False,
+                )
             # Check if the GGUF backend has this model loaded or is loading it.
             llama_backend = get_llama_cpp_backend()
             if llama_backend.is_active and (
@@ -5654,10 +6596,28 @@ async def unload_model(request: UnloadRequest, current_subject: str = Depends(ge
                 )
                 or not llama_backend.is_loaded
             ):
-                # A manual unload is a deliberate user action: tear down now even if a
-                # request is mid-stream (only the automatic idle loop defers to it).
+                # Read the identity before teardown clears it, so the row reads repo:QUANT.
+                _unloaded = _llama_public_model_id(llama_backend, request.model_path)
+                _unloaded_variant = getattr(llama_backend, "hf_variant", None)
+                # Point of no return: this really does replace the running server, so stop the
+                # chats. A manual unload is a deliberate user action, so it cancels mid-stream
+                # requests rather than deferring to them the way the automatic idle loop does.
+                _raise_or_cancel_active_generations(
+                    force = request.force_cancel_active, action = "Unloading the model"
+                )
+                # Let what we just cancelled unwind first, like /load: tearing the server down under
+                # streams told to stop but not yet finished turned a clean end into a dropped
+                # connection. Bounded, since a manual unload is deliberate.
+                await _drain_and_recancel_before_teardown(
+                    force = request.force_cancel_active, action = "Unloading the model"
+                )
                 llama_backend.unload_model()
                 note_model_unloaded()
+                api_monitor.record_lifecycle(
+                    event = "unload",
+                    model = _lifecycle_model_label(_unloaded, _unloaded_variant),
+                    reason = "manual",
+                )
                 logger.info(f"Unloaded GGUF model: {request.model_path}")
                 return UnloadResponse(status = "unloaded", model = request.model_path)
 
@@ -5665,11 +6625,27 @@ async def unload_model(request: UnloadRequest, current_subject: str = Depends(ge
             # a slow SSE stream paused between tokens still holds, so a sync call would block
             # the loop that drives the stream's next token and the lock release.
             backend = get_inference_backend()
+            if _unload_evicts_standard_backend(backend, request.model_path):
+                # Point of no return for the standard path, same rule as above.
+                _raise_or_cancel_active_generations(
+                    force = request.force_cancel_active, action = "Unloading the model"
+                )
+                await _drain_and_recancel_before_teardown(
+                    force = request.force_cancel_active, action = "Unloading the model"
+                )
             await asyncio.to_thread(backend.unload_model, request.model_path)
             note_model_unloaded()
+            api_monitor.record_lifecycle(
+                event = "unload",
+                model = _lifecycle_model_label(request.model_path),
+                reason = "manual",
+            )
             logger.info(f"Unloaded model: {request.model_path}")
             return UnloadResponse(status = "unloaded", model = request.model_path)
 
+    except HTTPException:
+        # Typed refusals (the gate's 409) must not be rewritten as a 500 below.
+        raise
     except Exception as e:
         logger.error(f"Error unloading model: {e}", exc_info = True)
         raise HTTPException(status_code = 500, detail = "Failed to unload model")
@@ -5818,6 +6794,12 @@ async def generate_stream(
         disconnect_watcher = asyncio.create_task(
             _await_disconnect_then_cancel(fastapi_request, cancel_event)
         )
+        # Registered inside the generator, under the finally that unregisters it, so a response whose
+        # body never starts leaves nothing behind. Unregistered, this run passes /unload's 409 gate
+        # (which runs no idle drain) and a forced swap has no event to signal. GenerateRequest
+        # carries no thread_id: counted, not nameable.
+        _tracker = _TrackedCancel(cancel_event, model = backend.active_model_name)
+        _tracker.__enter__()
         try:
             gen = backend.generate_chat_response(
                 messages = request.messages,
@@ -5838,7 +6820,7 @@ async def generate_stream(
                     # Watcher set cancel_event between chunks. Reset here: closing
                     # the generator does not signal a subprocess backend, so it would
                     # keep decoding. The finally's reset is guarded, so no double-run.
-                    backend.reset_generation_state()
+                    backend.reset_generation_state(cancel_event)
                     break
                 chunk = await asyncio.to_thread(next, gen, _DONE)
                 if chunk is _DONE:
@@ -5854,24 +6836,28 @@ async def generate_stream(
 
         except asyncio.CancelledError:
             cancel_event.set()
-            backend.reset_generation_state()
+            backend.reset_generation_state(cancel_event)
             raise
         except Exception as e:
             cancel_event.set()
-            backend.reset_generation_state()
+            backend.reset_generation_state(cancel_event)
             logger.error(f"Error during generation: {e}", exc_info = True)
             yield f"data: {json.dumps({'error': _friendly_error(e)})}\n\n"
             yield "data: [DONE]\n\n"
         finally:
-            await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
-            if not completed and not cancel_event.is_set():
-                cancel_event.set()
-                backend.reset_generation_state()
-            if gen is not None:
-                try:
-                    await asyncio.to_thread(gen.close)
-                except (RuntimeError, ValueError):
-                    pass
+            # Nested so a teardown failure still unregisters; a phantom entry 409s swaps.
+            try:
+                await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+                if not completed and not cancel_event.is_set():
+                    cancel_event.set()
+                    backend.reset_generation_state(cancel_event)
+                if gen is not None:
+                    try:
+                        await asyncio.to_thread(gen.close)
+                    except (RuntimeError, ValueError):
+                        pass
+            finally:
+                _tracker.__exit__(None, None, None)
 
     return _sse_streaming_response(stream())
 
@@ -5921,6 +6907,9 @@ async def get_status(current_subject: str = Depends(get_current_subject)):
                 and os.path.isabs(_model_id)
             ):
                 _display_model_id = os.path.basename(_model_id)
+            elif not _native_grant_backed and _display_model_id == _model_id:
+                # No label registered, so report the clean public id, not the snapshot's sha.
+                _display_model_id = _llama_public_model_id(llama_backend) or _display_model_id
             _inference_cfg = load_inference_config(_model_id) if _model_id else None
             _audio_type = getattr(llama_backend, "_audio_type", None)
             # Don't surface Unsloth's auto-applied bundled family template (e.g. the
@@ -6136,6 +7125,10 @@ async def generate_audio(
     # the idle-stash restore runs here; switching TTS models is an explicit /load.
     await _maybe_auto_switch_model(_RELOAD_ONLY_MODEL, request, current_subject)
 
+    # Created before the backend pick so the GGUF lambda can close over it; the registration
+    # that arms it is below, once the model name is known.
+    _audio_cancel = threading.Event()
+
     # Pick backend — both return (wav_bytes, sample_rate)
     llama_backend = get_llama_cpp_backend()
     if llama_backend.is_loaded and getattr(llama_backend, "_is_audio", False):
@@ -6152,6 +7145,7 @@ async def generate_audio(
             min_p = payload.min_p,
             max_new_tokens = _effective_max_tokens(payload) or 2048,
             repetition_penalty = payload.repetition_penalty,
+            cancel_event = _audio_cancel,
         )
     else:
         backend = get_inference_backend()
@@ -6180,11 +7174,30 @@ async def generate_audio(
     # /audio/generate route and the chat-completions audio branches that delegate here.
     _fill_recommended_sampling_openai(payload, _audio_model_id)
 
-    try:
-        wav_bytes, sample_rate = await asyncio.to_thread(gen)
-    except Exception as e:
-        logger.error(f"Audio generation error: {e}", exc_info = True)
-        raise HTTPException(status_code = 500, detail = safe_error_detail(e))
+    # TTS holds the model for the whole request, so unregistered a non-forced swap counted zero
+    # generations and tore the model down mid-generation. The GGUF path observes the event; the
+    # subprocess backend blocks on its response queue with no cancel plumbing, so there it is
+    # only advisory -- which is why the swap drains are bounded. No cancel keys: /cancel
+    # addresses streams, and this route has none.
+    with _TrackedCancel(
+        _audio_cancel,
+        thread_id = getattr(payload, "thread_id", None),
+        model = model_name,
+        kind = "audio",
+    ):
+        # Stop in the UI aborts the fetch and nothing more, and this route has no cancel id to
+        # address, so without watching the disconnect llama-server kept generating for the rest
+        # of the request timeout after the chat had already reported it stopped.
+        _audio_watcher = asyncio.create_task(_await_disconnect_then_cancel(request, _audio_cancel))
+        try:
+            wav_bytes, sample_rate = await asyncio.to_thread(gen)
+        except Exception as e:
+            if _audio_cancel.is_set():
+                raise HTTPException(status_code = 499, detail = "Audio generation cancelled")
+            logger.error(f"Audio generation error: {e}", exc_info = True)
+            raise HTTPException(status_code = 500, detail = safe_error_detail(e))
+        finally:
+            await _stop_local_disconnect_cancel_watcher(_audio_watcher)
 
     audio_b64 = base64.b64encode(wav_bytes).decode("ascii")
     return JSONResponse(
@@ -7800,10 +8813,13 @@ async def openai_chat_completions(
     else:
         backend = get_inference_backend()
         if not backend.active_model_name:
-            raise HTTPException(
-                status_code = 400,
-                detail = _no_model_loaded_detail("No model loaded. Call POST /inference/load first."),
+            _status, _detail = await _no_model_loaded_error(
+                "No model loaded. Call POST /inference/load first.",
+                _switch_model_for_payload(payload),
+                request,
+                status = 400,
             )
+            raise HTTPException(status_code = _status, detail = _detail)
         # Clean public id so the response never echoes a local path; the audio
         # branch below receives this sanitized label too.
         model_name = public_model_id(backend.active_model_name) or payload.model
@@ -7873,7 +8889,7 @@ async def openai_chat_completions(
 
             if payload.stream:
                 _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
-                _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+                _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
                 _tracker.__enter__()
 
                 async def audio_input_stream():
@@ -7939,6 +8955,12 @@ async def openai_chat_completions(
                     },
                 )
             else:
+                # `stream` defaults to False, so this is the ordinary shape of an audio-input chat and it
+                # holds the worker for the whole request. Unregistered, a swap counted zero generations
+                # and cancelled it instead of 409ing (/unload runs no idle drain).
+                _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
+                _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
+                _tracker.__enter__()
                 try:
                     full_text = ""
                     for chunk_text in audio_input_generate():
@@ -7952,6 +8974,9 @@ async def openai_chat_completions(
                 except Exception as e:
                     api_monitor.fail(monitor_id, _friendly_error(e))
                     raise
+                finally:
+                    # Nested under the except arms too: api_monitor.fail() can throw, and a leaked entry 409s swaps.
+                    _tracker.__exit__(None, None, None)
                 api_monitor.set_reply(monitor_id, full_text)
                 api_monitor.finish(monitor_id)
                 response = ChatCompletion(
@@ -8110,7 +9135,7 @@ async def openai_chat_completions(
                 monitor_id = monitor_id,
             )
         _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
-        _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+        _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
         _tracker.__enter__()
         try:
             return await _openai_passthrough_non_streaming(
@@ -8333,7 +9358,7 @@ async def openai_chat_completions(
                     llama_backend = llama_backend,
                 )
             except LlamaAdmissionQueueFull as exc:
-                _openai_admission_log(
+                _llama_admission_log(
                     "queue-full",
                     snapshot = exc.snapshot,
                     request = request,
@@ -8347,13 +9372,37 @@ async def openai_chat_completions(
             _tool_sentinel = object()
 
             _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
-            _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+            _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
             _tracker.__enter__()
 
             async def gguf_tool_stream():
                 gen = None
                 next_task = None
                 stream_completed = False
+                # A call parked on the approval prompt is not decoding, so it gives its slot back;
+                # otherwise unanswered prompts hold every slot.
+                _parked = False
+
+                async def _park_admission(on: bool, *, wait: bool = True):
+                    nonlocal _parked
+                    if on == _parked:
+                        return
+                    # This run's own lease, not a fresh lookup: queues are keyed by base_url and a
+                    # reload mints a new port, so re-resolving could release someone else's slot.
+                    lease = reservation.lease_nowait()
+                    if lease is None:
+                        return
+                    if on:
+                        lease.park()
+                    elif wait:
+                        # Resuming: park() may have handed our slot to a waiter, so wait for room instead
+                        # of putting two holders on one slot.
+                        await lease.unpark_async(cancel_event = cancel_event)
+                    else:
+                        # Tearing down; the lease is released separately.
+                        lease.unpark()
+                    _parked = on
+
                 disconnect_watcher = asyncio.create_task(
                     _await_disconnect_then_cancel(request, cancel_event)
                 )
@@ -8413,6 +9462,12 @@ async def openai_chat_completions(
                         if event is _tool_sentinel:
                             break
 
+                        # Anything after the gated tool_start means the user answered.
+                        if not (
+                            event["type"] == "tool_start" and event.get("awaiting_confirmation")
+                        ):
+                            await _park_admission(False)
+
                         if event["type"] == "heartbeat":
                             # Tool-wrapper heartbeat while a server-side tool blocks; keeps SSE alive.
                             yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
@@ -8451,6 +9506,8 @@ async def openai_chat_completions(
                                     yield chunk
                                 prev_text = ""
                                 reasoning_extractor = _new_chat_reasoning_extractor()
+                                # Yielded just before the loop blocks on the user.
+                                await _park_admission(bool(event.get("awaiting_confirmation")))
                             yield f"data: {json.dumps(event)}\n\n"
                             continue
 
@@ -8534,6 +9591,8 @@ async def openai_chat_completions(
                     error_chunk = _openai_stream_error_chunk(e)
                     yield _openai_stream_error_sse(error_chunk)
                 finally:
+                    # A disconnect mid-approval must not leave a slot parked.
+                    await _park_admission(False, wait = False)
                     try:
                         if not stream_completed:
                             cancel_event.set()
@@ -8571,7 +9630,7 @@ async def openai_chat_completions(
                 admission_wait_started_at = None
                 if stream_lease is None:
                     admission_wait_started_at = time.monotonic()
-                    _openai_admission_log(
+                    _llama_admission_log(
                         "queued",
                         reservation,
                         request = request,
@@ -8596,7 +9655,7 @@ async def openai_chat_completions(
                                     yield wait_item
                                     continue
                                 lease = wait_item
-                                _openai_admission_log(
+                                _llama_admission_log(
                                     "granted-after-wait",
                                     reservation,
                                     request = request,
@@ -8627,7 +9686,7 @@ async def openai_chat_completions(
                                 cancelled = stream_cancelled,
                             )
                     except LlamaAdmissionTimeout as exc:
-                        _openai_admission_log(
+                        _llama_admission_log(
                             "timeout",
                             reservation,
                             request = request,
@@ -8641,7 +9700,7 @@ async def openai_chat_completions(
                             _openai_admission_error_body(exc, status_code = 503)
                         )
                     except LlamaAdmissionCancelled:
-                        _openai_admission_log(
+                        _llama_admission_log(
                             "cancelled-before-upstream",
                             reservation,
                             request = request,
@@ -8752,7 +9811,7 @@ async def openai_chat_completions(
             try:
                 if reservation.lease_nowait() is None:
                     admission_wait_started_at = time.monotonic()
-                    _openai_admission_log(
+                    _llama_admission_log(
                         "queued",
                         reservation,
                         request = request,
@@ -8767,7 +9826,7 @@ async def openai_chat_completions(
                     cancel_event = cancel_event,
                 )
                 if admission_wait_started_at is not None:
-                    _openai_admission_log(
+                    _llama_admission_log(
                         "granted-after-wait",
                         reservation,
                         request = request,
@@ -8838,7 +9897,7 @@ async def openai_chat_completions(
                 _tracker.__exit__(None, None, None)
                 raise
             except LlamaAdmissionTimeout as exc:
-                _openai_admission_log(
+                _llama_admission_log(
                     "timeout",
                     reservation,
                     request = request,
@@ -8853,7 +9912,7 @@ async def openai_chat_completions(
                 _tracker.__exit__(None, None, None)
                 raise _openai_admission_http_exception(exc, status_code = 503)
             except LlamaAdmissionCancelled as exc:
-                _openai_admission_log(
+                _llama_admission_log(
                     "cancelled-before-upstream",
                     reservation,
                     request = request,
@@ -8924,7 +9983,7 @@ async def openai_chat_completions(
             if _wants_multiple_choices(payload):
                 raise _reject_unsupported_n("streaming GGUF chat completions")
             _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
-            _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+            _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
             _tracker.__enter__()
             try:
                 reservation, admission_config = _openai_llama_admission_reserve(
@@ -8933,7 +9992,7 @@ async def openai_chat_completions(
                 )
             except LlamaAdmissionQueueFull as exc:
                 _tracker.__exit__(None, None, None)
-                _openai_admission_log(
+                _llama_admission_log(
                     "queue-full",
                     snapshot = exc.snapshot,
                     request = request,
@@ -9105,7 +10164,7 @@ async def openai_chat_completions(
             admission_wait_started_at = None
             if stream_lease is None:
                 admission_wait_started_at = time.monotonic()
-                _openai_admission_log(
+                _llama_admission_log(
                     "queued",
                     reservation,
                     request = request,
@@ -9130,7 +10189,7 @@ async def openai_chat_completions(
                                 yield wait_item
                                 continue
                             lease = wait_item
-                            _openai_admission_log(
+                            _llama_admission_log(
                                 "granted-after-wait",
                                 reservation,
                                 request = request,
@@ -9161,7 +10220,7 @@ async def openai_chat_completions(
                             cancelled = stream_cancelled,
                         )
                 except LlamaAdmissionTimeout as exc:
-                    _openai_admission_log(
+                    _llama_admission_log(
                         "timeout",
                         reservation,
                         request = request,
@@ -9175,7 +10234,7 @@ async def openai_chat_completions(
                         _openai_admission_error_body(exc, status_code = 503)
                     )
                 except LlamaAdmissionCancelled:
-                    _openai_admission_log(
+                    _llama_admission_log(
                         "cancelled-before-upstream",
                         reservation,
                         request = request,
@@ -9231,7 +10290,7 @@ async def openai_chat_completions(
                     llama_backend = llama_backend,
                 )
             except LlamaAdmissionQueueFull as exc:
-                _openai_admission_log(
+                _llama_admission_log(
                     "queue-full",
                     snapshot = exc.snapshot,
                     request = request,
@@ -9243,14 +10302,14 @@ async def openai_chat_completions(
                 raise _openai_admission_http_exception(exc, status_code = 429)
 
             _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
-            _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+            _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
             _tracker.__enter__()
             admission_lease = None
             admission_wait_started_at = None
             try:
                 if reservation.lease_nowait() is None:
                     admission_wait_started_at = time.monotonic()
-                    _openai_admission_log(
+                    _llama_admission_log(
                         "queued",
                         reservation,
                         request = request,
@@ -9265,7 +10324,7 @@ async def openai_chat_completions(
                     cancel_event = cancel_event,
                 )
                 if admission_wait_started_at is not None:
-                    _openai_admission_log(
+                    _llama_admission_log(
                         "granted-after-wait",
                         reservation,
                         request = request,
@@ -9287,7 +10346,7 @@ async def openai_chat_completions(
                 _tracker.__exit__(None, None, None)
                 raise
             except LlamaAdmissionTimeout as exc:
-                _openai_admission_log(
+                _llama_admission_log(
                     "timeout",
                     reservation,
                     request = request,
@@ -9302,7 +10361,7 @@ async def openai_chat_completions(
                 _tracker.__exit__(None, None, None)
                 raise _openai_admission_http_exception(exc, status_code = 503)
             except LlamaAdmissionCancelled as exc:
-                _openai_admission_log(
+                _llama_admission_log(
                     "cancelled-before-upstream",
                     reservation,
                     request = request,
@@ -9685,7 +10744,7 @@ async def openai_chat_completions(
 
         _sf_tool_sentinel = object()
         _sf_cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
-        _sf_tracker = _TrackedCancel(cancel_event, *_sf_cancel_keys)
+        _sf_tracker = _TrackedCancel.for_payload(cancel_event, payload, *_sf_cancel_keys)
         _sf_tracker.__enter__()
 
         async def sf_tool_stream():
@@ -9714,11 +10773,11 @@ async def openai_chat_completions(
 
                 while True:
                     if cancel_event.is_set():
-                        backend.reset_generation_state()
+                        backend.reset_generation_state(cancel_event)
                         break
                     if await request.is_disconnected():
                         cancel_event.set()
-                        backend.reset_generation_state()
+                        backend.reset_generation_state(cancel_event)
                         api_monitor.finish(monitor_id, "cancelled")
                         return
 
@@ -9741,7 +10800,7 @@ async def openai_chat_completions(
                     if event is _sf_tool_sentinel:
                         break
                     if isinstance(event, GenStreamError):
-                        backend.reset_generation_state()
+                        backend.reset_generation_state(cancel_event)
                         _msg = _friendly_gen_stream_error(event)
                         api_monitor.fail(monitor_id, _msg)
                         yield _openai_stream_error_sse(
@@ -9836,16 +10895,16 @@ async def openai_chat_completions(
 
             except asyncio.CancelledError:
                 cancel_event.set()
-                backend.reset_generation_state()
+                backend.reset_generation_state(cancel_event)
                 api_monitor.finish(monitor_id, "cancelled")
                 raise
             except GenStreamErrorRaised as exc:
-                backend.reset_generation_state()
+                backend.reset_generation_state(cancel_event)
                 _msg = _friendly_gen_stream_error(exc)
                 api_monitor.fail(monitor_id, _msg)
                 yield _openai_stream_error_sse({"error": {"message": _msg, "type": "server_error"}})
             except Exception:
-                backend.reset_generation_state()
+                backend.reset_generation_state(cancel_event)
                 # Generic wire message; full trace stays in the log (CWE-209:
                 # transformers/torch errors may leak paths).
                 logger.exception("safetensors tool stream error")
@@ -9939,20 +10998,20 @@ async def openai_chat_completions(
             return _model_json_response(response)
         except asyncio.CancelledError:
             cancel_event.set()
-            backend.reset_generation_state()
+            backend.reset_generation_state(cancel_event)
             api_monitor.finish(monitor_id, "cancelled")
             raise
         except GenStreamErrorRaised as exc:
-            backend.reset_generation_state()
+            backend.reset_generation_state(cancel_event)
             _msg = _friendly_gen_stream_error(exc)
             api_monitor.fail(monitor_id, _msg)
             raise HTTPException(status_code = 500, detail = _msg)
         except HTTPException as exc:
-            backend.reset_generation_state()
+            backend.reset_generation_state(cancel_event)
             api_monitor.fail(monitor_id, str(exc.detail))
             raise
         except Exception:
-            backend.reset_generation_state()
+            backend.reset_generation_state(cancel_event)
             # CWE-209: generic detail; full trace in log.
             logger.exception("safetensors tool completion error")
             api_monitor.fail(monitor_id, "An internal error occurred.")
@@ -10077,7 +11136,7 @@ async def openai_chat_completions(
     # ── Streaming response ────────────────────────────────────────
     if payload.stream:
         _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
-        _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+        _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
         _tracker.__enter__()
 
         async def stream_chunks():
@@ -10104,7 +11163,7 @@ async def openai_chat_completions(
                 gen = generate()
                 while True:
                     if cancel_event.is_set():
-                        backend.reset_generation_state()
+                        backend.reset_generation_state(cancel_event)
                         break
                     # Stall keepalive (see safetensors tool stream) each window while
                     # next(gen) runs in a worker. next(gen, _DONE) returns _DONE rather
@@ -10124,7 +11183,7 @@ async def openai_chat_completions(
                     if cumulative is _DONE:
                         break
                     if isinstance(cumulative, GenStreamError):
-                        backend.reset_generation_state()
+                        backend.reset_generation_state(cancel_event)
                         _msg = _friendly_gen_stream_error(cumulative)
                         api_monitor.fail(monitor_id, _msg)
                         yield _openai_stream_error_sse(
@@ -10133,7 +11192,7 @@ async def openai_chat_completions(
                         return
                     if await request.is_disconnected():
                         cancel_event.set()
-                        backend.reset_generation_state()
+                        backend.reset_generation_state(cancel_event)
                         api_monitor.finish(monitor_id, "cancelled")
                         return
                     new_text = cumulative[len(prev_text) :]
@@ -10234,18 +11293,18 @@ async def openai_chat_completions(
 
             except asyncio.CancelledError:
                 cancel_event.set()
-                backend.reset_generation_state()
+                backend.reset_generation_state(cancel_event)
                 api_monitor.finish(monitor_id, "cancelled")
                 raise
             except GenStreamErrorRaised as exc:
                 # Adapter-controlled (compare-mode) backend failure. Honor the
                 # public flag so operational errors surface their real message.
-                backend.reset_generation_state()
+                backend.reset_generation_state(cancel_event)
                 _msg = _friendly_gen_stream_error(exc)
                 api_monitor.fail(monitor_id, _msg)
                 yield _openai_stream_error_sse({"error": {"message": _msg, "type": "server_error"}})
             except Exception as e:
-                backend.reset_generation_state()
+                backend.reset_generation_state(cancel_event)
                 logger.error(f"Error during OpenAI streaming: {e}", exc_info = True)
                 _msg = _friendly_error(e)
                 api_monitor.fail(monitor_id, _msg)
@@ -10284,11 +11343,17 @@ async def openai_chat_completions(
 
     # ── Non-streaming response ────────────────────────────────────
     else:
+        # `stream` defaults to False, so this is the default shape of a standard (non-GGUF) chat and
+        # generate() holds the worker throughout. Unregistered, a swap cancelled this run rather
+        # than returning 409 (/unload runs no idle drain).
+        _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
+        _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
+        _tracker.__enter__()
         try:
             full_text = ""
             for token in generate():
                 if isinstance(token, GenStreamError):
-                    backend.reset_generation_state()
+                    backend.reset_generation_state(cancel_event)
                     _msg = _friendly_gen_stream_error(token)
                     api_monitor.fail(monitor_id, _msg)
                     raise HTTPException(status_code = 500, detail = _msg)
@@ -10395,15 +11460,18 @@ async def openai_chat_completions(
         except GenStreamErrorRaised as exc:
             # Adapter-controlled (compare-mode) backend failure. Honor the public
             # flag so operational errors surface their real message.
-            backend.reset_generation_state()
+            backend.reset_generation_state(cancel_event)
             _msg = _friendly_gen_stream_error(exc)
             api_monitor.fail(monitor_id, _msg)
             raise HTTPException(status_code = 500, detail = _msg)
         except Exception as e:
-            backend.reset_generation_state()
+            backend.reset_generation_state(cancel_event)
             logger.error(f"Error during OpenAI completion: {e}", exc_info = True)
             api_monitor.fail(monitor_id, _friendly_error(e))
             raise HTTPException(status_code = 500, detail = safe_error_detail(e))
+        finally:
+            # Nested under the except arms too: reset_generation_state() can throw, and a leaked entry 409s swaps.
+            _tracker.__exit__(None, None, None)
 
 
 # =====================================================================
@@ -10511,6 +11579,9 @@ def _openai_model_objects() -> list[dict]:
             "created": _created,
             "owned_by": _OWNED_BY,
         }
+        _quant = getattr(llama_backend, "hf_variant", None)
+        if _quant and _quant_reference_resolves(entry["id"], _quant):
+            entry["quant"] = _quant
         _ctx = _positive_int_or_none(getattr(llama_backend, "context_length", None))
         if _ctx is not None:
             entry["context_length"] = _ctx
@@ -10551,6 +11622,50 @@ def _openai_model_objects() -> list[dict]:
 # Brief cache for the local-model filesystem scan so repeated /v1/models calls
 # don't rescan the HF cache and models dirs on every request.
 _CATALOG_CACHE: dict = {"at": 0.0, "models": []}
+# Ids the last catalog scan listed, rebuilt only when that scan is replaced.
+_ADVERTISED_CACHE: dict = {"at": None, "paths": {}}
+
+
+def _quant_reference_resolves(model_id: Optional[str], quant: str) -> bool:
+    """Whether ``<model_id>:<quant>`` still resolves once this model is not resident.
+
+    A standalone .gguf takes its quant from the filename, but the resolver stores
+    such files with no quants, so advertising one hands out a pin that dies the
+    moment another model loads.
+    """
+    from core.inference.local_model_resolver import (
+        index_is_built,
+        recently_downloaded,
+        resolve_local_gguf,
+        warm_index_soon,
+    )
+
+    if not model_id:
+        return False
+    # A cold index proves nothing, and publishing on no proof is what hands out the
+    # dead pin; warm so the next response carries the quant.
+    warm_index_soon()
+    return resolve_local_gguf(f"{model_id}:{quant}", allow_scan = False) is not None
+
+
+def _advertised_local_path(model: str) -> Optional[str]:
+    """On-disk path of *model* if the last /v1/models scan listed it, else None.
+
+    Cache-only, never scans. The catalog scans on its own schedule, so it can have
+    advertised a local model the resolver index has not picked up yet, which is
+    evidence the name means something other than the resident one.
+    """
+    if _ADVERTISED_CACHE["at"] != _CATALOG_CACHE["at"]:
+        paths = {}
+        for info in _CATALOG_CACHE["models"] or ():
+            cid = getattr(info, "model_id", None) or public_model_id(getattr(info, "id", None))
+            path = getattr(info, "path", None)
+            if cid and path:
+                paths.setdefault(cid.strip().lower(), path)
+        _ADVERTISED_CACHE.update(at = _CATALOG_CACHE["at"], paths = paths)
+    return _ADVERTISED_CACHE["paths"].get(model.strip().lower())
+
+
 _CATALOG_TTL_S = 30.0
 # Per-loop lock (like _auto_switch_lock): a module-level asyncio.Lock ties its
 # waiters to the loop that first awaited it, so a second event loop awaiting it
@@ -10617,11 +11732,14 @@ async def _openai_catalog_objects() -> list[dict]:
     # read from the on-disk files, not model_format: the HF-cache scanner leaves
     # model_format unset for GGUF snapshots, so a model_format filter would drop
     # every cached GGUF. The file checks run off the loop.
-    from core.inference.local_model_resolver import info_has_local_gguf
+    from core.inference.local_model_resolver import local_gguf_quants
 
     catalog = await _cached_local_catalog()
-    servable = await asyncio.to_thread(lambda: [i for i in catalog if info_has_local_gguf(i)])
-    for info in servable:
+    # One scan yields both "is this servable" and its on-disk quants, so no second pass.
+    servable = await asyncio.to_thread(
+        lambda: [(i, q) for i in catalog if (q := local_gguf_quants(i)) is not None]
+    )
+    for info, quants in servable:
         cid = getattr(info, "model_id", None) or public_model_id(getattr(info, "id", None))
         if not cid or cid in by_id:
             continue
@@ -10630,8 +11748,21 @@ async def _openai_catalog_objects() -> list[dict]:
             "object": "model",
             "created": _created,
             "owned_by": _OWNED_BY,
-            "loaded": False,
+            # A manual load keys the resident entry by path basename while the catalog
+            # uses the alias, so match on the path or the alias reads as not loaded.
+            # llama-only: a Transformers model live from a directory that also holds
+            # GGUF exports must not mark one of these GGUF entries loaded, or the
+            # examples pin a quant nothing can serve with switching off.
+            "loaded": _resolves_to_resident(getattr(info, "path", None), llama_only = True),
         }
+        # The id stays bare for OpenAI compat; a client appends ":<quant>" to pin one.
+        # For the resident model that must be the quant actually loaded, not the
+        # preferred one on disk, or the listing advertises alias:Q4 while Q8 serves.
+        resident_quant = getattr(get_llama_cpp_backend(), "hf_variant", None)
+        if obj["loaded"] and resident_quant:
+            obj["quant"] = resident_quant
+        elif quants:
+            obj["quant"] = quants[0]
         display = getattr(info, "display_name", None)
         if display:
             obj["display_name"] = display
@@ -10767,10 +11898,13 @@ async def openai_completions(request: Request, current_subject: str = Depends(ge
     # Opt-in: load the requested local GGUF before the loaded-state check.
     body = await _auto_switch_from_request_body(request, current_subject)
     if not llama_backend.is_loaded:
-        raise HTTPException(
-            status_code = 503,
-            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
+        _status, _detail = await _no_model_loaded_error(
+            "No GGUF model loaded. Load a GGUF model first.",
+            _raw_body_model(body),
+            request,
+            status = 503,
         )
+        raise HTTPException(status_code = _status, detail = _detail)
     if not isinstance(body, dict):
         # Re-read to re-raise a malformed-body error (post-503, pre-feature behavior);
         # a valid non-dict body such as a list is a clean 400 rather than a 500.
@@ -10791,10 +11925,11 @@ async def openai_completions(request: Request, current_subject: str = Depends(ge
     target_url = f"{llama_backend.base_url}/v1/completions"
     is_stream = body.get("stream", False)
     prompt_text = _flatten_monitor_prompt(body.get("prompt", ""))
+    monitor_model = str(body.get("model") or _llama_public_model_id(llama_backend) or "default")
     monitor_id = api_monitor.start(
         endpoint = request.url.path,
         method = request.method,
-        model = str(body.get("model") or _llama_public_model_id(llama_backend) or "default"),
+        model = monitor_model,
         prompt = prompt_text,
         context_length = llama_backend.context_length,
         subject = current_subject,
@@ -10822,12 +11957,23 @@ async def openai_completions(request: Request, current_subject: str = Depends(ge
             bytes_iter = None
             disconnect_event = threading.Event()
             disconnect_watcher = None
+            # This proxy relays straight from llama-server, so the swap gate has to see it: without an
+            # entry a non-forced /unload counts zero generations and tears the server down mid-response.
+            # Sharing disconnect_event lets a forced swap stop the relay through the check it already
+            # polls. Entered inside the body generator, so a response whose body never starts leaves
+            # nothing behind (see _responses_stream). No thread_id: public API surface, not a chat.
+            _tracker = _TrackedCancel(disconnect_event, model = monitor_model, kind = "completions")
+            _tracker.__enter__()
             try:
                 req = client.build_request(
                     "POST", target_url, json = body, headers = {"Connection": "close"}
                 )
                 first_token_deadline = time.monotonic() + _DEFAULT_FIRST_TOKEN_TIMEOUT_S
-                resp = await _send_stream_with_preheader_cancel(client, req, request = request)
+                # Same event the relay loop polls, so a forced swap ends the request during prefill
+                # instead of only once headers arrive.
+                resp = await _send_stream_with_preheader_cancel(
+                    client, req, disconnect_event, request = request
+                )
                 if resp is None:
                     api_monitor.finish(monitor_id, "cancelled")
                     return
@@ -10898,27 +12044,64 @@ async def openai_completions(request: Request, current_subject: str = Depends(ge
                 yield _openai_stream_error_sse_bytes(error_chunk)
                 return
             finally:
-                await _aclose_stream_resources(
-                    watchers = (disconnect_watcher,),
-                    iterator = bytes_iter,
-                    resp = resp,
-                    client = client,
-                )
+                # Nested so a close-time failure still unregisters; a phantom entry 409s swaps.
+                try:
+                    await _aclose_stream_resources(
+                        watchers = (disconnect_watcher,),
+                        iterator = bytes_iter,
+                        resp = resp,
+                        client = client,
+                    )
+                finally:
+                    _tracker.__exit__(None, None, None)
 
         return _sse_streaming_response(_stream())
     else:
-        try:
-            resp = await nonstreaming_client().post(
-                target_url,
-                json = body,
-                timeout = _llama_non_streaming_generation_timeout(),
+        # ``stream`` defaults to false, so this common shape registers with the swap gate like the
+        # streaming branch: unregistered, a non-forced /unload counts zero generations and kills
+        # llama-server mid-request, and force_cancel_active has no event. Unpooled client so a
+        # cancel-close hits this call only.
+        _cancel_event = threading.Event()
+        _client = _cancelable_nonstreaming_client()
+        _tracker = _TrackedCancel(_cancel_event, model = monitor_model, kind = "completions")
+        _tracker.__enter__()
+        _cancel_watcher = asyncio.create_task(
+            _await_cancel_or_disconnect_then_close_client(
+                cancel_event = _cancel_event,
+                request = request,
+                client = _client,
             )
+        )
+        try:
+            try:
+                resp = await _client.post(
+                    target_url,
+                    json = body,
+                    timeout = _llama_non_streaming_generation_timeout(),
+                )
+            except httpx.RequestError:
+                # The watcher closed the client out from under the request: report the cancel, not a transport failure.
+                if _cancel_event.is_set():
+                    raise asyncio.CancelledError()
+                raise
+            if _cancel_event.is_set():
+                raise asyncio.CancelledError()
         except asyncio.CancelledError:
             api_monitor.finish(monitor_id, "cancelled")
             raise
         except Exception as e:
             api_monitor.fail(monitor_id, _friendly_error(e))
             raise
+        finally:
+            # Nested so a close-time failure still unregisters; a phantom entry 409s swaps.
+            try:
+                await _stop_local_disconnect_cancel_watcher(_cancel_watcher)
+                try:
+                    await _client.aclose()
+                except Exception:
+                    pass
+            finally:
+                _tracker.__exit__(None, None, None)
 
         if resp.status_code != 200:
             api_monitor.fail(monitor_id, resp.text[:500])
@@ -10987,10 +12170,13 @@ async def openai_embeddings(request: Request, current_subject: str = Depends(get
     # a non-embedding target switches, then llama-server returns a no-pooling error.
     body = await _auto_switch_from_request_body(request, current_subject)
     if not llama_backend.is_loaded:
-        raise HTTPException(
-            status_code = 503,
-            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
+        _status, _detail = await _no_model_loaded_error(
+            "No GGUF model loaded. Load a GGUF model first.",
+            _raw_body_model(body),
+            request,
+            status = 503,
         )
+        raise HTTPException(status_code = _status, detail = _detail)
     if not isinstance(body, dict):
         # Re-read to re-raise a malformed-body error (post-503, pre-feature behavior);
         # a valid non-dict body such as a list is a clean 400 rather than a 500.
@@ -11011,18 +12197,54 @@ async def openai_embeddings(request: Request, current_subject: str = Depends(get
             subject = current_subject,
         )
 
-    try:
-        resp = await nonstreaming_client().post(
-            target_url,
-            json = body,
-            timeout = _DEFAULT_FIRST_TOKEN_TIMEOUT_S,
+    # Same gate registration as the completions proxy: unregistered, a non-forced /unload counts
+    # zero generations and kills llama-server mid-embedding. Unpooled client so a cancel-close
+    # hits this call only.
+    _cancel_event = threading.Event()
+    _client = _cancelable_nonstreaming_client()
+    _tracker = _TrackedCancel(
+        _cancel_event,
+        model = str(body.get("model") or _llama_public_model_id(llama_backend) or "default"),
+        kind = "embeddings",
+    )
+    _tracker.__enter__()
+    _cancel_watcher = asyncio.create_task(
+        _await_cancel_or_disconnect_then_close_client(
+            cancel_event = _cancel_event,
+            request = request,
+            client = _client,
         )
+    )
+    try:
+        try:
+            resp = await _client.post(
+                target_url,
+                json = body,
+                timeout = _DEFAULT_FIRST_TOKEN_TIMEOUT_S,
+            )
+        except httpx.RequestError:
+            # The watcher closed the client out from under the request: report the cancel, not a transport failure.
+            if _cancel_event.is_set():
+                raise asyncio.CancelledError()
+            raise
+        if _cancel_event.is_set():
+            raise asyncio.CancelledError()
     except asyncio.CancelledError:
         api_monitor.finish(monitor_id, "cancelled")
         raise
     except Exception as exc:
         api_monitor.fail(monitor_id, _friendly_error(exc))
         raise
+    finally:
+        # Nested so a close-time failure still unregisters; a phantom entry 409s swaps.
+        try:
+            await _stop_local_disconnect_cancel_watcher(_cancel_watcher)
+            try:
+                await _client.aclose()
+            except Exception:
+                pass
+        finally:
+            _tracker.__exit__(None, None, None)
     if resp.status_code != 200:
         api_monitor.fail(monitor_id, resp.text[:500])
     else:
@@ -11727,14 +12949,15 @@ async def _responses_stream(
         # double-layer asyncgen close pattern that produces "Attempted to exit
         # cancel scope in a different task" on Python 3.13. Surface a typed 400
         # so the client sees a useful error instead of a dangling stream.
-        raise HTTPException(
-            status_code = 400,
-            detail = _no_model_loaded_detail(
-                "Streaming /v1/responses requires a GGUF model loaded via "
-                "llama-server. Use non-streaming /v1/responses, "
-                "/v1/chat/completions, or load a GGUF model."
-            ),
+        _status, _detail = await _no_model_loaded_error(
+            "Streaming /v1/responses requires a GGUF model loaded via "
+            "llama-server. Use non-streaming /v1/responses, "
+            "/v1/chat/completions, or load a GGUF model.",
+            _switch_model_for_payload(payload),
+            request,
+            status = 400,
         )
+        raise HTTPException(status_code = _status, detail = _detail)
 
     # Direct pass-through bypasses the openai_chat_completions image gate.
     if not llama_backend.is_vision and any(
@@ -11754,13 +12977,19 @@ async def _responses_stream(
     )
     body["stream_options"] = {"include_usage": True}
     target_url = f"{llama_backend.base_url}/v1/chat/completions"
+    # The stream's own disconnect event, shared with the cancel/active-generation registries:
+    # this path decodes on llama-server, so a non-forced /unload must see it and refuse instead
+    # of tearing the server down mid-response. Entered inside the body generator below, so a
+    # response whose body never starts leaves nothing behind.
+    cancel_event = threading.Event()
+    _tracker = _TrackedCancel.for_payload(cancel_event, payload, resp_id)
     try:
         reservation, admission_config = _openai_llama_admission_reserve(
             request = request,
             llama_backend = llama_backend,
         )
     except LlamaAdmissionQueueFull as exc:
-        _openai_admission_log(
+        _llama_admission_log(
             "queue-full",
             snapshot = exc.snapshot,
             request = request,
@@ -12207,14 +13436,19 @@ async def _responses_stream(
         resp = None
         lines_iter = None
         disconnect_watcher = None
-        disconnect_event = threading.Event()
+        # Tracked per-run event: a client disconnect and a forced reload both land here.
+        disconnect_event = cancel_event
         try:
             req = client.build_request(
                 "POST", target_url, json = body, headers = {"Connection": "close"}
             )
             first_token_deadline = time.monotonic() + _DEFAULT_FIRST_TOKEN_TIMEOUT_S
             try:
-                resp = await _send_stream_with_preheader_cancel(client, req, request = request)
+                # Same event the loop below polls: prefill can run for the whole first-token window,
+                # and only the send watcher can end it early.
+                resp = await _send_stream_with_preheader_cancel(
+                    client, req, disconnect_event, request = request
+                )
                 if resp is None:
                     api_monitor.finish(monitor_id, "cancelled")
                     return
@@ -12610,6 +13844,9 @@ async def _responses_stream(
         yield _sse("response.completed", completed_response)
 
     async def admitted_event_generator():
+        # Register for the body's whole lifetime, admission wait included: the run holds a decode
+        # slot from here on, so /load and /unload must count it. __exit__ runs from the finally below.
+        _tracker.__enter__()
         lease = reservation.lease_nowait()
         admission_wait_started_at = None
         stream_started = False
@@ -12618,7 +13855,7 @@ async def _responses_stream(
         try:
             if lease is None:
                 admission_wait_started_at = time.monotonic()
-                _openai_admission_log(
+                _llama_admission_log(
                     "queued",
                     reservation,
                     request = request,
@@ -12626,17 +13863,20 @@ async def _responses_stream(
                     completion_id = resp_id,
                     level = "debug",
                 )
+                # The tracked event, not just the client socket: registered above, so a forced swap's
+                # cancel_all() reaches this run while it is still queued. Otherwise it takes a lease it was
+                # told to give up and the post-cancel drain waits out the round trip it just cancelled.
                 async for wait_item in _openai_admission_wait_stream_chunks(
                     reservation,
                     admission_config,
                     request = request,
-                    cancel_event = None,
+                    cancel_event = cancel_event,
                 ):
                     if isinstance(wait_item, str):
                         yield wait_item
                         continue
                     lease = wait_item
-                    _openai_admission_log(
+                    _llama_admission_log(
                         "granted-after-wait",
                         reservation,
                         request = request,
@@ -12651,7 +13891,7 @@ async def _responses_stream(
             await _raise_if_openai_admission_cancelled(
                 reservation,
                 request = request,
-                cancel_event = None,
+                cancel_event = cancel_event,
             )
             iterator = event_generator()
             stream_started = True
@@ -12668,7 +13908,7 @@ async def _responses_stream(
                     cancelled = stream_cancelled,
                 )
         except LlamaAdmissionTimeout as exc:
-            _openai_admission_log(
+            _llama_admission_log(
                 "timeout",
                 reservation,
                 request = request,
@@ -12680,7 +13920,7 @@ async def _responses_stream(
             api_monitor.fail(monitor_id, str(exc))
             yield _responses_admission_failed_sse(exc, status_code = 503)
         except LlamaAdmissionCancelled:
-            _openai_admission_log(
+            _llama_admission_log(
                 "cancelled-before-upstream",
                 reservation,
                 request = request,
@@ -12700,6 +13940,7 @@ async def _responses_stream(
             if not stream_started:
                 api_monitor.finish(monitor_id, "cancelled")
                 reservation.cancel()
+            _tracker.__exit__(None, None, None)
 
     async def _responses_admission_unstarted_cleanup() -> None:
         api_monitor.finish(monitor_id, "cancelled")
@@ -12836,8 +14077,7 @@ def _anthropic_requested_studio_tools(tools: Optional[list]) -> set[str]:
     requested: set[str] = set()
     for tool in tools or []:
         td = tool if isinstance(tool, dict) else tool.model_dump()
-        # Client tools always carry input_schema; server tools never do.
-        if td.get("input_schema") is not None:
+        if td.get("input_schema") is not None or anthropic_schema_client_tool_kind(td) is not None:
             continue
         # Anthropic dispatches server tools by `type`, not bare `name`; matching
         # name too would let a malformed client tool like `{"name": "python"}`
@@ -12930,18 +14170,21 @@ def _validate_anthropic_client_tools(tools) -> None:
     # Reject malformed client tools before any model load, so an invalid request
     # never evicts the loaded model. AnthropicTool relaxed name/input_schema to
     # Optional for server tools, so the converter silently drops incomplete
-    # entries; surface them as 400 here. A `type` field marks a server-tool
-    # declaration (unrecognized server tools are no-ops); anything else without
-    # input_schema or name is malformed.
+    # entries; surface them as 400 here. Recognized Anthropic-schema client
+    # tools use type/name without input_schema; other type declarations are
+    # server tools (unrecognized server tools remain no-ops).
     for tool in tools or []:
         td = tool if isinstance(tool, dict) else tool.model_dump()
         name, type_, schema = td.get("name"), td.get("type"), td.get("input_schema")
+        schema_client_kind = anthropic_schema_client_tool_kind(td)
         if schema is None and not isinstance(type_, str):
             raise HTTPException(
                 status_code = 400,
                 detail = f"Tool {name!r} is missing required field 'input_schema'.",
             )
-        if schema is not None and (not isinstance(name, str) or not name):
+        if (schema is not None or schema_client_kind is not None) and (
+            not isinstance(name, str) or not name
+        ):
             raise HTTPException(
                 status_code = 400,
                 detail = "Client tool is missing required field 'name'.",
@@ -12976,10 +14219,13 @@ async def anthropic_count_tokens(
 
     llama_backend = get_llama_cpp_backend()
     if not llama_backend.is_loaded:
-        raise HTTPException(
-            status_code = 503,
-            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
+        _status, _detail = await _no_model_loaded_error(
+            "No GGUF model loaded. Load a GGUF model first.",
+            _switch_model_for_payload(payload),
+            request,
+            status = 503,
         )
+        raise HTTPException(status_code = _status, detail = _detail)
 
     # Same Anthropic → OpenAI translation as anthropic_messages: system is
     # folded into the messages list, so pass system=None to the counter.
@@ -13048,6 +14294,7 @@ async def anthropic_messages(
     # before any request-shape check, exactly as the pre-feature endpoint did. When
     # an automatic load can run (auto-switch or a standalone idle TTL), fall through
     # so validation runs before the reload hook gets a chance to restore the model.
+    # Plain detail, not _no_model_loaded_error: that helper leaves this case unchanged.
     if not llama_backend.is_loaded and not _automatic_model_load_may_run():
         raise HTTPException(
             status_code = 503,
@@ -13078,9 +14325,13 @@ async def anthropic_messages(
     requested_studio_tools = _anthropic_requested_studio_tools(payload.tools)
     _has_client_tool = any(
         (t if isinstance(t, dict) else t.model_dump()).get("input_schema") is not None
+        or anthropic_schema_client_tool_kind(t) is not None
         for t in payload.tools or []
     )
-    if requested_studio_tools and _has_client_tool:
+    _explicit_server_tools = bool(requested_studio_tools) or (
+        payload.enable_tools is True and _effective_enable_tools(payload) is not False
+    )
+    if _explicit_server_tools and _has_client_tool:
         raise HTTPException(
             status_code = 400,
             detail = (
@@ -13103,7 +14354,11 @@ async def anthropic_messages(
     # post-switch); an image request can never take the server-tool path, so it is
     # excluded as in the server_tools gate below. off/full and an explicit
     # confirm_tool_calls=False opt-out always pass.
-    _enable_pre = _effective_enable_tools(payload)
+    # A process-wide ``--enable-tools`` policy is only a default for ordinary
+    # chat. It must not steal an explicit Anthropic client-tool catalog (Claude
+    # Code's Write/Edit/Bash tools) and turn it into Unsloth's local tool loop.
+    # An explicit per-request server-tool ask was rejected as mixed mode above.
+    _enable_pre = False if _has_client_tool else _effective_enable_tools(payload)
     _server_tools_requested_pre = (
         _enable_pre or (_enable_pre is None and bool(requested_studio_tools))
     ) and not _anthropic_request_has_image(payload)
@@ -13147,10 +14402,13 @@ async def anthropic_messages(
         require_vision = _anthropic_request_has_image(payload),
     )
     if not llama_backend.is_loaded:
-        raise HTTPException(
-            status_code = 503,
-            detail = _no_model_loaded_detail("No GGUF model loaded. Load a GGUF model first."),
+        _status, _detail = await _no_model_loaded_error(
+            "No GGUF model loaded. Load a GGUF model first.",
+            _switch_model_for_payload(payload),
+            request,
+            status = 503,
         )
+        raise HTTPException(status_code = _status, detail = _detail)
 
     # Advertised repo id after an auto-switch load, else a clean public id, never
     # the local .gguf path (and a legacy raw path in payload.model is sanitized).
@@ -13229,7 +14487,7 @@ async def anthropic_messages(
     # An Anthropic server-tool declaration implies server-tool mode, but only
     # when tools aren't explicitly disabled (CLI --disable-tools or per-request
     # enable_tools=false). Explicit False always wins.
-    _enable = _effective_enable_tools(payload)
+    _enable = False if _has_client_tool else _effective_enable_tools(payload)
     server_tools = (
         (_enable or (_enable is None and bool(requested_studio_tools)))
         and llama_backend.supports_tools
@@ -13280,12 +14538,226 @@ async def anthropic_messages(
             cancel_event,
         )
 
+    async def _tracked_anthropic_non_streaming(coro):
+        """Register a non-streaming /v1/messages run with the swap gate.
+
+        `stream` defaults to false, so this is the route's common shape, and all
+        three helpers hold llama-server for the whole await. /unload runs no idle
+        drain, so unregistered a swap tore the server down mid-request; only the
+        streaming siblings registered. No cancel keys, unlike the streaming
+        tool/plain siblings: the gate reaches a run through the registry, and
+        keys would add a cancel surface to a public API.
+        """
+        _tracker = _TrackedCancel(cancel_event, model = model_name, kind = "messages")
+        _tracker.__enter__()
+        try:
+            return await _monitored_anthropic(coro)
+        finally:
+            # _monitored_anthropic's bookkeeping can throw; a leaked entry 409s later swaps.
+            _tracker.__exit__(None, None, None)
+
+    # ── Admission control ─────────────────────────────────────
+    # Bound concurrent llama-server generations to the backend's serving slots via a
+    # FIFO queue keyed by base_url (shared with /v1/chat/completions, same slots).
+    # Excess requests queue; a streaming waiter gets SSE keep-alives, the queue 429s
+    # once full. Mirrors the OpenAI passthrough admission wiring. Streaming takes the
+    # slot when the response is built and drops it when the body finishes or is
+    # abandoned; the non-stream path holds it across the single awaited generation.
+    _anthropic_admission_mode = "anthropic_stream" if payload.stream else "anthropic_nonstream"
+
+    async def _admitted_anthropic_stream(
+        orig_body,
+        reservation,
+        admission_config,
+        stream_lease,
+        prior_cleanup = None,
+    ):
+        lease = stream_lease
+        stream_cancelled = False
+        body_started = False
+        wait_started_at = None
+        try:
+            if lease is None:
+                wait_started_at = time.monotonic()
+                _llama_admission_log(
+                    "queued",
+                    reservation,
+                    request = request,
+                    mode = _anthropic_admission_mode,
+                )
+                async for wait_item in _openai_admission_wait_stream_chunks(
+                    reservation,
+                    admission_config,
+                    request = request,
+                    cancel_event = cancel_event,
+                ):
+                    if isinstance(wait_item, str):
+                        yield wait_item
+                        continue
+                    lease = wait_item
+                    break
+                _llama_admission_log(
+                    "granted-after-wait",
+                    reservation,
+                    request = request,
+                    mode = _anthropic_admission_mode,
+                    wait_started_at = wait_started_at,
+                )
+            if lease is None:
+                return
+            body_started = True
+            async for chunk in orig_body:
+                yield chunk
+        except asyncio.CancelledError:
+            # Must reach the monitored generator as CancelledError, not aclose's
+            # GeneratorExit, or its handler never finalizes the monitor entry.
+            stream_cancelled = True
+            raise
+        except LlamaAdmissionTimeout as exc:
+            api_monitor.fail(monitor_id, str(exc))
+            _llama_admission_log(
+                "timeout",
+                reservation,
+                request = request,
+                mode = _anthropic_admission_mode,
+                wait_started_at = wait_started_at,
+                level = "warning",
+            )
+            yield build_anthropic_sse_event(
+                "error",
+                anthropic_error_body(str(exc), status = 503),
+            )
+        except LlamaAdmissionCancelled:
+            _llama_admission_log(
+                "cancelled-before-upstream",
+                reservation,
+                request = request,
+                mode = _anthropic_admission_mode,
+                wait_started_at = wait_started_at,
+            )
+            return
+        finally:
+            # Closing can raise (a raw body re-raises CancelledError after
+            # teardown), and a slot lost that way never comes back: with no queue
+            # timeout the pool just shrinks and later callers wait forever. Keep
+            # the release in its own finally, as the /responses wiring does.
+            try:
+                if body_started:
+                    await _close_openai_admitted_stream_iterator(
+                        orig_body,
+                        cancelled = stream_cancelled,
+                    )
+                else:
+                    # Gave up while queued: the monitored body never ran, so nothing
+                    # downstream finalizes the entry or exits the response's tracker.
+                    api_monitor.finish(monitor_id, "cancelled")
+                    await _release_unstarted_anthropic_stream(orig_body, prior_cleanup)
+            finally:
+                if lease is not None:
+                    lease.release()
+                else:
+                    reservation.cancel()
+
+    async def _admitted_anthropic(coro):
+        try:
+            reservation, admission_config = _openai_llama_admission_reserve(
+                request = request, llama_backend = llama_backend
+            )
+        except LlamaAdmissionQueueFull as exc:
+            coro.close()
+            api_monitor.fail(monitor_id, str(exc))
+            _llama_admission_log(
+                "queue-full",
+                snapshot = getattr(exc, "snapshot", None),
+                request = request,
+                mode = _anthropic_admission_mode,
+                level = "warning",
+            )
+            raise _anthropic_admission_http_exception(exc, status_code = 429)
+        except BaseException:
+            # Reserving never awaited the generation, so close it rather than
+            # leave an un-awaited coroutine behind.
+            coro.close()
+            raise
+
+        if payload.stream:
+            stream_lease = reservation.lease_nowait()
+            # Set up the stream (token count + tracker enter) and surface a pre-response
+            # cancel now, exactly as the un-admitted path did; the upstream generation is
+            # deferred to body iteration, so the slot is only held while tokens flow.
+            try:
+                # Token counting calls llama-server, so a dead backend raises here
+                # with the slot already taken. cancel() covers both cases: it
+                # releases the lease if one was granted, else drops the waiter.
+                monitored = await _monitored_anthropic(coro)
+            except BaseException:
+                reservation.cancel()
+                raise
+            orig_body = getattr(monitored, "body_iterator", None)
+            if orig_body is None:
+                reservation.cancel()
+                return monitored
+
+            # Replacing body_iterator would strand the response's own pre-start
+            # hook (the passthrough uses one to exit its cancel tracker), so chain
+            # to it instead of clobbering it.
+            prior_cleanup = getattr(monitored, "_unstarted_cleanup", None)
+
+            async def _unstarted_cleanup() -> None:
+                # The body never ran, so nothing else closes out the monitor entry.
+                api_monitor.finish(monitor_id, "cancelled")
+                try:
+                    await _release_unstarted_anthropic_stream(orig_body, prior_cleanup)
+                finally:
+                    # A BaseException here is swallowed upstream, so releasing
+                    # outside the finally would shrink the pool silently.
+                    reservation.cancel()
+
+            monitored.body_iterator = _admitted_anthropic_stream(
+                orig_body, reservation, admission_config, stream_lease, prior_cleanup
+            )
+            monitored._unstarted_cleanup = _unstarted_cleanup
+            return monitored
+
+        lease = None
+        try:
+            lease = await _wait_for_openai_admission_non_streaming(
+                reservation,
+                admission_config,
+                request = request,
+                cancel_event = cancel_event,
+            )
+            # Registered only once admitted: a queued request is not holding
+            # llama-server, so it has no business blocking a swap.
+            monitored = await _tracked_anthropic_non_streaming(coro)
+            return monitored
+        except LlamaAdmissionTimeout as exc:
+            coro.close()
+            api_monitor.fail(monitor_id, str(exc))
+            raise _anthropic_admission_http_exception(exc, status_code = 503)
+        except LlamaAdmissionCancelled as exc:
+            coro.close()
+            api_monitor.finish(monitor_id, "cancelled")
+            raise _anthropic_admission_http_exception(exc, status_code = 499)
+        except BaseException:
+            # Cancelled while queued (shutdown, outer task cancel): the generation
+            # coroutine was never awaited, so close it rather than leak it.
+            if lease is None:
+                coro.close()
+                api_monitor.finish(monitor_id, "cancelled")
+            raise
+        finally:
+            if lease is not None:
+                lease.release()
+            else:
+                reservation.cancel()
+
     # ── Client-side pass-through path ─────────────────────────
     if client_tools:
         openai_tools = openai_client_tools
 
         if payload.stream:
-            return await _monitored_anthropic(
+            return await _admitted_anthropic(
                 _anthropic_passthrough_stream(
                     request,
                     cancel_event,
@@ -13309,7 +14781,7 @@ async def anthropic_messages(
                     auto_heal_tool_calls = payload.auto_heal_tool_calls,
                 )
             )
-        return await _monitored_anthropic(
+        return await _admitted_anthropic(
             _anthropic_passthrough_non_streaming(
                 llama_backend,
                 openai_messages,
@@ -13328,6 +14800,8 @@ async def anthropic_messages(
                 disable_parallel_tool_use = _disable_parallel,
                 auto_heal_tool_calls = payload.auto_heal_tool_calls,
                 nudge_tool_calls = payload.nudge_tool_calls,
+                request = request,
+                cancel_event = cancel_event,
             )
         )
 
@@ -13414,7 +14888,7 @@ async def anthropic_messages(
             )
 
         if payload.stream:
-            return await _monitored_anthropic(
+            return await _admitted_anthropic(
                 _anthropic_tool_stream(
                     request,
                     cancel_event,
@@ -13427,7 +14901,7 @@ async def anthropic_messages(
                     disable_parallel_tool_use = _disable_parallel,
                 )
             )
-        return await _monitored_anthropic(
+        return await _admitted_anthropic(
             _anthropic_tool_non_streaming(
                 _run_tool_gen,
                 message_id,
@@ -13454,7 +14928,7 @@ async def anthropic_messages(
         )
 
     if payload.stream:
-        return await _monitored_anthropic(
+        return await _admitted_anthropic(
             _anthropic_plain_stream(
                 request,
                 cancel_event,
@@ -13465,7 +14939,7 @@ async def anthropic_messages(
                 openai_messages = openai_messages,
             )
         )
-    return await _monitored_anthropic(
+    return await _admitted_anthropic(
         _anthropic_plain_non_streaming(
             _run_plain_gen,
             message_id,
@@ -13503,134 +14977,132 @@ async def _anthropic_tool_stream(
         )
 
     async def _stream():
-        emitter = AnthropicStreamEmitter()
-        for line in emitter.start(message_id, model_name, input_tokens = input_tokens):
-            yield line
-
-        captured_finish_reason = None
-        # Whether the response currently ends on a pending tool_use block (the
-        # client must act → stop_reason "tool_use") as opposed to final text.
-        # The server may run a tool and then keep generating, which flips this
-        # back to False — that is an end_turn (or max_tokens) response.
-        ends_on_tool_use = False
-        tool_blocks_emitted = 0
-        drop_until_tool_end = False
-        # Last drop-branch keepalive, seeded to stream start so a chatty tool busy
-        # past the stall window still gets a keepalive though its events are dropped.
-        _last_drop_keepalive = time.monotonic()
-
-        gen = run_gen()
-        _next_task = None
-        # Watcher to cancel on disconnect: the in-loop poll fires only between
-        # events, so a mid-prefill disconnect would otherwise hold the decode slot.
-        disconnect_watcher = asyncio.create_task(
-            _await_disconnect_then_cancel(request, cancel_event)
-        )
+        # The server-tool loop decodes on llama-server for its whole body, so without an entry a
+        # non-forced /unload saw zero generations and tore the server down mid-response. Entered
+        # inside the body generator so a response whose body never starts leaves nothing behind.
+        # No thread_id: public API surface.
+        _tracker = _TrackedCancel(cancel_event, model = model_name, kind = "messages")
+        _tracker.__enter__()
         try:
-            while True:
-                if cancel_event.is_set() or await request.is_disconnected():
-                    cancel_event.set()
-                    return
-                # Stall keepalive (see GGUF tool stream): silent backend segments
-                # must not leave the SSE stream idle past proxy timeouts.
-                _next_task = asyncio.create_task(asyncio.to_thread(next, gen, _sentinel))
-                while True:
-                    _done_tasks, _ = await asyncio.wait(
-                        {_next_task},
-                        timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
-                    )
-                    if _done_tasks:
-                        break
-                    yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
-                event = _next_task.result()
-                # Done; drop the reference so the finally-block drain no-ops.
-                _next_task = None
-                if event is _sentinel:
-                    break
-                etype = event.get("type")
-                if etype == "heartbeat":
-                    # Tool-wrapper heartbeat -> SSE keepalive, checked BEFORE the drop
-                    # skip: a dropped tool still runs server-side and its events keep the
-                    # stall keepalive from firing, so dropping heartbeats would go silent.
-                    yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
-                    continue
-                if etype in ("tool_output", "tool_args"):
-                    # Live stdout / arg streaming have no Anthropic Messages equivalent
-                    # (the full call/result follow in tool_use / tool_result), so drop them.
-                    # They keep the stall keepalive from firing, so a chatty tool would go
-                    # silent past the ~100s proxy cap; emit a rate-limited keepalive instead.
-                    _now = time.monotonic()
-                    if _now - _last_drop_keepalive >= _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S:
-                        _last_drop_keepalive = _now
-                        yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
-                    continue
-                if drop_until_tool_end:
-                    # disable_parallel_tool_use: skip every event until (and
-                    # including) this dropped tool call's tool_end.
-                    if etype == "tool_end":
-                        drop_until_tool_end = False
-                    continue
-                if etype == "metadata":
-                    _fr = event.get("finish_reason")
-                    if _fr is not None:
-                        captured_finish_reason = _fr
-                # Strip leaked tool-call XML from content events first, so a
-                # content event that was purely tool XML doesn't count as text.
-                # Protected helper preserves <think> rehearsal and balanced
-                # [TOOL_CALLS] trailing prose (raw _TOOL_XML_RE.sub corrupts both).
-                if etype == "content":
-                    event = dict(event)
-                    event["text"] = _strip_tool_xml_for_display(
-                        event["text"],
-                        auto_heal_tool_calls = True,
-                        enabled_tool_names = _display_names,
-                    )
-                # disable_parallel_tool_use: keep only the first tool_use block,
-                # dropping every later tool_start and its paired tool_end (robust
-                # to empty tool-call ids — tracked by state, not id matching).
-                if etype == "tool_start":
-                    if disable_parallel_tool_use and tool_blocks_emitted >= 1:
-                        drop_until_tool_end = True
-                        continue
-                    ends_on_tool_use = True
-                elif etype == "tool_end":
-                    tool_blocks_emitted += 1
-                    # A tool_end means Unsloth executed the tool server-side, so
-                    # the response no longer ends on a pending client action.
-                    # Without this, a server tool that produces no trailing text
-                    # would be mislabeled stop_reason "tool_use", telling the
-                    # client to run a tool Unsloth already ran.
-                    ends_on_tool_use = False
-                elif etype == "content" and event.get("text"):
-                    ends_on_tool_use = False
-                for line in emitter.feed(event):
-                    yield line
-        except Exception as e:
-            logger.error("anthropic_messages stream error: %s", e)
-            # force = True so an unclassified mid-stream failure (llama-server crash,
-            # decode OOM, dropped socket) still emits an SSE error and returns, instead
-            # of a normal message_stop that masks a truncated turn as a clean finish.
-            _error_event = _anthropic_stream_error_event(e, force = True)
-            if _error_event is not None:
-                yield _error_event
-                return
-        finally:
-            await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
-            # Drain a still-running next(gen) worker before closing, so a mid-prefill
-            # disconnect releases the thread/generator/tool resources. Closing first
-            # would race into ValueError('generator already executing').
-            await _drain_pending_next_task(_next_task, cancel_event)
-            if gen is not None:
-                try:
-                    await asyncio.to_thread(gen.close)
-                except (RuntimeError, ValueError):
-                    pass
+            emitter = AnthropicStreamEmitter()
+            for line in emitter.start(message_id, model_name, input_tokens = input_tokens):
+                yield line
 
-        stop_reason = openai_finish_to_anthropic_stop(
-            captured_finish_reason, had_tool_calls = ends_on_tool_use
-        )
-        for line in emitter.finish(stop_reason = stop_reason, stop_sequence = None):
-            yield line
+            captured_finish_reason = None
+            # Response ends on a pending tool_use block rather than final text; a server tool
+            # that keeps generating flips this back to False.
+            ends_on_tool_use = False
+            tool_blocks_emitted = 0
+            drop_until_tool_end = False
+            # Last drop-branch keepalive, seeded to stream start so a chatty tool busy past the
+            # stall window still gets one though its events are dropped.
+            _last_drop_keepalive = time.monotonic()
+
+            gen = run_gen()
+            _next_task = None
+            # Watcher to cancel on disconnect: the in-loop poll fires only between events,
+            # so a mid-prefill disconnect would hold the decode slot.
+            disconnect_watcher = asyncio.create_task(
+                _await_disconnect_then_cancel(request, cancel_event)
+            )
+            try:
+                while True:
+                    if cancel_event.is_set() or await request.is_disconnected():
+                        cancel_event.set()
+                        return
+                    # Stall keepalive (see GGUF tool stream): silent backend segments must not
+                    # leave the SSE stream idle past proxy timeouts.
+                    _next_task = asyncio.create_task(asyncio.to_thread(next, gen, _sentinel))
+                    while True:
+                        _done_tasks, _ = await asyncio.wait(
+                            {_next_task},
+                            timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
+                        )
+                        if _done_tasks:
+                            break
+                        yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                    event = _next_task.result()
+                    # Done; drop the reference so the finally-block drain no-ops.
+                    _next_task = None
+                    if event is _sentinel:
+                        break
+                    etype = event.get("type")
+                    if etype == "heartbeat":
+                        # Tool-wrapper heartbeat -> SSE keepalive, checked BEFORE the drop skip:
+                        # a dropped tool still runs and suppresses the stall keepalive.
+                        yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                        continue
+                    if etype in ("tool_output", "tool_args"):
+                        # No Anthropic Messages equivalent (the full call/result follow in tool_use /
+                        # tool_result), so drop them. They suppress the stall keepalive, so emit a
+                        # rate-limited one instead of going silent past the ~100s proxy cap.
+                        _now = time.monotonic()
+                        if _now - _last_drop_keepalive >= _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S:
+                            _last_drop_keepalive = _now
+                            yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                        continue
+                    if drop_until_tool_end:
+                        # disable_parallel_tool_use: skip every event until (and
+                        # including) this dropped tool call's tool_end.
+                        if etype == "tool_end":
+                            drop_until_tool_end = False
+                        continue
+                    if etype == "metadata":
+                        _fr = event.get("finish_reason")
+                        if _fr is not None:
+                            captured_finish_reason = _fr
+                    # Strip leaked tool-call XML first, so a purely-tool-XML content event doesn't
+                    # count as text. The protected helper keeps <think> rehearsal and balanced
+                    # [TOOL_CALLS] trailing prose, which a raw sub corrupts.
+                    if etype == "content":
+                        event = dict(event)
+                        event["text"] = _strip_tool_xml_for_display(
+                            event["text"],
+                            auto_heal_tool_calls = True,
+                            enabled_tool_names = _display_names,
+                        )
+                    # disable_parallel_tool_use: keep only the first tool_use block, dropping
+                    # later tool_start/tool_end pairs (by state, not id: ids may be empty).
+                    if etype == "tool_start":
+                        if disable_parallel_tool_use and tool_blocks_emitted >= 1:
+                            drop_until_tool_end = True
+                            continue
+                        ends_on_tool_use = True
+                    elif etype == "tool_end":
+                        tool_blocks_emitted += 1
+                        # Unsloth ran the tool server-side, so the response no longer ends on a pending
+                        # client action; otherwise stop_reason "tool_use" tells the client to run it again.
+                        ends_on_tool_use = False
+                    elif etype == "content" and event.get("text"):
+                        ends_on_tool_use = False
+                    for line in emitter.feed(event):
+                        yield line
+            except Exception as e:
+                logger.error("anthropic_messages stream error: %s", e)
+                # force = True so an unclassified mid-stream failure emits an SSE error instead
+                # of a message_stop that masks a truncated turn as a clean finish.
+                _error_event = _anthropic_stream_error_event(e, force = True)
+                if _error_event is not None:
+                    yield _error_event
+                    return
+            finally:
+                await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+                # Drain a still-running next(gen) worker first, so a mid-prefill disconnect releases
+                # its resources; closing first races into 'already executing'.
+                await _drain_pending_next_task(_next_task, cancel_event)
+                if gen is not None:
+                    try:
+                        await asyncio.to_thread(gen.close)
+                    except (RuntimeError, ValueError):
+                        pass
+
+            stop_reason = openai_finish_to_anthropic_stop(
+                captured_finish_reason, had_tool_calls = ends_on_tool_use
+            )
+            for line in emitter.finish(stop_reason = stop_reason, stop_sequence = None):
+                yield line
+        finally:
+            _tracker.__exit__(None, None, None)
 
     return _sse_streaming_response(_stream())
 
@@ -13654,75 +15126,81 @@ async def _anthropic_plain_stream(
         input_tokens = await asyncio.to_thread(llama_backend.count_chat_tokens, openai_messages)
 
     async def _stream():
-        emitter = AnthropicStreamEmitter()
-        for line in emitter.start(message_id, model_name, input_tokens = input_tokens):
-            yield line
-
-        captured_finish_reason = None
-
-        gen = run_gen()
-        _next_task = None
-        # Watcher to cancel on disconnect: the in-loop poll fires only between
-        # chunks, so a mid-prefill disconnect would otherwise hold the decode slot.
-        disconnect_watcher = asyncio.create_task(
-            _await_disconnect_then_cancel(request, cancel_event)
-        )
+        # Registered like the tool stream above: this default /v1/messages path decodes on
+        # llama-server, so without an entry a non-forced /unload tore it down mid-response.
+        _tracker = _TrackedCancel(cancel_event, model = model_name, kind = "messages")
+        _tracker.__enter__()
         try:
-            while True:
-                if cancel_event.is_set() or await request.is_disconnected():
-                    cancel_event.set()
-                    return
-                # Stall keepalive (see Anthropic tool stream) each window while
-                # next(gen) runs in a worker.
-                _next_task = asyncio.create_task(asyncio.to_thread(next, gen, _sentinel))
-                while True:
-                    _done_tasks, _ = await asyncio.wait(
-                        {_next_task},
-                        timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
-                    )
-                    if _done_tasks:
-                        break
-                    yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
-                cumulative = _next_task.result()
-                # Done; drop the reference so the finally-block drain no-ops.
-                _next_task = None
-                if cumulative is _sentinel:
-                    break
-                if isinstance(cumulative, dict):
-                    if cumulative.get("type") == "metadata":
-                        _fr = cumulative.get("finish_reason")
-                        if _fr is not None:
-                            captured_finish_reason = _fr
-                        for line in emitter.feed(cumulative):
-                            yield line
-                    continue
-                # Plain generator yields cumulative text strings
-                for line in emitter.feed({"type": "content", "text": cumulative}):
-                    yield line
-        except Exception as e:
-            logger.error("anthropic_messages stream error: %s", e)
-            # force = True so an unclassified mid-stream failure (llama-server crash,
-            # decode OOM, dropped socket) still emits an SSE error and returns, instead
-            # of a normal message_stop that masks a truncated turn as a clean finish.
-            _error_event = _anthropic_stream_error_event(e, force = True)
-            if _error_event is not None:
-                yield _error_event
-                return
-        finally:
-            await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
-            # Drain a still-running next(gen) worker before closing, so a mid-prefill
-            # disconnect releases the thread/generator/model resources. Closing first
-            # would race into ValueError('generator already executing').
-            await _drain_pending_next_task(_next_task, cancel_event)
-            if gen is not None:
-                try:
-                    await asyncio.to_thread(gen.close)
-                except (RuntimeError, ValueError):
-                    pass
+            emitter = AnthropicStreamEmitter()
+            for line in emitter.start(message_id, model_name, input_tokens = input_tokens):
+                yield line
 
-        stop_reason = openai_finish_to_anthropic_stop(captured_finish_reason, had_tool_calls = False)
-        for line in emitter.finish(stop_reason = stop_reason, stop_sequence = None):
-            yield line
+            captured_finish_reason = None
+
+            gen = run_gen()
+            _next_task = None
+            # Watcher to cancel on disconnect: the in-loop poll fires only between chunks,
+            # so a mid-prefill disconnect would hold the decode slot.
+            disconnect_watcher = asyncio.create_task(
+                _await_disconnect_then_cancel(request, cancel_event)
+            )
+            try:
+                while True:
+                    if cancel_event.is_set() or await request.is_disconnected():
+                        cancel_event.set()
+                        return
+                    # Stall keepalive each window while next(gen) runs in a worker.
+                    _next_task = asyncio.create_task(asyncio.to_thread(next, gen, _sentinel))
+                    while True:
+                        _done_tasks, _ = await asyncio.wait(
+                            {_next_task},
+                            timeout = _LOCAL_TOOL_STREAM_STALL_KEEPALIVE_S,
+                        )
+                        if _done_tasks:
+                            break
+                        yield _OPENAI_PASSTHROUGH_SSE_KEEPALIVE
+                    cumulative = _next_task.result()
+                    # Done; drop the reference so the finally-block drain no-ops.
+                    _next_task = None
+                    if cumulative is _sentinel:
+                        break
+                    if isinstance(cumulative, dict):
+                        if cumulative.get("type") == "metadata":
+                            _fr = cumulative.get("finish_reason")
+                            if _fr is not None:
+                                captured_finish_reason = _fr
+                            for line in emitter.feed(cumulative):
+                                yield line
+                        continue
+                    # Plain generator yields cumulative text strings
+                    for line in emitter.feed({"type": "content", "text": cumulative}):
+                        yield line
+            except Exception as e:
+                logger.error("anthropic_messages stream error: %s", e)
+                # force = True so an unclassified mid-stream failure emits an SSE error instead
+                # of a message_stop that masks a truncated turn as a clean finish.
+                _error_event = _anthropic_stream_error_event(e, force = True)
+                if _error_event is not None:
+                    yield _error_event
+                    return
+            finally:
+                await _stop_local_disconnect_cancel_watcher(disconnect_watcher)
+                # Drain a still-running next(gen) worker first, so a mid-prefill disconnect releases
+                # its resources; closing first races into 'already executing'.
+                await _drain_pending_next_task(_next_task, cancel_event)
+                if gen is not None:
+                    try:
+                        await asyncio.to_thread(gen.close)
+                    except (RuntimeError, ValueError):
+                        pass
+
+            stop_reason = openai_finish_to_anthropic_stop(
+                captured_finish_reason, had_tool_calls = False
+            )
+            for line in emitter.finish(stop_reason = stop_reason, stop_sequence = None):
+                yield line
+        finally:
+            _tracker.__exit__(None, None, None)
 
     return _sse_streaming_response(_stream())
 
@@ -13914,6 +15392,113 @@ async def _anthropic_plain_non_streaming(run_gen, message_id, model_name):
 # =====================================================================
 
 
+_JSON_SCHEMA_MAP_KEYWORDS = frozenset(
+    {
+        "$defs",
+        "definitions",
+        "dependentSchemas",
+        "patternProperties",
+        "properties",
+    }
+)
+_JSON_SCHEMA_SINGLE_KEYWORDS = frozenset(
+    {
+        "additionalProperties",
+        "contains",
+        "contentSchema",
+        "else",
+        "if",
+        "items",
+        "not",
+        "propertyNames",
+        "then",
+        "unevaluatedItems",
+        "unevaluatedProperties",
+    }
+)
+_JSON_SCHEMA_LIST_KEYWORDS = frozenset({"allOf", "anyOf", "oneOf", "prefixItems"})
+_LLAMA_GRAMMAR_MAX_REPETITION = 2000
+_JSON_SCHEMA_REPETITION_KEYWORDS = frozenset({"maxItems", "maxLength", "minItems", "minLength"})
+
+
+def _llama_compatible_tool_schema(schema):
+    """Return a llama.cpp-compatible copy of one JSON Schema node.
+
+    JSON Schema ``pattern`` expressions match anywhere in a string, so an
+    unanchored pattern is valid and cannot be made compatible by merely adding
+    ``^`` and ``$`` without changing its meaning. llama.cpp's grammar converter
+    currently rejects those patterns outright. Its grammar parser likewise
+    rejects repetition bounds above 2000. Omit only those unsupported
+    constraints from the local-backend copy; the agent retains and validates
+    its original schema, while every compatible constraint still reaches
+    llama.cpp.
+    """
+    if not isinstance(schema, dict):
+        return schema
+
+    compatible = dict(schema)
+    pattern = compatible.get("pattern")
+    if isinstance(pattern, str) and not (pattern.startswith("^") and pattern.endswith("$")):
+        compatible.pop("pattern")
+    # llama-grammar.cpp refuses repetition bounds above its sane-default
+    # threshold. Dropping the local-backend constraint preserves every value
+    # the client schema accepts; capping it would incorrectly reject otherwise
+    # valid tool arguments.
+    for keyword in _JSON_SCHEMA_REPETITION_KEYWORDS:
+        bound = compatible.get(keyword)
+        if (
+            isinstance(bound, int)
+            and not isinstance(bound, bool)
+            and bound > _LLAMA_GRAMMAR_MAX_REPETITION
+        ):
+            compatible.pop(keyword)
+
+    for keyword in _JSON_SCHEMA_MAP_KEYWORDS:
+        children = compatible.get(keyword)
+        if isinstance(children, dict):
+            compatible[keyword] = {
+                key: _llama_compatible_tool_schema(value) for key, value in children.items()
+            }
+
+    for keyword in _JSON_SCHEMA_SINGLE_KEYWORDS:
+        child = compatible.get(keyword)
+        if isinstance(child, dict):
+            compatible[keyword] = _llama_compatible_tool_schema(child)
+
+    for keyword in _JSON_SCHEMA_LIST_KEYWORDS:
+        children = compatible.get(keyword)
+        if isinstance(children, list):
+            compatible[keyword] = [_llama_compatible_tool_schema(value) for value in children]
+
+    return compatible
+
+
+def _llama_compatible_tools(openai_tools):
+    if not isinstance(openai_tools, list):
+        return openai_tools
+
+    compatible_tools = []
+    for tool in openai_tools:
+        if not isinstance(tool, dict):
+            compatible_tools.append(tool)
+            continue
+        function = tool.get("function")
+        parameters = function.get("parameters") if isinstance(function, dict) else None
+        if not isinstance(parameters, dict):
+            compatible_tools.append(tool)
+            continue
+        compatible_tools.append(
+            {
+                **tool,
+                "function": {
+                    **function,
+                    "parameters": _llama_compatible_tool_schema(parameters),
+                },
+            }
+        )
+    return compatible_tools
+
+
 def _build_passthrough_payload(
     openai_messages,
     openai_tools,
@@ -13941,7 +15526,7 @@ def _build_passthrough_payload(
         "stream": stream,
     }
     if openai_tools:
-        body["tools"] = openai_tools
+        body["tools"] = _llama_compatible_tools(openai_tools)
         if tool_choice is not None:
             body["tool_choice"] = tool_choice
     if seed is not None:
@@ -13977,6 +15562,28 @@ def _build_passthrough_payload(
     return body
 
 
+async def _anthropic_passthrough_retry_url(llama_backend, exc):
+    """Fresh upstream URL after respawning a dead llama-server, else None.
+
+    A crashed server relaunches on a NEW ephemeral port, so a passthrough still
+    holding the old base_url keeps failing until the next load. Mirrors the
+    respawn-and-retry in generate_chat_completion. None when an MTP+tensor crash
+    already scheduled its own recovery, or when nothing needed respawning.
+    """
+    recover = getattr(llama_backend, "_maybe_recover_from_mtp_crash", None)
+    if recover is not None and recover(exc):
+        return None
+    # Only the first caller gets True above; the rest must not respawn the same
+    # MTP config underneath the fallback that is already reloading without it.
+    if getattr(llama_backend, "_mtp_runtime_fallback_in_progress", False):
+        return None
+    respawn = getattr(llama_backend, "_respawn_if_dead", None)
+    if respawn is None or not await asyncio.to_thread(respawn):
+        return None
+    logger.warning("llama-server was unreachable; respawned it and retrying the passthrough")
+    return f"{llama_backend.base_url}/v1/chat/completions"
+
+
 async def _anthropic_passthrough_stream(
     request,
     cancel_event,
@@ -14029,10 +15636,23 @@ async def _anthropic_passthrough_stream(
 
     # cancel_id mirrors the OpenAI passthrough so a per-run cancel POST
     # works without the caller having to know the local message_id.
-    _tracker = _TrackedCancel(cancel_event, cancel_id, session_id, message_id)
-    _tracker.__enter__()
+    # No thread_id: public API surface, but still registered so a reload cannot yank
+    # llama-server out from under it. Built here, entered below inside _stream().
+    _tracker = _TrackedCancel(
+        cancel_event,
+        cancel_id,
+        session_id,
+        message_id,
+        model = model_name,
+        kind = "messages",
+    )
 
     async def _stream():
+        # Entered inside the body, not eagerly: aclose() runs no body on a generator
+        # that never started, so a client that drops first would leave the run
+        # registered until restart, 409-ing every swap. Ahead of the first yield, so
+        # the opening lines are covered as well.
+        _tracker.__enter__()
         emitter = AnthropicPassthroughEmitter()
         # Promote text-form tool calls (declared client tools only) into
         # tool_use blocks; verbatim behavior when healing is off or no tools.
@@ -14044,8 +15664,15 @@ async def _anthropic_passthrough_stream(
                 openai_tools,
                 disable_parallel_tool_use = disable_parallel_tool_use,
             )
-        for line in emitter.start(message_id, model_name, input_tokens = input_tokens):
-            yield line
+        # These yields sit outside the teardown try below, so a disconnect while
+        # the opening lines are being sent would strand the tracker. __exit__ is
+        # idempotent, so the normal path still exits once, down there.
+        try:
+            for line in emitter.start(message_id, model_name, input_tokens = input_tokens):
+                yield line
+        except BaseException:
+            _tracker.__exit__(None, None, None)
+            raise
 
         # Manage the httpx client, response, AND the aiter_lines() async
         # generator MANUALLY -- no `async with`, no anonymous iterator.
@@ -14080,13 +15707,24 @@ async def _anthropic_passthrough_stream(
         cancel_watcher = None
         disconnect_watcher = None
         try:
-            req = client.build_request(
-                "POST", target_url, json = body, headers = {"Connection": "close"}
-            )
-            first_token_deadline = time.monotonic() + _DEFAULT_FIRST_TOKEN_TIMEOUT_S
-            resp = await _send_stream_with_preheader_cancel(
-                client, req, cancel_event, request = request
-            )
+            url = target_url
+            try:
+                req = client.build_request("POST", url, json = body, headers = {"Connection": "close"})
+                first_token_deadline = time.monotonic() + _DEFAULT_FIRST_TOKEN_TIMEOUT_S
+                resp = await _send_stream_with_preheader_cancel(
+                    client, req, cancel_event, request = request
+                )
+            except httpx.ConnectError as exc:
+                # Nothing has streamed yet, so a respawned server can be retried once
+                # on its new port without duplicating output.
+                url = await _anthropic_passthrough_retry_url(llama_backend, exc)
+                if url is None:
+                    raise
+                req = client.build_request("POST", url, json = body, headers = {"Connection": "close"})
+                first_token_deadline = time.monotonic() + _DEFAULT_FIRST_TOKEN_TIMEOUT_S
+                resp = await _send_stream_with_preheader_cancel(
+                    client, req, cancel_event, request = request
+                )
             if resp is None:
                 return
 
@@ -14165,7 +15803,13 @@ async def _anthropic_passthrough_stream(
         for line in emitter.finish():
             yield line
 
-    return _sse_streaming_response(_stream())
+    # The tracker is entered eagerly above, but _stream()'s finally is what exits
+    # it. Closing an async generator that never started is a no-op, so hand the
+    # response a cleanup hook or a pre-start give-up leaks the registry entry.
+    return _sse_streaming_response(
+        _stream(),
+        unstarted_cleanup = _tracked_cancel_unstarted_cleanup(_tracker),
+    )
 
 
 async def _anthropic_passthrough_non_streaming(
@@ -14186,8 +15830,16 @@ async def _anthropic_passthrough_non_streaming(
     disable_parallel_tool_use = False,
     auto_heal_tool_calls = None,
     nudge_tool_calls = None,
+    request: Optional[Request] = None,
+    cancel_event = None,
 ):
-    """Non-streaming client-side pass-through."""
+    """Non-streaming client-side pass-through.
+
+    Both POSTs run on a per-request client so a Stop or a forced swap can close
+    it and interrupt them. The pooled ``nonstreaming_client()`` cannot be closed
+    without disturbing unrelated calls, which left this path registered with the
+    swap gate but deaf to the event it registered.
+    """
     target_url = f"{llama_backend.base_url}/v1/chat/completions"
     body = _build_passthrough_payload(
         openai_messages,
@@ -14205,125 +15857,162 @@ async def _anthropic_passthrough_non_streaming(
         backend_ctx = llama_backend.context_length,
     )
 
-    resp = await nonstreaming_client().post(
-        target_url,
-        json = body,
-        timeout = _llama_non_streaming_generation_timeout(),
+    _client = _cancelable_nonstreaming_client()
+    _cancel_watcher = asyncio.create_task(
+        _await_cancel_or_disconnect_then_close_client(
+            cancel_event = cancel_event,
+            request = request,
+            client = _client,
+        )
     )
 
-    if resp.status_code != 200:
-        raise HTTPException(
-            status_code = resp.status_code,
-            detail = _friendly_upstream_error(resp.text[:500]),
-        )
-
-    data = resp.json()
-    # tool_choice arrives here already converted to the OpenAI shape.
-    _allowed_tools = heal_gate(auto_heal_tool_calls, openai_tools, tool_choice)
-
-    # Opt-in single-retry nudge (mirrors the OpenAI passthrough): the model
-    # tried to call a tool but nothing usable came out; re-ask once with the
-    # prompt prefix intact so llama-server's KV cache is reused.
-    if (
-        _allowed_tools
-        and nudge_enabled(nudge_tool_calls)
-        and nudge_should_retry(data, _allowed_tools, openai_tools)
-    ):
-        retry_body = {
-            **body,
-            "messages": [*body.get("messages", []), *nudge_messages(data, _allowed_tools)],
-        }
+    async def _post(payload_body):
+        nonlocal target_url
         try:
-            retry_resp = await nonstreaming_client().post(
+            return await _client.post(
                 target_url,
-                json = retry_body,
+                json = payload_body,
+                timeout = _llama_non_streaming_generation_timeout(),
+            )
+        except httpx.RequestError as exc:
+            # The watcher closes the client to break a blocked POST, so a transport error
+            # with the event set is the cancel, not a failure.
+            if cancel_event is not None and cancel_event.is_set():
+                raise asyncio.CancelledError()
+            # Nothing was returned yet, so retry once against the respawned server's
+            # new port; the nudge retry below then reuses the same fresh URL.
+            retry_url = (
+                await _anthropic_passthrough_retry_url(llama_backend, exc)
+                if isinstance(exc, httpx.ConnectError)
+                else None
+            )
+            if retry_url is None:
+                raise
+            target_url = retry_url
+            return await _client.post(
+                target_url,
+                json = payload_body,
                 timeout = _llama_non_streaming_generation_timeout(),
             )
-            if retry_resp.status_code == 200:
-                retry_data = retry_resp.json()
-                if response_has_promotable_calls(retry_data, _allowed_tools, openai_tools):
-                    data = retry_data
-        except (httpx.RequestError, ValueError) as exc:
-            logger.warning("tool-call nudge retry failed; keeping original: %s", exc)
 
-    choice = (data.get("choices") or [{}])[0]
-    message = choice.get("message") or {}
-    finish_reason = choice.get("finish_reason")
+    try:
+        resp = await _post(body)
 
-    healing_active = bool(_allowed_tools)
-    healed_events = (
-        heal_openai_message_events(message, _allowed_tools, openai_tools)
-        if healing_active
-        else None
-    )
+        if resp.status_code != 200:
+            raise HTTPException(
+                status_code = resp.status_code,
+                detail = _friendly_upstream_error(resp.text[:500]),
+            )
 
-    content_blocks = []
-    tool_calls = []
-    if healed_events:
-        emitted_tool_uses = 0
-        for kind, value in healed_events:
-            if kind == "text":
-                text = str(value).strip()
+        data = resp.json()
+        # tool_choice arrives here already converted to the OpenAI shape.
+        _allowed_tools = heal_gate(auto_heal_tool_calls, openai_tools, tool_choice)
+
+        # Opt-in single-retry nudge (mirrors the OpenAI passthrough): the tool call came out
+        # unusable; re-ask with the prompt prefix intact so the KV cache is reused.
+        if (
+            _allowed_tools
+            and nudge_enabled(nudge_tool_calls)
+            and nudge_should_retry(data, _allowed_tools, openai_tools)
+        ):
+            retry_body = {
+                **body,
+                "messages": [*body.get("messages", []), *nudge_messages(data, _allowed_tools)],
+            }
+            try:
+                retry_resp = await _post(retry_body)
+                if retry_resp.status_code == 200:
+                    retry_data = retry_resp.json()
+                    if response_has_promotable_calls(retry_data, _allowed_tools, openai_tools):
+                        data = retry_data
+            except (httpx.RequestError, ValueError) as exc:
+                logger.warning("tool-call nudge retry failed; keeping original: %s", exc)
+
+        choice = (data.get("choices") or [{}])[0]
+        message = choice.get("message") or {}
+        finish_reason = choice.get("finish_reason")
+
+        healing_active = bool(_allowed_tools)
+        healed_events = (
+            heal_openai_message_events(message, _allowed_tools, openai_tools)
+            if healing_active
+            else None
+        )
+
+        content_blocks = []
+        tool_calls = []
+        if healed_events:
+            emitted_tool_uses = 0
+            for kind, value in healed_events:
+                if kind == "text":
+                    text = str(value).strip()
+                    if text:
+                        content_blocks.append(AnthropicResponseTextBlock(text = text))
+                    continue
+                if disable_parallel_tool_use and emitted_tool_uses >= 1:
+                    continue
+                fn = value.get("function") or {}
+                try:
+                    args = json.loads(fn.get("arguments", "{}"))
+                except json.JSONDecodeError:
+                    args = {}
+                tool_calls.append(value)
+                emitted_tool_uses += 1
+                content_blocks.append(
+                    AnthropicResponseToolUseBlock(
+                        id = anthropic_tool_use_id(value.get("id")),
+                        name = fn.get("name", ""),
+                        input = args,
+                    )
+                )
+        else:
+            text = message.get("content") or ""
+            if text:
+                # Keep unpromoted bytes when healing is active; legacy stripping is only for opted-out
+                # or no-client-tool requests. The protected helper preserves <think> rehearsal and
+                # balanced [TOOL_CALLS] prose, gated on the declared tools so an inactive
+                # NAME[ARGS]{...} example is kept.
+                if not healing_active:
+                    text = _strip_tool_xml_for_display(
+                        text,
+                        auto_heal_tool_calls = True,
+                        enabled_tool_names = _display_tool_name_gate(openai_tools),
+                    )
+                text = text.strip()
                 if text:
                     content_blocks.append(AnthropicResponseTextBlock(text = text))
-                continue
-            if disable_parallel_tool_use and emitted_tool_uses >= 1:
-                continue
-            fn = value.get("function") or {}
-            try:
-                args = json.loads(fn.get("arguments", "{}"))
-            except json.JSONDecodeError:
-                args = {}
-            tool_calls.append(value)
-            emitted_tool_uses += 1
-            content_blocks.append(
-                AnthropicResponseToolUseBlock(
-                    id = anthropic_tool_use_id(value.get("id")),
-                    name = fn.get("name", ""),
-                    input = args,
-                )
-            )
-    else:
-        text = message.get("content") or ""
-        if text:
-            # Keep unpromoted bytes when healing is active; legacy stripping is
-            # only for opted-out or no-client-tool requests. Protected helper (not
-            # raw _TOOL_XML_RE.sub): preserves <think> rehearsal and balanced
-            # [TOOL_CALLS] trailing prose, gated on the declared tools so an
-            # inactive NAME[ARGS]{...} example in the final text is kept.
-            if not healing_active:
-                text = _strip_tool_xml_for_display(
-                    text,
-                    auto_heal_tool_calls = True,
-                    enabled_tool_names = _display_tool_name_gate(openai_tools),
-                )
-            text = text.strip()
-            if text:
-                content_blocks.append(AnthropicResponseTextBlock(text = text))
 
-        tool_calls = message.get("tool_calls") or []
-        if disable_parallel_tool_use and len(tool_calls) > 1:
-            tool_calls = tool_calls[:1]
-        for tc in tool_calls:
-            fn = tc.get("function") or {}
-            try:
-                args = json.loads(fn.get("arguments", "{}"))
-            except json.JSONDecodeError:
-                args = {}
-            content_blocks.append(
-                AnthropicResponseToolUseBlock(
-                    id = anthropic_tool_use_id(tc.get("id")),
-                    name = fn.get("name", ""),
-                    input = args,
+            tool_calls = message.get("tool_calls") or []
+            if disable_parallel_tool_use and len(tool_calls) > 1:
+                tool_calls = tool_calls[:1]
+            for tc in tool_calls:
+                fn = tc.get("function") or {}
+                try:
+                    args = json.loads(fn.get("arguments", "{}"))
+                except json.JSONDecodeError:
+                    args = {}
+                content_blocks.append(
+                    AnthropicResponseToolUseBlock(
+                        id = anthropic_tool_use_id(tc.get("id")),
+                        name = fn.get("name", ""),
+                        input = args,
+                    )
                 )
-            )
 
-    stop_reason = openai_finish_to_anthropic_stop(finish_reason, had_tool_calls = bool(tool_calls))
+        stop_reason = openai_finish_to_anthropic_stop(
+            finish_reason, had_tool_calls = bool(tool_calls)
+        )
 
-    usage = data.get("usage") or {}
-    return _anthropic_message_json_response(
-        message_id, model_name, content_blocks, stop_reason, usage
-    )
+        usage = data.get("usage") or {}
+        return _anthropic_message_json_response(
+            message_id, model_name, content_blocks, stop_reason, usage
+        )
+    finally:
+        await _stop_local_disconnect_cancel_watcher(_cancel_watcher)
+        try:
+            await _client.aclose()
+        except Exception:
+            pass
 
 
 # =====================================================================
@@ -14705,7 +16394,7 @@ async def _openai_passthrough_stream(
     monitor_id: Optional[str] = None,
 ):
     _cancel_keys = (payload.cancel_id, payload.session_id, completion_id)
-    _tracker = _TrackedCancel(cancel_event, *_cancel_keys)
+    _tracker = _TrackedCancel.for_payload(cancel_event, payload, *_cancel_keys)
     _tracker.__enter__()
     try:
         reservation, admission_config = _openai_llama_admission_reserve(
@@ -14714,7 +16403,7 @@ async def _openai_passthrough_stream(
         )
     except LlamaAdmissionQueueFull as exc:
         _tracker.__exit__(None, None, None)
-        _openai_admission_log(
+        _llama_admission_log(
             "queue-full",
             snapshot = exc.snapshot,
             request = request,
@@ -14759,7 +16448,7 @@ async def _openai_passthrough_stream(
         )
 
     admission_wait_started_at = time.monotonic()
-    _openai_admission_log(
+    _llama_admission_log(
         "queued",
         reservation,
         request = request,
@@ -14783,7 +16472,7 @@ async def _openai_passthrough_stream(
                 if isinstance(wait_item, str):
                     yield wait_item
                     continue
-                _openai_admission_log(
+                _llama_admission_log(
                     "granted-after-wait",
                     reservation,
                     request = request,
@@ -14828,7 +16517,7 @@ async def _openai_passthrough_stream(
                             await cleanup()
                 return
         except LlamaAdmissionTimeout as exc:
-            _openai_admission_log(
+            _llama_admission_log(
                 "timeout",
                 reservation,
                 request = request,
@@ -14840,7 +16529,7 @@ async def _openai_passthrough_stream(
             api_monitor.fail(monitor_id, str(exc))
             yield _openai_stream_error_sse(_openai_admission_error_body(exc, status_code = 503))
         except LlamaAdmissionCancelled:
-            _openai_admission_log(
+            _llama_admission_log(
                 "cancelled-before-upstream",
                 reservation,
                 request = request,
@@ -15617,7 +17306,7 @@ async def _openai_passthrough_non_streaming(
             llama_backend = llama_backend,
         )
     except LlamaAdmissionQueueFull as exc:
-        _openai_admission_log(
+        _llama_admission_log(
             "queue-full",
             snapshot = exc.snapshot,
             request = request,
@@ -15632,7 +17321,7 @@ async def _openai_passthrough_non_streaming(
     try:
         if reservation.lease_nowait() is None:
             admission_wait_started_at = time.monotonic()
-            _openai_admission_log(
+            _llama_admission_log(
                 "queued",
                 reservation,
                 request = request,
@@ -15646,7 +17335,7 @@ async def _openai_passthrough_non_streaming(
             cancel_event = cancel_event,
         )
         if admission_wait_started_at is not None:
-            _openai_admission_log(
+            _llama_admission_log(
                 "granted-after-wait",
                 reservation,
                 request = request,
@@ -15668,7 +17357,7 @@ async def _openai_passthrough_non_streaming(
             cancel_event = cancel_event,
         )
     except LlamaAdmissionTimeout as exc:
-        _openai_admission_log(
+        _llama_admission_log(
             "timeout",
             reservation,
             request = request,
@@ -15679,7 +17368,7 @@ async def _openai_passthrough_non_streaming(
         api_monitor.fail(monitor_id, str(exc))
         raise _openai_admission_http_exception(exc, status_code = 503)
     except LlamaAdmissionCancelled as exc:
-        _openai_admission_log(
+        _llama_admission_log(
             "cancelled-before-upstream",
             reservation,
             request = request,
diff --git a/studio/backend/routes/settings.py b/studio/backend/routes/settings.py
index fef18a9145..7770c12a8a 100644
--- a/studio/backend/routes/settings.py
+++ b/studio/backend/routes/settings.py
@@ -37,12 +37,14 @@ from utils.helper_precache_settings import (
 from utils.coding_agents import CODING_AGENTS, detect_installed_coding_agents
 from utils.openai_auto_switch_settings import (
     DEFAULT_AUTO_UNLOAD_KEEP_KV,
+    DEFAULT_OPENAI_AUTO_DOWNLOAD_ENABLED,
     DEFAULT_OPENAI_AUTO_SWITCH_ENABLED,
     get_auto_unload_idle_seconds,
     get_auto_unload_keep_kv,
     get_model_overrides,
     get_openai_auto_switch_enabled,
     get_stored_auto_unload_idle_seconds,
+    get_stored_openai_auto_download_enabled,
     set_model_override,
     set_openai_auto_switch,
 )
@@ -112,6 +114,7 @@ class OpenAIAutoSwitchPayload(BaseModel):
     # None leaves the stored value untouched (partial updates can't clobber it).
     auto_unload_idle_seconds: Optional[int] = Field(default = None, ge = 0)
     auto_unload_keep_kv: Optional[bool] = None
+    auto_download_model: Optional[bool] = None
 
 
 class OpenAIAutoSwitchResponse(BaseModel):
@@ -123,6 +126,8 @@ class OpenAIAutoSwitchResponse(BaseModel):
     # is false, so the UI can show idle-unload as active instead of "needs enable".
     idle_unload_active: bool = False
     auto_unload_keep_kv: bool = DEFAULT_AUTO_UNLOAD_KEEP_KV
+    # Stored, not effective: the UI must round-trip the saved value across an auto-switch toggle.
+    auto_download_model: bool = DEFAULT_OPENAI_AUTO_DOWNLOAD_ENABLED
 
 
 class ModelOverridePayload(BaseModel):
@@ -245,6 +250,7 @@ def get_openai_auto_switch(
         auto_unload_idle_seconds = get_stored_auto_unload_idle_seconds(),
         idle_unload_active = get_auto_unload_idle_seconds() > 0,
         auto_unload_keep_kv = get_auto_unload_keep_kv(),
+        auto_download_model = get_stored_openai_auto_download_enabled(),
     )
 
 
@@ -253,8 +259,11 @@ def update_openai_auto_switch(
     payload: OpenAIAutoSwitchPayload, current_subject: str = Depends(get_current_subject)
 ) -> OpenAIAutoSwitchResponse:
     try:
-        enabled, idle_seconds, keep_kv = set_openai_auto_switch(
-            payload.enabled, payload.auto_unload_idle_seconds, payload.auto_unload_keep_kv
+        enabled, idle_seconds, keep_kv, auto_download = set_openai_auto_switch(
+            payload.enabled,
+            payload.auto_unload_idle_seconds,
+            payload.auto_unload_keep_kv,
+            payload.auto_download_model,
         )
     except ValueError as exc:
         raise log_and_http_error(
@@ -274,6 +283,7 @@ def update_openai_auto_switch(
         auto_unload_idle_seconds = idle_seconds,
         idle_unload_active = idle_unload_active,
         auto_unload_keep_kv = keep_kv,
+        auto_download_model = auto_download,
     )
 
 
diff --git a/studio/backend/run.py b/studio/backend/run.py
index 5dd27db4f9..08d1c5299e 100644
--- a/studio/backend/run.py
+++ b/studio/backend/run.py
@@ -1377,13 +1377,21 @@ def _apply_cli_tool_policy(enable_tools: "Optional[bool]") -> None:
     set_tool_policy(enable_tools)
 
 
+# Mirror unsloth_cli/commands/studio.py's _PARALLEL_*: the admission queue caps concurrent
+# chats at the slot count, so a direct launch matches the CLI (VRAM fit may still cut it
+# back). Defined above run_server() so embedders that omit it do not serialise every chat.
+_PARALLEL_MIN = 1
+_PARALLEL_MAX = 64
+_PARALLEL_DEFAULT_PLAIN = 4
+
+
 def run_server(
     host: str = "127.0.0.1",
     port: int = 8888,
     frontend_path: Path = _DEFAULT_FRONTEND_PATH,
     silent: bool = False,
     api_only: bool = False,
-    llama_parallel_slots: int = 1,
+    llama_parallel_slots: int = _PARALLEL_DEFAULT_PLAIN,
     cloudflare: "Optional[bool]" = None,
     secure: bool = False,
     enable_tools: "Optional[bool]" = None,
@@ -1399,7 +1407,8 @@ def run_server(
         frontend_path: Path to frontend build directory (optional)
         silent: Suppress startup messages
         api_only: API server only, no frontend (for Tauri desktop app)
-        llama_parallel_slots: parallel slots for llama-server
+        llama_parallel_slots: parallel slots for llama-server (default
+            _PARALLEL_DEFAULT_PLAIN, matching the CLI entry points)
         cloudflare: opt in to the public Cloudflare HTTPS tunnel for a wildcard
             bind. Tri-state: None (unset) and False both mean off; True enables it.
             --secure implies it (True) and rejects an explicit False.
@@ -1817,15 +1826,6 @@ def run_server(
     return app
 
 
-# Mirror unsloth_cli/commands/studio.py's _PARALLEL_* and the shared
-# core/inference/llama_server_args.py PARALLEL_* (the per-load
-# LoadRequest.n_parallel bounds). Default 1 is for direct backend launches;
-# `unsloth studio run` always passes its own value (4).
-_PARALLEL_MIN = 1
-_PARALLEL_MAX = 64
-_PARALLEL_DEFAULT_PLAIN = 1
-
-
 def _build_arg_parser():
     """Build the backend CLI argument parser.
 
@@ -1920,8 +1920,8 @@ def _build_arg_parser():
         default = _PARALLEL_DEFAULT_PLAIN,
         help = (
             f"llama-server parallel decode slots ({_PARALLEL_MIN}..{_PARALLEL_MAX}). "
-            f"Default {_PARALLEL_DEFAULT_PLAIN}; `unsloth studio run` uses 4. "
-            "The Studio run settings (Parallel Slots) can override it per load."
+            f"Default {_PARALLEL_DEFAULT_PLAIN}. The Studio run settings "
+            "(Parallel Slots) override it per load."
         ),
     )
     return parser
diff --git a/studio/backend/state/active_generations.py b/studio/backend/state/active_generations.py
new file mode 100644
index 0000000000..d1f2812c59
--- /dev/null
+++ b/studio/backend/state/active_generations.py
@@ -0,0 +1,146 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Registry of in-flight chat generations, keyed by conversation.
+
+New Chat leaves the previous conversation streaming, so /load and /unload need
+to know which chats a reload would interrupt: they refuse with 409 unless the
+caller opts in to cancelling them, and GET /inference/active-generations lets
+the UI name them. A frontend guard alone would miss a second tab or a REST call.
+
+Entries hold the same threading.Event as the per-run cancel registry in
+routes/inference.py, so cancel_all() closes each generation's own upstream
+stream and never signals llama-server itself.
+
+A plain dict plus a threading.Lock: no signals, no process groups, no event loop
+affinity, so it behaves identically on Linux, macOS, Windows and WSL.
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+import uuid
+from typing import Any, Optional
+
+# handle id -> entry. Keyed by handle, not thread_id: a tool continuation can register
+# before the previous leg unregisters, and one key would drop the other.
+_ACTIVE: dict[str, dict[str, Any]] = {}
+_LOCK = threading.Lock()
+
+
+class ActiveGeneration:
+    """Registers one in-flight generation for the duration of the block.
+
+    Each __enter__ mints its own handle, so overlapping uses never clobber.
+    """
+
+    __slots__ = ("thread_id", "cancel_event", "model", "kind", "_handle")
+
+    def __init__(
+        self,
+        cancel_event: threading.Event,
+        *,
+        thread_id: Optional[str] = None,
+        model: Optional[str] = None,
+        kind: str = "chat",
+    ):
+        self.thread_id = thread_id or None
+        self.cancel_event = cancel_event
+        self.model = model or None
+        self.kind = kind
+        self._handle: Optional[str] = None
+
+    def __enter__(self) -> "ActiveGeneration":
+        self._handle = uuid.uuid4().hex
+        with _LOCK:
+            _ACTIVE[self._handle] = {
+                "handle": self._handle,
+                "thread_id": self.thread_id,
+                "model": self.model,
+                "kind": self.kind,
+                "started_at": time.time(),
+                "event": self.cancel_event,
+            }
+        return self
+
+    def __exit__(self, *exc) -> bool:
+        handle, self._handle = self._handle, None
+        if handle is not None:
+            with _LOCK:
+                _ACTIVE.pop(handle, None)
+        return False
+
+
+def snapshot() -> list[dict[str, Any]]:
+    """In-flight generations, newest last. Drops the Event: this is a response."""
+    with _LOCK:
+        entries = list(_ACTIVE.values())
+    entries.sort(key = lambda e: e["started_at"])
+    return [
+        {
+            "handle": e["handle"],
+            "thread_id": e["thread_id"],
+            "model": e["model"],
+            "kind": e["kind"],
+            "started_at": e["started_at"],
+        }
+        for e in entries
+    ]
+
+
+def active_thread_ids() -> list[str]:
+    """Distinct conversation ids with a generation in flight, in start order.
+
+    A first turn that races persistence has no thread id yet: count() sees it,
+    this cannot name it.
+    """
+    seen: list[str] = []
+    for e in snapshot():
+        tid = e["thread_id"]
+        if tid and tid not in seen:
+            seen.append(tid)
+    return seen
+
+
+def count() -> int:
+    """Number of generations currently in flight."""
+    with _LOCK:
+        return len(_ACTIVE)
+
+
+def cancel_all() -> int:
+    """Signal every in-flight generation to stop. Returns how many were signalled.
+
+    Only sets the cancel events; each stream tears itself down. Entries are
+    removed by their own __exit__, so one mid-cleanup is neither lost nor double
+    counted.
+    """
+    with _LOCK:
+        events = [e["event"] for e in _ACTIVE.values()]
+    for ev in events:
+        try:
+            ev.set()
+        except Exception:
+            pass
+    return len(events)
+
+
+def cancel_thread(thread_id: str) -> int:
+    """Signal only the generations belonging to ``thread_id``."""
+    if not thread_id:
+        return 0
+    with _LOCK:
+        events = [e["event"] for e in _ACTIVE.values() if e["thread_id"] == thread_id]
+    for ev in events:
+        try:
+            ev.set()
+        except Exception:
+            pass
+    return len(events)
+
+
+def reset_for_tests() -> None:
+    """Drop every entry. Test-only; never called from request paths."""
+    with _LOCK:
+        _ACTIVE.clear()
diff --git a/studio/backend/tests/conftest.py b/studio/backend/tests/conftest.py
index c2216104a3..89f612393c 100644
--- a/studio/backend/tests/conftest.py
+++ b/studio/backend/tests/conftest.py
@@ -58,6 +58,26 @@ def pytest_addoption(parser):
 # E2E server fixtures
 
 
+@pytest.fixture(autouse = True)
+def _no_background_model_scan(monkeypatch):
+    """Keep the /v1 admission hook from scanning the real HF cache during tests.
+
+    The hook warms the local-model index on a background thread: right in a server,
+    wrong here, since it walks the developer's actual caches and the I/O starves the
+    loop under timing-sensitive streaming tests. Warm tests patch it back.
+    """
+    import time
+
+    from core.inference import local_model_resolver
+
+    monkeypatch.setattr(local_model_resolver, "warm_index_soon", lambda: None)
+    # Start from a built, empty index: stubbing only the warm left the cold path
+    # walking those caches inside the admission wait, so on a large install the
+    # assertion became a 503 "still indexing". Cold-path tests reset _scan themselves;
+    # _build_index is untouched so tests calling it directly still walk for real.
+    monkeypatch.setattr(local_model_resolver, "_scan", (time.monotonic(), {}))
+
+
 @pytest.fixture(scope = "session")
 def studio_server(request):
     """Yield ``(base_url, api_key)`` for e2e tests.
diff --git a/studio/backend/tests/test_active_generations.py b/studio/backend/tests/test_active_generations.py
new file mode 100644
index 0000000000..aa087fe4ea
--- /dev/null
+++ b/studio/backend/tests/test_active_generations.py
@@ -0,0 +1,2635 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Parallel chats: the active-generation registry and the model-swap gate.
+
+A load/unload has to know which streaming chats it would interrupt. Everything
+under test is a dict + threading.Lock, so this passes on every platform.
+"""
+
+import os
+import sys
+import threading
+
+import pytest
+
+_backend = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, _backend)
+
+from state import active_generations
+
+
+@pytest.fixture(autouse = True)
+def _clean_registry():
+    active_generations.reset_for_tests()
+    yield
+    active_generations.reset_for_tests()
+
+
+# ── registry ──────────────────────────────────────────────────────────
+
+
+def test_registry_starts_empty():
+    assert active_generations.count() == 0
+    assert active_generations.snapshot() == []
+    assert active_generations.active_thread_ids() == []
+
+
+def test_entry_lives_only_for_the_block():
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1", model = "m"):
+        assert active_generations.count() == 1
+        assert active_generations.active_thread_ids() == ["t1"]
+    assert active_generations.count() == 0
+    assert active_generations.active_thread_ids() == []
+
+
+def test_entry_is_removed_even_when_the_block_raises():
+    ev = threading.Event()
+    with pytest.raises(RuntimeError):
+        with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+            raise RuntimeError("stream blew up")
+    assert active_generations.count() == 0
+
+
+def test_overlapping_runs_on_one_thread_both_register():
+    # A tool continuation registers its next leg before the previous unwinds.
+    a, b = threading.Event(), threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "t1"):
+        with active_generations.ActiveGeneration(b, thread_id = "t1"):
+            assert active_generations.count() == 2
+            assert active_generations.active_thread_ids() == ["t1"]
+        assert active_generations.count() == 1
+    assert active_generations.count() == 0
+
+
+def test_snapshot_is_json_safe_and_ordered_by_start():
+    a, b = threading.Event(), threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "first", model = "m1"):
+        with active_generations.ActiveGeneration(b, thread_id = "second", model = "m2"):
+            snap = active_generations.snapshot()
+    assert [e["thread_id"] for e in snap] == ["first", "second"]
+    # The threading.Event must not leak into an HTTP response body.
+    assert all("event" not in e for e in snap)
+    assert {"handle", "thread_id", "model", "kind", "started_at"} == set(snap[0])
+
+
+def test_thread_ids_are_deduped_and_skip_unnamed_runs():
+    a, b, c = threading.Event(), threading.Event(), threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "t1"):
+        with active_generations.ActiveGeneration(b, thread_id = "t1"):
+            # A brand-new chat whose first turn races persistence has no id yet.
+            with active_generations.ActiveGeneration(c, thread_id = None):
+                assert active_generations.active_thread_ids() == ["t1"]
+                assert active_generations.count() == 3
+
+
+# ── cancellation ──────────────────────────────────────────────────────
+
+
+def test_cancel_all_sets_every_event():
+    a, b = threading.Event(), threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "t1"):
+        with active_generations.ActiveGeneration(b, thread_id = "t2"):
+            assert active_generations.cancel_all() == 2
+            assert a.is_set() and b.is_set()
+
+
+def test_cancel_all_on_an_empty_registry_is_a_no_op():
+    assert active_generations.cancel_all() == 0
+
+
+def test_cancel_thread_leaves_siblings_alone():
+    # Per-thread Stop: the rest keep generating, llama-server is untouched.
+    a, b = threading.Event(), threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "t1"):
+        with active_generations.ActiveGeneration(b, thread_id = "t2"):
+            assert active_generations.cancel_thread("t1") == 1
+            assert a.is_set()
+            assert not b.is_set()
+
+
+def test_cancel_thread_with_no_match_is_a_no_op():
+    a = threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "t1"):
+        assert active_generations.cancel_thread("nope") == 0
+        assert active_generations.cancel_thread("") == 0
+        assert not a.is_set()
+
+
+def test_cancel_does_not_unregister_entries():
+    # __exit__ owns removal, so a generation mid-cleanup is not lost.
+    a = threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "t1"):
+        active_generations.cancel_all()
+        assert active_generations.count() == 1
+
+
+# ── concurrency ───────────────────────────────────────────────────────
+
+
+def test_registry_survives_concurrent_register_unregister():
+    errors: list[BaseException] = []
+    barrier = threading.Barrier(8)
+
+    def worker(i: int) -> None:
+        try:
+            barrier.wait(timeout = 10)
+            for _ in range(50):
+                with active_generations.ActiveGeneration(threading.Event(), thread_id = f"t{i}"):
+                    active_generations.snapshot()
+        except BaseException as exc:  # noqa: BLE001 - surfaced via assert below
+            errors.append(exc)
+
+    threads = [threading.Thread(target = worker, args = (i,)) for i in range(8)]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join(timeout = 30)
+
+    assert errors == []
+    assert active_generations.count() == 0
+
+
+# ── the model-swap gate ───────────────────────────────────────────────
+
+
+# The gate lives in routes.inference, which pulls the whole inference stack.
+def _route_gate():
+    pytest.importorskip("fastapi", reason = "inference stack not installed")
+    routes_inference = pytest.importorskip(
+        "routes.inference", reason = "inference stack not installed"
+    )
+    return routes_inference._raise_or_cancel_active_generations
+
+
+@pytest.fixture
+def gate():
+    return _route_gate()
+
+
+def test_gate_allows_a_swap_when_nothing_is_generating(gate):
+    assert gate(force = False, action = "Loading a model") == 0
+
+
+def test_gate_refuses_with_409_and_names_the_chats(gate):
+    from fastapi import HTTPException
+
+    a, b = threading.Event(), threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "t1"):
+        with active_generations.ActiveGeneration(b, thread_id = "t2"):
+            with pytest.raises(HTTPException) as exc:
+                gate(force = False, action = "Loading a model")
+    assert exc.value.status_code == 409
+    detail = exc.value.detail
+    assert detail["error"] == "active_generations"
+    assert detail["running"] == 2
+    assert detail["thread_ids"] == ["t1", "t2"]
+    # Refusing must not cancel anything.
+    assert not a.is_set() and not b.is_set()
+
+
+def test_gate_message_is_singular_for_one_chat(gate):
+    from fastapi import HTTPException
+
+    with active_generations.ActiveGeneration(threading.Event(), thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            gate(force = False, action = "Unloading the model")
+    message = exc.value.detail["message"]
+    assert "1 chat that is still generating" in message
+    assert "Unloading the model" in message
+
+
+def test_gate_force_cancels_and_returns_the_count(gate):
+    a, b = threading.Event(), threading.Event()
+    with active_generations.ActiveGeneration(a, thread_id = "t1"):
+        with active_generations.ActiveGeneration(b, thread_id = "t2"):
+            assert gate(force = True, action = "Loading a model") == 2
+            assert a.is_set() and b.is_set()
+
+
+def test_gate_force_with_nothing_running_is_a_no_op(gate):
+    assert gate(force = True, action = "Loading a model") == 0
+
+
+# ── the route wiring ──────────────────────────────────────────────────
+
+
+def test_tracked_cancel_registers_the_thread_for_its_block():
+    # The single place a generation is recorded, so every streaming path gets it.
+    _route_gate()
+    from routes.inference import _TrackedCancel
+
+    ev = threading.Event()
+    tracker = _TrackedCancel(ev, "cancel-1", thread_id = "t1", model = "m")
+    tracker.__enter__()
+    try:
+        assert active_generations.active_thread_ids() == ["t1"]
+        assert active_generations.snapshot()[0]["model"] == "m"
+    finally:
+        tracker.__exit__(None, None, None)
+    assert active_generations.count() == 0
+
+
+def test_tracked_cancel_shares_its_event_with_the_registry():
+    # Reusing the per-run event is what keeps a forced reload off llama-server.
+    _route_gate()
+    from routes.inference import _TrackedCancel
+
+    ev = threading.Event()
+    tracker = _TrackedCancel(ev, "cancel-1", thread_id = "t1")
+    tracker.__enter__()
+    try:
+        active_generations.cancel_all()
+        assert ev.is_set()
+    finally:
+        tracker.__exit__(None, None, None)
+
+
+def _stub_load_route(monkeypatch, *, active_model_name):
+    """Point POST /load at an in-memory safetensors backend.
+
+    active_model_name == the requested path makes the request idempotent, so
+    _load_model_impl takes its already_loaded fast return.
+    """
+    from types import SimpleNamespace
+
+    import routes.inference as inf_mod
+
+    monkeypatch.setattr(inf_mod, "_raise_if_sidecar_swap_in_progress", lambda: None)
+    monkeypatch.setattr(inf_mod, "validate_extra_args", lambda args: [])
+    monkeypatch.setattr(
+        inf_mod,
+        "resolve_effective_chat_template_override",
+        lambda model_identifier = None, user_override = None: None,
+    )
+    monkeypatch.setattr(inf_mod, "load_inference_config", lambda name: {})
+    monkeypatch.setattr(
+        inf_mod,
+        "_detect_safetensors_features",
+        lambda backend, template, tools = None: {
+            "supports_reasoning": False,
+            "reasoning_style": "enable_thinking",
+            "reasoning_effort_levels": [],
+            "reasoning_always_on": False,
+            "supports_preserve_thinking": False,
+            "supports_tools": False,
+        },
+    )
+    monkeypatch.setattr(inf_mod, "_resolve_loaded_trust_remote_code", lambda *a, **k: False)
+    monkeypatch.setattr(
+        inf_mod,
+        "get_inference_backend",
+        lambda: SimpleNamespace(active_model_name = active_model_name, models = {}),
+    )
+    monkeypatch.setattr(
+        inf_mod,
+        "get_llama_cpp_backend",
+        lambda: SimpleNamespace(is_loaded = False, hf_variant = None, model_identifier = None),
+    )
+    return inf_mod
+
+
+def test_idempotent_load_neither_refuses_nor_cancels_running_chats(monkeypatch):
+    # Re-applying the resident model hits already_loaded: no llama-server touch, no 409, no stopped chats.
+    _route_gate()
+    import asyncio
+
+    from models.inference import LoadRequest
+
+    inf_mod = _stub_load_route(monkeypatch, active_model_name = "org/A")
+
+    for force in (False, True):
+        ev = threading.Event()
+        with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+            response = asyncio.run(
+                inf_mod.load_model(
+                    LoadRequest(model_path = "org/A", force_cancel_active = force),
+                    object(),
+                    "tester",
+                )
+            )
+        assert response.status == "already_loaded"
+        assert not ev.is_set()
+
+
+def test_a_real_reload_still_refuses_while_chats_stream(monkeypatch):
+    # A load that would really replace the model still 409s and names the chats.
+    _route_gate()
+    import asyncio
+
+    from fastapi import HTTPException
+
+    from models.inference import LoadRequest
+
+    inf_mod = _stub_load_route(monkeypatch, active_model_name = "org/OTHER")
+
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            asyncio.run(inf_mod.load_model(LoadRequest(model_path = "org/A"), object(), "tester"))
+    assert exc.value.status_code == 409
+    assert exc.value.detail["thread_ids"] == ["t1"]
+    assert not ev.is_set()
+
+
+def test_a_forced_load_that_fails_preflight_leaves_the_chats_alone(monkeypatch):
+    # Preflight can still reject after the user confirms, so cancelling first ends chats for nothing.
+    _route_gate()
+    import asyncio
+    import contextlib
+
+    from fastapi import HTTPException
+
+    from models.inference import LoadRequest
+
+    inf_mod = _stub_load_route(monkeypatch, active_model_name = "org/OTHER")
+    monkeypatch.setattr(inf_mod, "_hf_offline_if_dns_dead", contextlib.nullcontext)
+    # Stands in for any preflight refusal; a None here is the route's own 400.
+    monkeypatch.setattr(inf_mod.ModelConfig, "from_identifier", staticmethod(lambda **kwargs: None))
+
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            asyncio.run(
+                inf_mod.load_model(
+                    LoadRequest(model_path = "org/A", force_cancel_active = True),
+                    object(),
+                    "tester",
+                )
+            )
+        # The load was rejected, so the chat must still be streaming.
+        assert not ev.is_set()
+        assert active_generations.count() == 1
+    assert exc.value.status_code == 400
+
+
+def _stub_standard_load_route(monkeypatch):
+    """Drive _load_model_impl down the Unsloth path as far as the pre-teardown drain."""
+    import contextlib
+    from types import SimpleNamespace
+
+    import routes.inference as inf_mod
+
+    real_sidecar_check = inf_mod._raise_if_sidecar_swap_in_progress
+    _stub_load_route(monkeypatch, active_model_name = "org/OTHER")
+    # _stub_load_route neutralises the sidecar guard; this test is about it.
+    monkeypatch.setattr(inf_mod, "_raise_if_sidecar_swap_in_progress", real_sidecar_check)
+    monkeypatch.setattr(inf_mod, "_hf_offline_if_dns_dead", contextlib.nullcontext)
+    monkeypatch.setattr(inf_mod, "_mlx_distributed_launch_detected", lambda: False)
+    monkeypatch.setattr(
+        inf_mod.ModelConfig,
+        "from_identifier",
+        staticmethod(
+            lambda **kwargs: SimpleNamespace(
+                is_gguf = False,
+                identifier = "org/A",
+                display_name = "A",
+                is_vision = False,
+                gguf_hf_repo = None,
+                gguf_variant = None,
+            )
+        ),
+    )
+    monkeypatch.setattr(inf_mod, "_effective_load_in_4bit", lambda config, requested: False)
+    monkeypatch.setattr(inf_mod, "_resolve_inherited_extra_args", lambda *a, **k: None)
+    monkeypatch.setattr(inf_mod, "_guard_chat_load_against_training", lambda *a, **k: None)
+    return inf_mod
+
+
+def test_a_sidecar_swap_reserved_during_the_drain_never_strands_cancelled_chats(monkeypatch):
+    # A sidecar install can reserve the swap window during the pre-teardown drain, so the recheck
+    # after it is the last rejection point and must precede the cancel, else chats die for nothing.
+    _route_gate()
+    import asyncio
+    import time
+    from types import SimpleNamespace
+
+    from fastapi import HTTPException
+
+    from core.inference import llama_keepwarm as kw
+    from models.inference import LoadRequest
+
+    import utils.transformers_version as tv
+
+    inf_mod = _stub_standard_load_route(monkeypatch)
+    reserved = {"v": False}
+    monkeypatch.setattr(tv, "sidecar_swap_in_progress", lambda: reserved["v"])
+
+    # Two tracked requests; the install reserves the window mid-drain when the uncancellable one ends.
+    monkeypatch.setattr(kw, "_inflight", 2)
+
+    def _installer():
+        time.sleep(0.10)
+        kw._inflight = 1  # the non-cancellable request finished ...
+        reserved["v"] = True  # ... and an install reserved the swap window
+        time.sleep(0.35)
+        kw._inflight = 0  # the chat's own request drains last
+
+    thread = threading.Thread(target = _installer, daemon = True)
+    ev = threading.Event()
+    try:
+        with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+            thread.start()
+            with pytest.raises(HTTPException) as exc:
+                asyncio.run(
+                    inf_mod.load_model(
+                        LoadRequest(model_path = "org/A", force_cancel_active = True),
+                        SimpleNamespace(
+                            app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+                        ),
+                        "tester",
+                    )
+                )
+            # Rejected, so the chat traded for a model it never got must still stream.
+            assert not ev.is_set()
+            assert active_generations.count() == 1
+        assert exc.value.status_code == 409
+        assert "transformers installation" in str(exc.value.detail)
+    finally:
+        thread.join(timeout = 5)
+        kw._inflight = 0
+
+
+def _stub_unload_backends(monkeypatch, *, llama, backend):
+    """Point the /unload route at in-memory backends."""
+    import routes.inference as inf_mod
+    from core.inference import llama_keepwarm as kw
+
+    monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: llama)
+    monkeypatch.setattr(inf_mod, "get_inference_backend", lambda: backend)
+    monkeypatch.setattr(inf_mod, "is_registered_native_path_label", lambda *a: False)
+    monkeypatch.setattr(kw, "note_model_unloaded", lambda: None)
+    return inf_mod, kw
+
+
+def test_unload_rechecks_active_generations_under_the_lifecycle_gate(monkeypatch):
+    # Without the recheck, a chat that starts while this queues on the gate is torn down mid-stream.
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    from fastapi import HTTPException
+
+    from models.inference import UnloadRequest
+
+    torn_down: list[str] = []
+    inf_mod, kw = _stub_unload_backends(
+        monkeypatch,
+        llama = SimpleNamespace(
+            is_active = True,
+            is_loaded = True,
+            model_identifier = "org/A-GGUF",
+            unload_model = lambda: torn_down.append("gguf"),
+        ),
+        backend = SimpleNamespace(
+            get_loading_model = lambda: None,
+            unload_model = lambda path: torn_down.append("unsloth"),
+        ),
+    )
+
+    ev = threading.Event()
+    started = active_generations.ActiveGeneration(ev, thread_id = "t1")
+
+    async def drive():
+        # A load holds the lifecycle gate, so the unload queues behind it.
+        kw._lifecycle_lock.acquire()
+        task = asyncio.create_task(
+            inf_mod.unload_model(UnloadRequest(model_path = "org/A-GGUF"), "tester")
+        )
+        entered = False
+        try:
+            await asyncio.sleep(0.1)  # the route is polling the gate
+            started.__enter__()  # a chat starts in the meantime
+            entered = True
+        finally:
+            kw._lifecycle_lock.release()
+        try:
+            return await asyncio.wait_for(task, timeout = 5)
+        finally:
+            if entered:
+                started.__exit__(None, None, None)
+
+    with pytest.raises(HTTPException) as exc:
+        asyncio.run(drive())
+
+    # 409, not the catch-all 500 the route wraps unexpected failures in.
+    assert exc.value.status_code == 409
+    assert exc.value.detail["error"] == "active_generations"
+    assert torn_down == []
+    assert not ev.is_set()
+
+
+def _run_unload(
+    inf_mod,
+    monkeypatch,
+    *,
+    loaded_gguf,
+    requested,
+    force,
+    torn_down,
+    unload_model = None,
+):
+    """Drive POST /unload against a backend pair with ``loaded_gguf`` resident.
+
+    ``unload_model`` overrides the GGUF teardown so a caller can observe what the
+    world looked like at the moment of teardown, not just afterwards.
+    """
+    import asyncio
+    from types import SimpleNamespace
+
+    from models.inference import UnloadRequest
+
+    _stub_unload_backends(
+        monkeypatch,
+        llama = SimpleNamespace(
+            is_active = True,
+            is_loaded = True,
+            model_identifier = loaded_gguf,
+            unload_model = unload_model or (lambda: torn_down.append("gguf")),
+        ),
+        # Nothing on the standard backend: the GGUF above is what is resident.
+        backend = SimpleNamespace(
+            get_loading_model = lambda: None,
+            active_model_name = None,
+            models = {},
+            unload_model = lambda path: torn_down.append("unsloth"),
+        ),
+    )
+    return asyncio.run(
+        inf_mod.unload_model(
+            UnloadRequest(model_path = requested, force_cancel_active = force), "tester"
+        )
+    )
+
+
+def test_forced_unload_of_a_stale_model_path_leaves_the_chats_alone(monkeypatch):
+    # Eject naming a model another tab swapped out: a no-op success; cancelling first loses runs.
+    _route_gate()
+    import routes.inference as inf_mod
+
+    torn_down: list[str] = []
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        response = _run_unload(
+            inf_mod,
+            monkeypatch,
+            loaded_gguf = "org/B-GGUF",  # what the other tab actually loaded
+            requested = "org/A-GGUF",  # this tab's stale idea of it
+            force = True,
+            torn_down = torn_down,
+        )
+        assert not ev.is_set()
+        assert active_generations.count() == 1
+    # The resident GGUF was never touched, so nothing was worth cancelling.
+    assert "gguf" not in torn_down
+    assert response.status == "unloaded"
+
+
+def test_forced_unload_of_the_loaded_model_still_stops_its_chats(monkeypatch):
+    # A real unload must still cancel, or llama-server goes down mid-stream.
+    _route_gate()
+    import routes.inference as inf_mod
+
+    torn_down: list[str] = []
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        response = _run_unload(
+            inf_mod,
+            monkeypatch,
+            loaded_gguf = "org/A-GGUF",
+            requested = "org/A-GGUF",
+            force = True,
+            torn_down = torn_down,
+        )
+        assert ev.is_set()
+    assert torn_down == ["gguf"]
+    assert response.status == "unloaded"
+
+
+def test_forced_unload_lets_the_cancelled_chats_unwind_before_teardown(monkeypatch):
+    # /unload used to tear down right after the cancel, so a stream told to stop but not yet
+    # finished lost its server. Assert the count hits zero BEFORE unload_model runs.
+    _route_gate()
+    import core.inference.llama_keepwarm as keepwarm
+    import routes.inference as inf_mod
+
+    inflight = {"n": 1}
+    seen = {}
+
+    def _count(current_request_counted = True, *, include_pending = True):
+        # Unwinds one poll after the cancel, like a stream noticing its event.
+        if inflight["n"] > 0:
+            inflight["n"] -= 1
+        return inflight["n"]
+
+    monkeypatch.setattr(keepwarm, "other_inference_request_count", _count)
+    monkeypatch.setattr(inf_mod, "_switch_waiter_count", lambda: 0)
+
+    torn_down: list[str] = []
+    ev = threading.Event()
+
+    def _record_teardown():
+        seen["inflight_at_teardown"] = inflight["n"]
+        torn_down.append("gguf")
+
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        response = _run_unload(
+            inf_mod,
+            monkeypatch,
+            loaded_gguf = "org/A-GGUF",
+            requested = "org/A-GGUF",
+            force = True,
+            torn_down = torn_down,
+            unload_model = _record_teardown,
+        )
+        assert ev.is_set()
+
+    assert torn_down == ["gguf"]
+    assert seen["inflight_at_teardown"] == 0
+    assert response.status == "unloaded"
+
+
+def test_unload_drains_on_the_middleware_count_not_just_the_registry(monkeypatch):
+    # A request past the middleware but not yet at its _TrackedCancel is counted but unregistered, so
+    # the drain reads the middleware count, not "did we cancel anything": one poll on a quiet server.
+    _route_gate()
+    import core.inference.llama_keepwarm as keepwarm
+    import routes.inference as inf_mod
+
+    polls = {"n": 0}
+
+    def _count(current_request_counted = True, *, include_pending = True):
+        polls["n"] += 1
+        return 0
+
+    monkeypatch.setattr(keepwarm, "other_inference_request_count", _count)
+
+    torn_down: list[str] = []
+    response = _run_unload(
+        inf_mod,
+        monkeypatch,
+        loaded_gguf = "org/A-GGUF",
+        requested = "org/A-GGUF",
+        force = True,
+        torn_down = torn_down,
+    )
+    assert torn_down == ["gguf"]
+    # Polled, but returned on the first read rather than waiting anything out.
+    assert polls["n"] == 1
+    assert response.status == "unloaded"
+
+
+def test_unforced_unload_of_a_stale_model_path_is_still_a_no_op(monkeypatch):
+    # Same stale Eject unforced: it reaches no teardown, so refusing strands the stale tab's selection.
+    _route_gate()
+    import routes.inference as inf_mod
+
+    torn_down: list[str] = []
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        response = _run_unload(
+            inf_mod,
+            monkeypatch,
+            loaded_gguf = "org/B-GGUF",  # what the other tab actually loaded
+            requested = "org/A-GGUF",  # this tab's stale idea of it
+            force = False,
+            torn_down = torn_down,
+        )
+        assert not ev.is_set()
+        assert active_generations.count() == 1
+    # The resident GGUF was untouched; only the standard backend's stale-path no-op ran.
+    assert torn_down == ["unsloth"]
+    assert response.status == "unloaded"
+
+
+def test_unforced_unload_of_the_loaded_model_still_refuses_while_chats_stream(monkeypatch):
+    # The stale skip above must not disarm the gate for a real replacement.
+    _route_gate()
+    import routes.inference as inf_mod
+
+    from fastapi import HTTPException
+
+    torn_down: list[str] = []
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            _run_unload(
+                inf_mod,
+                monkeypatch,
+                loaded_gguf = "org/A-GGUF",
+                requested = "org/A-GGUF",
+                force = False,
+                torn_down = torn_down,
+            )
+    assert exc.value.status_code == 409
+    assert exc.value.detail["thread_ids"] == ["t1"]
+    assert torn_down == []
+    assert not ev.is_set()
+
+
+def test_unforced_unload_still_refuses_while_a_gguf_load_is_in_flight(monkeypatch):
+    # A stale tab's Eject naming the PREVIOUS model while a different one loads. The GGUF branch
+    # evicts a live llama-server, so a chat on the previous model must get the 409, not be killed.
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    from fastapi import HTTPException
+
+    from models.inference import UnloadRequest
+
+    torn_down: list[str] = []
+    inf_mod, _kw = _stub_unload_backends(
+        monkeypatch,
+        llama = SimpleNamespace(
+            is_active = True,
+            is_loaded = False,  # spawned, health check not passed: mid-load
+            model_identifier = "org/B-GGUF",
+            unload_model = lambda: torn_down.append("gguf"),
+        ),
+        backend = SimpleNamespace(
+            get_loading_model = lambda: None,
+            active_model_name = None,
+            models = {},
+            unload_model = lambda path: torn_down.append("unsloth"),
+        ),
+    )
+
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            asyncio.run(
+                inf_mod.unload_model(
+                    UnloadRequest(model_path = "org/A-GGUF", force_cancel_active = False),
+                    "tester",
+                )
+            )
+    assert exc.value.status_code == 409
+    assert torn_down == []
+    assert not ev.is_set()
+
+
+def test_cancelling_an_in_flight_standard_load_is_not_refused_by_the_chat_gate(monkeypatch):
+    # The real cancelLoading shape: unforced /unload naming the still-LOADING model. It replaces
+    # nothing, so it cannot interrupt a chat and must not 409 (the frontend would drop the error).
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    from models.inference import UnloadRequest
+
+    cancelled: list[str] = []
+    torn_down: list[str] = []
+    inf_mod, _kw = _stub_unload_backends(
+        monkeypatch,
+        # Nothing on llama-server: the load in flight is a safetensors one.
+        llama = SimpleNamespace(
+            is_active = False,
+            is_loaded = False,
+            model_identifier = None,
+            unload_model = lambda: torn_down.append("gguf"),
+        ),
+        backend = SimpleNamespace(
+            get_loading_model = lambda: "org/B",
+            cancel_load = lambda path: bool(cancelled.append(path)) or True,
+            active_model_name = None,
+            models = {},
+            unload_model = lambda path: torn_down.append("unsloth"),
+        ),
+    )
+
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        response = asyncio.run(
+            inf_mod.unload_model(
+                UnloadRequest(model_path = "org/B", force_cancel_active = False), "tester"
+            )
+        )
+        # The chat on the previous model is untouched: the load never reached it.
+        assert not ev.is_set()
+        assert active_generations.count() == 1
+    assert response.status == "unloaded"
+    assert cancelled == ["org/B"]
+    assert torn_down == []
+
+
+def test_cancelling_an_in_flight_gguf_load_is_not_refused_by_the_chat_gate(monkeypatch):
+    # Same cancelLoading shape on the GGUF fast path: killing that child ends a load, not a chat.
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    from models.inference import UnloadRequest
+
+    torn_down: list[str] = []
+    inf_mod, _kw = _stub_unload_backends(
+        monkeypatch,
+        llama = SimpleNamespace(
+            is_active = True,
+            is_loaded = False,  # spawned, health check not passed: mid-load
+            model_identifier = "org/B-GGUF",
+            unload_model = lambda: torn_down.append("gguf"),
+        ),
+        backend = SimpleNamespace(
+            get_loading_model = lambda: None,
+            active_model_name = None,
+            models = {},
+            unload_model = lambda path: torn_down.append("unsloth"),
+        ),
+    )
+
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        response = asyncio.run(
+            inf_mod.unload_model(
+                UnloadRequest(model_path = "org/B-GGUF", force_cancel_active = False), "tester"
+            )
+        )
+        assert not ev.is_set()
+        assert active_generations.count() == 1
+    assert response.status == "unloaded"
+    assert torn_down == ["gguf"]
+
+
+def _install_responses_stream_mock(monkeypatch, chunks):
+    """Point the direct /v1/responses GGUF pass-through at an in-process
+    llama-server. Mirrors the harness in test_responses_tool_passthrough.py."""
+    import json
+    from types import SimpleNamespace
+
+    import httpx
+
+    import routes.inference as inf_mod
+
+    def handler(request):
+        content = "".join(f"data: {json.dumps(chunk)}\n\n" for chunk in chunks)
+        content += "data: [DONE]\n\n"
+        return httpx.Response(
+            200,
+            content = content.encode(),
+            headers = {"content-type": "text/event-stream"},
+        )
+
+    transport = httpx.MockTransport(handler)
+    real_async_client = httpx.AsyncClient
+    monkeypatch.setattr(
+        inf_mod.httpx,
+        "AsyncClient",
+        lambda *a, **kw: real_async_client(transport = transport, timeout = kw.get("timeout", 600)),
+    )
+    monkeypatch.setattr(
+        inf_mod,
+        "get_llama_cpp_backend",
+        lambda: SimpleNamespace(
+            is_loaded = True,
+            is_vision = False,
+            context_length = 4096,
+            base_url = "http://llama.test",
+            supports_reasoning = True,
+            reasoning_always_on = False,
+            _request_reasoning_kwargs = (
+                lambda enable_thinking = None, reasoning_effort = None, preserve_thinking = None: None
+            ),
+        ),
+    )
+    return inf_mod
+
+
+class _NeverDisconnectedRequest:
+    async def is_disconnected(self):
+        return False
+
+
+def test_direct_responses_stream_is_visible_to_the_swap_gate(monkeypatch):
+    # /v1/responses streams straight to llama-server; unregistered, a non-forced /unload tore it down.
+    _route_gate()
+    import asyncio
+
+    from models.inference import ChatMessage, ResponsesRequest
+
+    inf_mod = _install_responses_stream_mock(
+        monkeypatch, [{"choices": [{"delta": {"content": "33"}}]}]
+    )
+    payload = ResponsesRequest(input = "hi", stream = True, model = "org/M-GGUF")
+    messages = [ChatMessage(role = "user", content = "hi")]
+    seen = {}
+
+    async def run():
+        response = await inf_mod._responses_stream(payload, messages, _NeverDisconnectedRequest())
+        iterator = response.body_iterator
+        await iterator.__anext__()
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        async for _ in iterator:
+            pass
+
+    asyncio.run(run())
+
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M-GGUF"
+    # And it unregisters, or one Codex call would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+def test_forced_reload_stops_a_direct_responses_stream(monkeypatch):
+    # The registered event must be the one the stream watches, or a forced reload kills a live decode.
+    _route_gate()
+    import asyncio
+
+    from models.inference import ChatMessage, ResponsesRequest
+
+    inf_mod = _install_responses_stream_mock(
+        monkeypatch,
+        [
+            {"choices": [{"delta": {"content": "3"}}]},
+            {"choices": [{"delta": {"content": "3"}}]},
+        ],
+    )
+    payload = ResponsesRequest(input = "hi", stream = True, model = "org/M-GGUF")
+    messages = [ChatMessage(role = "user", content = "hi")]
+
+    async def run():
+        response = await inf_mod._responses_stream(payload, messages, _NeverDisconnectedRequest())
+        iterator = response.body_iterator
+        chunks = [await iterator.__anext__()]
+        assert active_generations.cancel_all() == 1
+        async for chunk in iterator:
+            chunks.append(chunk)
+        return "".join(c.decode() if isinstance(c, bytes) else c for c in chunks)
+
+    body = asyncio.run(run())
+
+    # Cancelled mid-stream: the run ends without a completed envelope.
+    assert "response.completed" not in body
+    assert active_generations.count() == 0
+
+
+def test_forced_reload_stops_a_responses_stream_still_queued_for_a_slot(monkeypatch):
+    # The run registers before it holds a decode slot, so cancel_all() must reach it while queued in
+    # admission; watching only the client socket lets it open a generation the swap already revoked.
+    _route_gate()
+    import asyncio
+
+    from core.inference import llama_admission
+    from models.inference import ChatMessage, ResponsesRequest
+
+    for name in (
+        llama_admission.ADMISSION_CONTROL_ENV,
+        llama_admission.ADMISSION_QUEUE_TIMEOUT_ENV,
+        llama_admission.ADMISSION_KEEPALIVE_INTERVAL_ENV,
+        llama_admission.ADMISSION_MAX_QUEUE_ENV,
+    ):
+        monkeypatch.delenv(name, raising = False)
+
+    inf_mod = _install_responses_stream_mock(
+        monkeypatch, [{"choices": [{"delta": {"content": "33"}}]}]
+    )
+    payload = ResponsesRequest(input = "hi", stream = True, model = "org/M-GGUF")
+    messages = [ChatMessage(role = "user", content = "hi")]
+
+    llama_admission.reset_llama_admission_queues()
+    try:
+
+        async def run():
+            # Hold the backend's only decode slot so the run below has to queue.
+            queue = llama_admission.get_llama_admission_queue("http://llama.test")
+            holder = queue.reserve(capacity = 1, config = llama_admission.LlamaAdmissionConfig())
+            assert holder.lease_nowait() is not None
+            response = await inf_mod._responses_stream(
+                payload, messages, _NeverDisconnectedRequest()
+            )
+            chunks = []
+
+            async def drain():
+                async for chunk in response.body_iterator:
+                    chunks.append(chunk)
+
+            task = asyncio.create_task(drain())
+            for _ in range(500):
+                if active_generations.count() == 1:
+                    break
+                await asyncio.sleep(0.01)
+            assert active_generations.count() == 1, "the queued run never registered"
+            assert active_generations.cancel_all() == 1
+            # Unbounded queue by default: without the tracked event this never returns while the slot is held.
+            await asyncio.wait_for(task, timeout = 5)
+            return chunks
+
+        chunks = asyncio.run(run())
+    finally:
+        llama_admission.reset_llama_admission_queues()
+
+    body = "".join(c.decode() if isinstance(c, bytes) else c for c in chunks)
+    # It gave up its place instead of taking the slot: no upstream call, no envelope.
+    assert "response.created" not in body
+    assert active_generations.count() == 0
+
+
+def _install_completions_stream_mock(monkeypatch, events):
+    """Point the /v1/completions proxy at an in-process llama-server."""
+    import json
+    from types import SimpleNamespace
+
+    import httpx
+
+    import routes.inference as inf_mod
+
+    def handler(request):
+        # One network chunk per SSE event: the relay polls its cancel flag between upstream chunks.
+        async def _chunks():
+            for event in events:
+                yield f"data: {json.dumps(event)}\n\n".encode()
+            yield b"data: [DONE]\n\n"
+
+        return httpx.Response(
+            200,
+            content = _chunks(),
+            headers = {"content-type": "text/event-stream"},
+        )
+
+    transport = httpx.MockTransport(handler)
+    real_async_client = httpx.AsyncClient
+    monkeypatch.setattr(
+        inf_mod.httpx,
+        "AsyncClient",
+        lambda *a, **kw: real_async_client(transport = transport, timeout = kw.get("timeout", 600)),
+    )
+    monkeypatch.setattr(
+        inf_mod,
+        "get_llama_cpp_backend",
+        lambda: SimpleNamespace(
+            is_loaded = True,
+            context_length = 4096,
+            base_url = "http://llama.test",
+            model_identifier = "org/M-GGUF",
+        ),
+    )
+    monkeypatch.setattr(inf_mod, "_automatic_model_load_may_run", lambda: False)
+
+    async def _no_auto_switch(request, current_subject):
+        return await request.json()
+
+    monkeypatch.setattr(inf_mod, "_auto_switch_from_request_body", _no_auto_switch)
+    return inf_mod
+
+
+class _CompletionsRequest(_NeverDisconnectedRequest):
+    """Minimal stand-in for the Starlette Request /v1/completions reads."""
+
+    def __init__(self, body):
+        from types import SimpleNamespace
+
+        self._body = body
+        self.method = "POST"
+        self.url = SimpleNamespace(path = "/v1/completions")
+
+    async def json(self):
+        return self._body
+
+
+def test_completions_proxy_stream_is_visible_to_the_swap_gate(monkeypatch):
+    # /v1/completions relays from llama-server with no idle drain; unregistered, /unload tore it down.
+    _route_gate()
+    import asyncio
+
+    inf_mod = _install_completions_stream_mock(monkeypatch, [{"choices": [{"text": "33"}]}])
+    request = _CompletionsRequest(
+        {"prompt": "hi", "stream": True, "model": "org/M-GGUF", "max_tokens": 8}
+    )
+    seen = {}
+
+    async def run():
+        response = await inf_mod.openai_completions(request, "tester")
+        iterator = response.body_iterator
+        await iterator.__anext__()
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        async for _ in iterator:
+            pass
+
+    asyncio.run(run())
+
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M-GGUF"
+    # And it unregisters, or one completion would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+def test_forced_reload_stops_a_completions_proxy_stream(monkeypatch):
+    # The registered event must be the one the relay watches, or a forced reload kills a live decode.
+    _route_gate()
+    import asyncio
+
+    inf_mod = _install_completions_stream_mock(
+        monkeypatch,
+        [{"choices": [{"text": "3"}]}, {"choices": [{"text": "3"}]}],
+    )
+    request = _CompletionsRequest(
+        {"prompt": "hi", "stream": True, "model": "org/M-GGUF", "max_tokens": 8}
+    )
+
+    async def run():
+        response = await inf_mod.openai_completions(request, "tester")
+        iterator = response.body_iterator
+        chunks = [await iterator.__anext__()]
+        assert active_generations.cancel_all() == 1
+        async for chunk in iterator:
+            chunks.append(chunk)
+        return b"".join(c if isinstance(c, bytes) else c.encode() for c in chunks)
+
+    body = asyncio.run(run())
+
+    # Stopped after the first event instead of relaying the rest.
+    assert body.count(b'"text"') == 1
+    assert active_generations.count() == 0
+
+
+def test_completions_proxy_non_stream_is_visible_to_the_swap_gate(monkeypatch):
+    # ``stream`` defaults to false, so the non-streaming branch is the common shape and holds
+    # llama-server throughout: unregistered, /unload counts zero and force_cancel_active has no event.
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    import httpx
+
+    import routes.inference as inf_mod
+
+    seen = {}
+
+    def handler(request):
+        # Sampled mid-flight: exactly the window a concurrent /unload would tear down in.
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        # And the gate must reach this run, not just see it.
+        seen["cancelled"] = active_generations.cancel_all()
+        return httpx.Response(200, json = {"id": "cmpl-x", "choices": [{"text": "33"}]})
+
+    transport = httpx.MockTransport(handler)
+    real_async_client = httpx.AsyncClient
+    monkeypatch.setattr(
+        inf_mod.httpx,
+        "AsyncClient",
+        lambda *a, **kw: real_async_client(transport = transport, timeout = kw.get("timeout", 600)),
+    )
+    # The pooled client too, so a route that took no per-request one still reaches this transport.
+    monkeypatch.setattr(
+        inf_mod, "nonstreaming_client", lambda: real_async_client(transport = transport)
+    )
+    monkeypatch.setattr(
+        inf_mod,
+        "get_llama_cpp_backend",
+        lambda: SimpleNamespace(
+            is_loaded = True,
+            context_length = 4096,
+            base_url = "http://llama.test",
+            model_identifier = "org/M-GGUF",
+        ),
+    )
+    monkeypatch.setattr(inf_mod, "_automatic_model_load_may_run", lambda: False)
+
+    async def _no_auto_switch(request, current_subject):
+        return await request.json()
+
+    monkeypatch.setattr(inf_mod, "_auto_switch_from_request_body", _no_auto_switch)
+
+    request = _CompletionsRequest({"prompt": "hi", "model": "org/M-GGUF", "max_tokens": 8})
+
+    with pytest.raises(asyncio.CancelledError):
+        asyncio.run(inf_mod.openai_completions(request, "tester"))
+
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M-GGUF"
+    assert seen["cancelled"] == 1
+    # And it unregisters, or one completion would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+class _EmbeddingsRequest(_NeverDisconnectedRequest):
+    """Minimal stand-in for the Starlette Request /v1/embeddings reads."""
+
+    def __init__(self, body):
+        from types import SimpleNamespace
+
+        self._body = body
+        self.method = "POST"
+        self.url = SimpleNamespace(path = "/v1/embeddings")
+        self.state = SimpleNamespace(skip_api_monitor = True)
+
+    async def json(self):
+        return self._body
+
+
+def test_embeddings_proxy_is_visible_to_the_swap_gate(monkeypatch):
+    # /v1/embeddings holds llama-server for its whole HTTP call: unregistered, a non-forced /unload
+    # counts zero and kills the server mid-request (only /load waits on the middleware count).
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    import httpx
+
+    import routes.inference as inf_mod
+
+    seen = {}
+
+    def handler(request):
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        seen["cancelled"] = active_generations.cancel_all()
+        return httpx.Response(200, json = {"data": [{"embedding": [0.1, 0.2]}]})
+
+    transport = httpx.MockTransport(handler)
+    real_async_client = httpx.AsyncClient
+    monkeypatch.setattr(
+        inf_mod.httpx,
+        "AsyncClient",
+        lambda *a, **kw: real_async_client(transport = transport, timeout = kw.get("timeout", 600)),
+    )
+    monkeypatch.setattr(
+        inf_mod, "nonstreaming_client", lambda: real_async_client(transport = transport)
+    )
+    monkeypatch.setattr(
+        inf_mod,
+        "get_llama_cpp_backend",
+        lambda: SimpleNamespace(
+            is_loaded = True,
+            context_length = 4096,
+            base_url = "http://llama.test",
+            model_identifier = "org/M-GGUF",
+        ),
+    )
+    monkeypatch.setattr(inf_mod, "_automatic_model_load_may_run", lambda: False)
+
+    async def _no_auto_switch(request, current_subject):
+        return await request.json()
+
+    monkeypatch.setattr(inf_mod, "_auto_switch_from_request_body", _no_auto_switch)
+
+    request = _EmbeddingsRequest({"input": "hi", "model": "org/M-GGUF"})
+
+    with pytest.raises(asyncio.CancelledError):
+        asyncio.run(inf_mod.openai_embeddings(request, "tester"))
+
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M-GGUF"
+    assert seen["cancelled"] == 1
+    # And it unregisters, or one embedding would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+def test_active_generations_redacts_native_model_paths(monkeypatch):
+    # The legacy stream records active_model_name verbatim (an absolute path locally) and is the only
+    # place that serialises it: redact like the error paths so a remote client cannot learn host paths.
+    _route_gate()
+    import asyncio
+    import threading
+    from types import SimpleNamespace
+
+    import routes.inference as inf_mod
+    from utils.native_path_leases import _remember_native_path_for_redaction
+
+    secret_path = "/home/somebody/models/private-model.gguf"
+    _remember_native_path_for_redaction(secret_path, "private-model.gguf")
+
+    request = SimpleNamespace(app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 4)))
+    monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: SimpleNamespace())
+
+    with active_generations.ActiveGeneration(threading.Event(), thread_id = "t1", model = secret_path):
+        body = asyncio.run(inf_mod.get_active_generations(request, "tester"))
+
+    assert body["count"] == 1
+    assert secret_path not in str(body)
+    assert body["active"][0]["model"] == "<native_path>"
+
+
+def test_legacy_generate_stream_is_visible_to_the_swap_gate(monkeypatch):
+    # The legacy /generate/stream decodes on the standard backend throughout: unregistered it passed
+    # the advertised 409 gate then blocked on the generation lock, and a forced swap had no event.
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    import routes.inference as inf_mod
+    from models.inference import GenerateRequest
+
+    seen = {}
+
+    def _fake_generate_chat_response(**kwargs):
+        # Sampled mid-generation: exactly the window an /unload would land in.
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        seen["cancelled"] = active_generations.cancel_all()
+        yield "hello"
+        yield "world"
+
+    backend = SimpleNamespace(
+        active_model_name = "org/M",
+        models = {"org/M": {}},
+        generate_chat_response = lambda **kw: _fake_generate_chat_response(**kw),
+        reset_generation_state = lambda *a: None,
+        resize_image = lambda img: img,
+    )
+    monkeypatch.setattr(inf_mod, "get_inference_backend", lambda: backend)
+
+    async def _drain():
+        response = await inf_mod.generate_stream(
+            GenerateRequest(messages = [{"role": "user", "content": "hi"}]),
+            _NeverDisconnectedRequest(),
+            current_subject = "tester",
+        )
+        async for _ in response.body_iterator:
+            pass
+
+    asyncio.run(_drain())
+
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M"
+    assert seen["cancelled"] == 1
+    # And it unregisters, or one legacy stream would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+def _anthropic_stream_args(chunks):
+    """(request, cancel_event, run_gen) for the local Anthropic stream helpers."""
+    cancel_event = threading.Event()
+
+    def run_gen():
+        def _gen():
+            for chunk in chunks:
+                if cancel_event.is_set():
+                    return
+                yield chunk
+
+        return _gen()
+
+    return _NeverDisconnectedRequest(), cancel_event, run_gen
+
+
+def test_local_anthropic_plain_stream_is_visible_to_the_swap_gate(monkeypatch):
+    # Only the client-tool pass-through registered, so the no-tool /v1/messages path died mid-response.
+    _route_gate()
+    import asyncio
+
+    import routes.inference as inf_mod
+
+    request, cancel_event, run_gen = _anthropic_stream_args(["3", "33"])
+    seen = {}
+
+    async def run():
+        response = await inf_mod._anthropic_plain_stream(
+            request, cancel_event, run_gen, "msg_1", "org/M-GGUF"
+        )
+        iterator = response.body_iterator
+        await iterator.__anext__()
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        async for _ in iterator:
+            pass
+
+    asyncio.run(run())
+
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M-GGUF"
+    assert active_generations.count() == 0
+
+
+def test_forced_reload_stops_a_local_anthropic_plain_stream(monkeypatch):
+    # The event registered has to be the one the decode loop watches.
+    _route_gate()
+    import asyncio
+
+    import routes.inference as inf_mod
+
+    request, cancel_event, run_gen = _anthropic_stream_args(["3", "33", "333"])
+
+    async def run():
+        response = await inf_mod._anthropic_plain_stream(
+            request, cancel_event, run_gen, "msg_1", "org/M-GGUF"
+        )
+        iterator = response.body_iterator
+        chunks = [await iterator.__anext__()]
+        assert active_generations.cancel_all() == 1
+        async for chunk in iterator:
+            chunks.append(chunk)
+        return "".join(c.decode() if isinstance(c, bytes) else c for c in chunks)
+
+    body = asyncio.run(run())
+
+    assert cancel_event.is_set()
+    # Cancelled mid-stream: no clean message_stop envelope.
+    assert "message_stop" not in body
+    assert active_generations.count() == 0
+
+
+def test_local_anthropic_tool_stream_is_visible_to_the_swap_gate(monkeypatch):
+    # Same gap on the server-tool path (enable_tools / Anthropic server tools).
+    _route_gate()
+    import asyncio
+
+    import routes.inference as inf_mod
+
+    request, cancel_event, run_gen = _anthropic_stream_args(
+        [{"type": "content", "text": "3"}, {"type": "content", "text": "33"}]
+    )
+    seen = {}
+
+    async def run():
+        response = await inf_mod._anthropic_tool_stream(
+            request, cancel_event, run_gen, "msg_1", "org/M-GGUF"
+        )
+        iterator = response.body_iterator
+        await iterator.__anext__()
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        async for _ in iterator:
+            pass
+
+    asyncio.run(run())
+
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M-GGUF"
+    assert active_generations.count() == 0
+
+
+def test_load_and_unload_requests_default_to_not_cancelling():
+    pytest.importorskip("pydantic", reason = "pydantic not installed")
+    from models.inference import LoadRequest, UnloadRequest
+
+    assert LoadRequest(model_path = "m").force_cancel_active is False
+    assert UnloadRequest(model_path = "m").force_cancel_active is False
+    assert LoadRequest(model_path = "m", force_cancel_active = True).force_cancel_active is True
+
+
+def _parallel_constants(path: str) -> dict:
+    """Read the _PARALLEL_* constants from a file's source.
+
+    Importing run.py would drag in the whole server to read three integers.
+    """
+    import ast
+
+    with open(path, encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    found = {}
+    for node in tree.body:
+        if not isinstance(node, ast.Assign):
+            continue
+        for target in node.targets:
+            name = getattr(target, "id", "")
+            if name.startswith("_PARALLEL_") and isinstance(node.value, ast.Constant):
+                found[name] = node.value.value
+    return found
+
+
+def test_studio_defaults_to_more_than_one_decode_slot():
+    # With one slot the admission queue serialises every chat.
+    consts = _parallel_constants(os.path.join(_backend, "run.py"))
+
+    assert consts["_PARALLEL_DEFAULT_PLAIN"] > 1
+    assert consts["_PARALLEL_MIN"] <= consts["_PARALLEL_DEFAULT_PLAIN"] <= consts["_PARALLEL_MAX"]
+
+
+def test_cli_and_backend_parallel_defaults_agree():
+    # argparse and the typer CLI are separate entry points into the same server.
+    backend = _parallel_constants(os.path.join(_backend, "run.py"))
+    cli_path = os.path.join(
+        os.path.dirname(os.path.dirname(os.path.abspath(_backend))),
+        "unsloth_cli",
+        "commands",
+        "studio.py",
+    )
+    cli = _parallel_constants(cli_path)
+
+    assert cli["_PARALLEL_DEFAULT_PLAIN"] == backend["_PARALLEL_DEFAULT_PLAIN"]
+
+
+def _run_server_parallel_default(path: str, consts: dict):
+    """Resolve run_server()'s llama_parallel_slots default from run.py's source."""
+    import ast
+
+    with open(path, encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    for node in tree.body:
+        if not isinstance(node, ast.FunctionDef) or node.name != "run_server":
+            continue
+        args = node.args.args
+        defaults = node.args.defaults
+        # defaults align with the tail of the positional arg list.
+        for arg, default in zip(args[len(args) - len(defaults) :], defaults):
+            if arg.arg != "llama_parallel_slots":
+                continue
+            if isinstance(default, ast.Constant):
+                return default.value
+            if isinstance(default, ast.Name):
+                return consts.get(default.id)
+            return None
+    return None
+
+
+def test_run_server_default_matches_the_cli_parallel_default():
+    # colab.py omits llama_parallel_slots, so the signature default is what Colab runs with.
+    run_path = os.path.join(_backend, "run.py")
+    consts = _parallel_constants(run_path)
+
+    default = _run_server_parallel_default(run_path, consts)
+
+    assert default is not None, "run_server() must keep a llama_parallel_slots default"
+    assert default == consts["_PARALLEL_DEFAULT_PLAIN"]
+    assert default > 1
+
+
+def test_colab_launcher_inherits_the_parallel_default():
+    # Guard the inheritance itself: an explicit 1 here would resurrect the bug.
+    import ast
+
+    colab_path = os.path.join(_backend, "colab.py")
+    with open(colab_path, encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    consts = _parallel_constants(os.path.join(_backend, "run.py"))
+
+    calls = [
+        node
+        for node in ast.walk(tree)
+        if isinstance(node, ast.Call) and getattr(node.func, "id", "") == "run_server"
+    ]
+    assert calls, "colab.py must still launch the backend through run_server()"
+    for call in calls:
+        for kw in call.keywords:
+            if kw.arg != "llama_parallel_slots":
+                continue
+            value = kw.value.value if isinstance(kw.value, ast.Constant) else None
+            assert (
+                value is None or value > 1
+            ), "colab.py pins llama_parallel_slots to 1; Colab chats would serialise"
+    # Whether pinned or inherited, Colab must end up with more than one slot.
+    assert consts["_PARALLEL_DEFAULT_PLAIN"] > 1
+
+
+# ── the point of no return ────────────────────────────────────────────
+
+
+def test_a_forced_load_that_loses_to_a_sidecar_install_leaves_the_chats_alone(monkeypatch):
+    # The destructive cancel is the point of no return: nothing after it may reject the load. A sidecar
+    # install can reserve the window during preflight, so its recheck must run before, not after.
+    _route_gate()
+    import asyncio
+    import contextlib
+    from types import SimpleNamespace
+
+    from fastapi import HTTPException
+
+    from models.inference import LoadRequest
+
+    inf_mod = _stub_load_route(monkeypatch, active_model_name = "org/OTHER")
+    monkeypatch.setattr(inf_mod, "_hf_offline_if_dns_dead", contextlib.nullcontext)
+    monkeypatch.setattr(
+        inf_mod.ModelConfig,
+        "from_identifier",
+        staticmethod(
+            lambda **kwargs: SimpleNamespace(
+                is_gguf = False,
+                identifier = "org/A",
+                display_name = "A",
+                is_vision = False,
+                is_lora = False,
+                path = None,
+            )
+        ),
+    )
+    monkeypatch.setattr(inf_mod, "_mlx_distributed_launch_detected", lambda: False)
+    monkeypatch.setattr(inf_mod, "_guard_chat_load_against_training", lambda *a, **k: None)
+    monkeypatch.setattr(inf_mod, "_resolve_inherited_extra_args", lambda *a, **k: None)
+
+    # The two route-level checks pass, every check after them 409s.
+    seen = {"calls": 0}
+
+    def _sidecar_reserved_during_preflight():
+        seen["calls"] += 1
+        if seen["calls"] > 2:
+            raise HTTPException(
+                status_code = 409,
+                detail = "A transformers installation is in progress. Retry when it completes.",
+            )
+
+    monkeypatch.setattr(
+        inf_mod, "_raise_if_sidecar_swap_in_progress", _sidecar_reserved_during_preflight
+    )
+
+    fastapi_request = SimpleNamespace(
+        app = SimpleNamespace(state = SimpleNamespace(llama_parallel_slots = 1))
+    )
+
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            asyncio.run(
+                inf_mod.load_model(
+                    LoadRequest(
+                        model_path = "org/A",
+                        load_in_4bit = False,
+                        force_cancel_active = True,
+                    ),
+                    fastapi_request,
+                    "tester",
+                )
+            )
+        # The load was rejected, so the chat must still be streaming.
+        assert not ev.is_set()
+        assert active_generations.count() == 1
+    assert exc.value.status_code == 409
+
+
+def test_anthropic_passthrough_registers_nothing_until_its_body_starts():
+    # A pass-through response whose body never starts must leave both registries clean: a never-started
+    # async generator runs no body code (PEP 342), so an eagerly entered tracker never unregisters.
+    _route_gate()
+    import asyncio
+    import inspect
+    from types import SimpleNamespace
+
+    from starlette.requests import ClientDisconnect
+
+    import routes.inference as inf_mod
+
+    llama_backend = SimpleNamespace(
+        base_url = "http://127.0.0.1:8080",
+        context_length = 4096,
+        count_chat_tokens = lambda messages, _unused, tools: 7,
+    )
+
+    async def _build():
+        return await inf_mod._anthropic_passthrough_stream(
+            SimpleNamespace(),
+            threading.Event(),
+            llama_backend,
+            [{"role": "user", "content": "hi"}],
+            [],
+            0.7,
+            0.9,
+            40,
+            128,
+            "msg_1",
+            "org/A",
+            session_id = "s1",
+            cancel_id = "c1",
+        )
+
+    # Built and abandoned, as when the request task is cancelled before Starlette calls the response.
+    asyncio.run(_build())
+    assert active_generations.count() == 0
+    assert not inf_mod._CANCEL_REGISTRY
+
+    # The client is gone at header time, so the first send fails and the body generator never runs.
+    async def _drive():
+        response = await _build()
+
+        async def _receive():
+            return {"type": "http.disconnect"}
+
+        async def _send(message):
+            raise OSError("client disconnected")
+
+        with pytest.raises(ClientDisconnect):
+            await response({"type": "http"}, _receive, _send)
+
+    asyncio.run(_drive())
+    assert active_generations.count() == 0
+    assert not inf_mod._CANCEL_REGISTRY
+
+    # Still tracked once the body runs: the enter stays inside the generator, under the finally.
+    src = inspect.getsource(inf_mod._anthropic_passthrough_stream)
+    assert src.index("async def _stream()") < src.index("_tracker.__enter__()")
+    assert src.index("_tracker.__enter__()") < src.index("_tracker.__exit__(None, None, None)")
+
+
+def test_audio_generation_is_visible_to_the_swap_gate(monkeypatch):
+    # /audio/generate is non-streaming and holds the model for the whole request: unregistered, a
+    # non-forced swap counted zero and could tear it down mid-TTS, and a forced one had no entry.
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    import routes.inference as inf_mod
+    from models.inference import ChatCompletionRequest
+
+    seen = {}
+
+    class _TtsBackend:
+        active_model_name = "org/TTS"
+        models = {"org/TTS": {"is_audio": True}}
+
+        def generate_audio_response(self, **kwargs):
+            # Sampled mid-generation: the window a concurrent swap would tear down in.
+            seen["count"] = active_generations.count()
+            seen["snapshot"] = active_generations.snapshot()
+            return (b"RIFFfake", 24000)
+
+    # is_loaded False picks the transformers TTS branch, not the GGUF one.
+    monkeypatch.setattr(
+        inf_mod,
+        "get_llama_cpp_backend",
+        lambda: SimpleNamespace(is_loaded = False, _is_audio = False),
+    )
+    monkeypatch.setattr(inf_mod, "get_inference_backend", lambda: _TtsBackend())
+
+    async def _no_auto_switch(*a, **k):
+        return None
+
+    monkeypatch.setattr(inf_mod, "_maybe_auto_switch_model", _no_auto_switch)
+
+    payload = ChatCompletionRequest(
+        model = "org/TTS",
+        messages = [{"role": "user", "content": "hi"}],
+        thread_id = "thread-tts",
+    )
+    asyncio.run(inf_mod.generate_audio(payload, request = None, current_subject = "tester"))
+
+    assert seen["count"] == 1
+    # Named, so the swap dialog can say which chat it would interrupt.
+    assert seen["snapshot"][0]["thread_id"] == "thread-tts"
+    # And it unregisters, or one TTS call would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+class _ChatRequest(_NeverDisconnectedRequest):
+    """Minimal stand-in for the Starlette Request /v1/chat/completions reads."""
+
+    def __init__(self):
+        from types import SimpleNamespace
+
+        self.method = "POST"
+        self.url = SimpleNamespace(path = "/v1/chat/completions")
+        self.state = SimpleNamespace(skip_api_monitor = True)
+        self.scope: dict = {}
+
+
+def _standard_chat_stubs(monkeypatch, backend):
+    """Point /v1/chat/completions at a standard (non-GGUF) backend.
+
+    ``supports_tools`` False keeps the request off the safetensors server-tool
+    loop, which registers on its own, so the plain default branch is exercised.
+    """
+    from types import SimpleNamespace
+
+    import routes.inference as inf_mod
+
+    monkeypatch.setattr(
+        inf_mod,
+        "get_llama_cpp_backend",
+        lambda: SimpleNamespace(
+            is_loaded = False,
+            supports_tools = False,
+            is_vision = False,
+            context_length = None,
+        ),
+    )
+    monkeypatch.setattr(inf_mod, "get_inference_backend", lambda: backend)
+    monkeypatch.setattr(inf_mod, "_automatic_model_load_may_run", lambda: False)
+    monkeypatch.setattr(
+        inf_mod, "_detect_safetensors_features", lambda *a, **k: {"supports_tools": False}
+    )
+
+    async def _no_auto_switch(*a, **k):
+        return None
+
+    monkeypatch.setattr(inf_mod, "_maybe_auto_switch_model", _no_auto_switch)
+    return inf_mod
+
+
+def test_standard_non_stream_chat_is_visible_to_the_swap_gate(monkeypatch):
+    # ``stream`` defaults to false, so this is the default shape of a standard chat and it holds the
+    # worker throughout. Only the streaming branch registered, so a swap truncated the completion.
+    _route_gate()
+    import asyncio
+
+    import routes.inference as inf_mod
+    from models.inference import ChatCompletionRequest
+
+    seen = {}
+
+    class _StandardBackend:
+        active_model_name = "org/M"
+        models = {"org/M": {"chat_template_info": {"template": "chatml"}}}
+
+        def generate_chat_response(
+            self,
+            *,
+            cancel_event = None,
+            stats_holder = None,
+            **kwargs,
+        ):
+            # Sampled mid-generation: exactly the window an /unload lands in.
+            seen["count"] = active_generations.count()
+            seen["snapshot"] = active_generations.snapshot()
+            # And the gate must reach this run, on the event the decode watches.
+            seen["cancelled"] = active_generations.cancel_all()
+            seen["reached_the_decode"] = cancel_event is not None and cancel_event.is_set()
+            yield "33"
+
+        def reset_generation_state(self, caller_cancel_event = None):
+            pass
+
+    _standard_chat_stubs(monkeypatch, _StandardBackend())
+
+    payload = ChatCompletionRequest(
+        model = "org/M",
+        messages = [{"role": "user", "content": "hi"}],
+        thread_id = "thread-chat",
+    )
+    response = asyncio.run(
+        inf_mod.openai_chat_completions(payload, _ChatRequest(), current_subject = "tester")
+    )
+
+    assert response.status_code == 200
+    assert seen["count"] == 1
+    # Named, so the swap dialog can say which chat it would interrupt.
+    assert seen["snapshot"][0]["thread_id"] == "thread-chat"
+    assert seen["cancelled"] == 1
+    assert seen["reached_the_decode"]
+    # And it unregisters, or one completion would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+def test_standard_non_stream_chat_unregisters_when_it_fails(monkeypatch):
+    # A raising backend must not strand an entry: that would 409 every later swap.
+    _route_gate()
+    import asyncio
+
+    from fastapi import HTTPException
+
+    import routes.inference as inf_mod
+    from models.inference import ChatCompletionRequest
+
+    class _BrokenBackend:
+        active_model_name = "org/M"
+        models = {"org/M": {"chat_template_info": {"template": "chatml"}}}
+
+        def generate_chat_response(self, **kwargs):
+            raise RuntimeError("decode exploded")
+            yield  # pragma: no cover - generator marker
+
+        def reset_generation_state(self, caller_cancel_event = None):
+            pass
+
+    _standard_chat_stubs(monkeypatch, _BrokenBackend())
+
+    payload = ChatCompletionRequest(model = "org/M", messages = [{"role": "user", "content": "hi"}])
+    with pytest.raises(HTTPException):
+        asyncio.run(
+            inf_mod.openai_chat_completions(payload, _ChatRequest(), current_subject = "tester")
+        )
+
+    assert active_generations.count() == 0
+
+
+def test_audio_input_non_stream_chat_is_visible_to_the_swap_gate(monkeypatch):
+    # An audio-input model with the default stream=false holds the standard worker throughout. Only
+    # the streaming sibling registered, so a non-forced swap could unload it mid-transcription.
+    _route_gate()
+    import asyncio
+
+    import routes.inference as inf_mod
+    from models.inference import ChatCompletionRequest
+
+    seen = {}
+
+    class _AudioInputBackend:
+        active_model_name = "org/AUDIO-IN"
+        models = {"org/AUDIO-IN": {"has_audio_input": True}}
+
+        def generate_audio_input_response(
+            self,
+            *,
+            cancel_event = None,
+            **kwargs,
+        ):
+            # Sampled mid-transcription: the window a concurrent swap lands in.
+            seen["count"] = active_generations.count()
+            seen["snapshot"] = active_generations.snapshot()
+            seen["cancelled"] = active_generations.cancel_all()
+            seen["reached_the_decode"] = cancel_event is not None and cancel_event.is_set()
+            yield "33"
+
+        def reset_generation_state(self, caller_cancel_event = None):
+            pass
+
+    _standard_chat_stubs(monkeypatch, _AudioInputBackend())
+    monkeypatch.setattr(inf_mod, "_decode_audio_base64", lambda _b64: object())
+
+    payload = ChatCompletionRequest(
+        model = "org/AUDIO-IN",
+        messages = [{"role": "user", "content": "transcribe this"}],
+        audio_base64 = "ZmFrZQ==",
+        thread_id = "thread-audio-in",
+    )
+    response = asyncio.run(
+        inf_mod.openai_chat_completions(payload, _ChatRequest(), current_subject = "tester")
+    )
+
+    assert response.status_code == 200
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["thread_id"] == "thread-audio-in"
+    assert seen["cancelled"] == 1
+    assert seen["reached_the_decode"]
+    # And it unregisters, or one transcription would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+def _anthropic_route_stubs(monkeypatch, **overrides):
+    """Minimal GGUF backend + request stub for the /v1/messages route."""
+    from types import SimpleNamespace
+
+    import routes.inference as inf_mod
+    from state.tool_policy import reset_tool_policy
+
+    reset_tool_policy()
+    backend = SimpleNamespace(
+        is_loaded = True,
+        is_vision = False,
+        supports_tools = True,
+        supports_tool_passthrough = True,
+        model_identifier = "org/M-GGUF",
+        base_url = "http://llama.test",
+        context_length = 4096,
+        count_chat_tokens = lambda *a, **k: 2,
+    )
+    backend.__dict__.update(overrides)
+    monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+    monkeypatch.setattr(inf_mod, "_automatic_model_load_may_run", lambda: False)
+    return inf_mod
+
+
+class _MessagesRequest(_NeverDisconnectedRequest):
+    """Minimal stand-in for the Starlette Request /v1/messages reads."""
+
+    def __init__(self):
+        from types import SimpleNamespace
+
+        self.method = "POST"
+        self.url = SimpleNamespace(path = "/v1/messages")
+        self.state = SimpleNamespace(skip_api_monitor = True)
+
+
+@pytest.mark.parametrize("with_server_tools", [False, True])
+def test_local_anthropic_non_stream_is_visible_to_the_swap_gate(monkeypatch, with_server_tools):
+    # ``stream`` defaults to false on /v1/messages, so the non-streaming plain and server-tool branches
+    # are the common shape and decode throughout. Only their streaming siblings registered.
+    _route_gate()
+    import asyncio
+
+    from models.inference import AnthropicMessagesRequest
+
+    seen = {}
+
+    def _sample():
+        # Sampled mid-generation: exactly the window an /unload lands in.
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        seen["cancelled"] = active_generations.cancel_all()
+
+    def _gen_plain(*, cancel_event = None, **kwargs):
+        _sample()
+        seen["reached_the_decode"] = cancel_event is not None and cancel_event.is_set()
+        yield "ok"
+
+    def _gen_tools(*, cancel_event = None, **kwargs):
+        _sample()
+        seen["reached_the_decode"] = cancel_event is not None and cancel_event.is_set()
+        yield {"type": "content", "text": "ok"}
+
+    inf_mod = _anthropic_route_stubs(
+        monkeypatch,
+        generate_chat_completion = _gen_plain,
+        generate_chat_completion_with_tools = _gen_tools,
+    )
+
+    fields = {"max_tokens": 16, "messages": [{"role": "user", "content": "hi"}]}
+    if with_server_tools:
+        fields["enable_tools"] = True
+        fields["tools"] = [{"type": "web_search_20250305", "name": "web_search"}]
+    payload = AnthropicMessagesRequest(**fields)
+
+    response = asyncio.run(
+        inf_mod.anthropic_messages(payload, request = _MessagesRequest(), current_subject = "tester")
+    )
+
+    assert response.status_code == 200
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M-GGUF"
+    assert seen["cancelled"] == 1
+    # The event registered is the one the decode watches, so a forced swap lands.
+    assert seen["reached_the_decode"]
+    # And it unregisters, or one message would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+def test_anthropic_passthrough_non_stream_is_visible_to_the_swap_gate(monkeypatch):
+    # The client-tool pass-through holds llama-server for one non-streaming POST. Its streaming sibling
+    # registers inside the body generator; this branch had none, so /unload tore the server down.
+    _route_gate()
+    import asyncio
+
+    import httpx
+
+    from models.inference import AnthropicMessagesRequest
+
+    seen = {}
+
+    def handler(request):
+        seen["count"] = active_generations.count()
+        seen["snapshot"] = active_generations.snapshot()
+        seen["cancelled"] = active_generations.cancel_all()
+        return httpx.Response(
+            200,
+            json = {
+                "choices": [
+                    {"message": {"role": "assistant", "content": "33"}, "finish_reason": "stop"}
+                ]
+            },
+        )
+
+    inf_mod = _anthropic_route_stubs(monkeypatch)
+    transport = httpx.MockTransport(handler)
+    real_async_client = httpx.AsyncClient
+    # The pass-through takes a per-request client, so a Stop or forced swap can close it mid-POST.
+    monkeypatch.setattr(
+        inf_mod,
+        "_cancelable_nonstreaming_client",
+        lambda: real_async_client(transport = transport),
+    )
+
+    # enable_tools False keeps the server-tool loop out, so the client tool takes the pass-through.
+    payload = AnthropicMessagesRequest(
+        max_tokens = 16,
+        messages = [{"role": "user", "content": "hi"}],
+        enable_tools = False,
+        tools = [{"name": "lookup", "input_schema": {"type": "object", "properties": {}}}],
+    )
+
+    response = asyncio.run(
+        inf_mod.anthropic_messages(payload, request = _MessagesRequest(), current_subject = "tester")
+    )
+
+    assert response.status_code == 200
+    assert seen["count"] == 1
+    assert seen["snapshot"][0]["model"] == "org/M-GGUF"
+    assert seen["cancelled"] == 1
+    # And it unregisters, or one message would 409 every later reload.
+    assert active_generations.count() == 0
+
+
+def test_anthropic_passthrough_non_stream_stops_when_the_swap_cancels_it(monkeypatch):
+    # Registering is half the job: a pooled client cannot be closed, so the run was cancelled while the
+    # POST carried on. The watcher closes a per-request client; the set event makes that error a cancel.
+    _route_gate()
+    import asyncio
+
+    import httpx
+
+    from models.inference import AnthropicMessagesRequest
+
+    seen = {}
+
+    def handler(request):
+        # Stand in for a forced swap mid-decode: cancel, then fail the transport as closing would.
+        seen["cancelled"] = active_generations.cancel_all()
+        raise httpx.ConnectError("client closed")
+
+    inf_mod = _anthropic_route_stubs(monkeypatch)
+    transport = httpx.MockTransport(handler)
+    real_async_client = httpx.AsyncClient
+    monkeypatch.setattr(
+        inf_mod,
+        "_cancelable_nonstreaming_client",
+        lambda: real_async_client(transport = transport),
+    )
+
+    payload = AnthropicMessagesRequest(
+        max_tokens = 16,
+        messages = [{"role": "user", "content": "hi"}],
+        enable_tools = False,
+        tools = [{"name": "lookup", "input_schema": {"type": "object", "properties": {}}}],
+    )
+
+    with pytest.raises(asyncio.CancelledError):
+        asyncio.run(
+            inf_mod.anthropic_messages(
+                payload, request = _MessagesRequest(), current_subject = "tester"
+            )
+        )
+
+    assert seen["cancelled"] == 1
+    # Cancelled or not, the entry must go, or one message 409s every later reload.
+    assert active_generations.count() == 0
+
+
+def test_audio_generation_unregisters_when_it_fails(monkeypatch):
+    # A raising backend must not strand an entry: that would 409 every later load.
+    _route_gate()
+    import asyncio
+    from types import SimpleNamespace
+
+    from fastapi import HTTPException
+
+    import routes.inference as inf_mod
+    from models.inference import ChatCompletionRequest
+
+    class _BrokenTtsBackend:
+        active_model_name = "org/TTS"
+        models = {"org/TTS": {"is_audio": True}}
+
+        def generate_audio_response(self, **kwargs):
+            raise RuntimeError("codec exploded")
+
+    monkeypatch.setattr(
+        inf_mod,
+        "get_llama_cpp_backend",
+        lambda: SimpleNamespace(is_loaded = False, _is_audio = False),
+    )
+    monkeypatch.setattr(inf_mod, "get_inference_backend", lambda: _BrokenTtsBackend())
+
+    async def _no_auto_switch(*a, **k):
+        return None
+
+    monkeypatch.setattr(inf_mod, "_maybe_auto_switch_model", _no_auto_switch)
+
+    payload = ChatCompletionRequest(
+        model = "org/TTS",
+        messages = [{"role": "user", "content": "hi"}],
+    )
+    with pytest.raises(HTTPException):
+        asyncio.run(inf_mod.generate_audio(payload, request = None, current_subject = "tester"))
+
+    assert active_generations.count() == 0
+
+
+# ── sidecar install: carrying a confirmed swap through ─────────────────
+
+
+def _stub_install_route(monkeypatch, *, in_flight_events):
+    """Point POST /install-latest-transformers at an in-memory sidecar install.
+
+    ``in_flight_events`` stands in for the middleware's in-flight count: a
+    request is counted until its stream observes the cancel event and unwinds,
+    which is the coupling the installer's guard actually reads.
+    """
+    from types import SimpleNamespace
+
+    import core.inference.llama_keepwarm as keepwarm
+    import routes.inference as inf_mod
+    import utils.transformers_latest as latest_mod
+    import utils.transformers_version as version_mod
+
+    calls = {"installed": [], "released": 0}
+
+    monkeypatch.setattr(version_mod, "try_begin_sidecar_swap", lambda: True)
+
+    def _end_sidecar_swap():
+        calls["released"] += 1
+
+    monkeypatch.setattr(version_mod, "end_sidecar_swap", _end_sidecar_swap)
+
+    import core.export as export_mod
+    import core.training as training_mod
+
+    monkeypatch.setattr(
+        training_mod,
+        "get_training_backend",
+        lambda: SimpleNamespace(is_training_active = lambda: False),
+    )
+    monkeypatch.setattr(
+        export_mod,
+        "get_export_backend",
+        lambda: SimpleNamespace(is_export_active = lambda: False, current_checkpoint = None),
+    )
+    monkeypatch.setattr(
+        inf_mod,
+        "get_inference_backend",
+        lambda: SimpleNamespace(active_model_name = None, load_generation = 0),
+    )
+
+    def _fake_in_flight(current_request_counted = True, *, include_pending = True):
+        return sum(1 for ev in in_flight_events if not ev.is_set())
+
+    monkeypatch.setattr(keepwarm, "other_inference_request_count", _fake_in_flight)
+
+    def _install(version, before_swap, *args, **kwargs):
+        calls["installed"].append(version)
+        return {"success": True, "version": version, "message": "installed"}
+
+    monkeypatch.setattr(latest_mod, "install_latest_transformers", _install)
+    return inf_mod, calls
+
+
+def test_confirmed_install_stops_the_chats_it_was_given_permission_to_stop(monkeypatch):
+    # The install sits between the swap's "stop N chats" prompt and the /load carrying the
+    # confirmation, and refuses while those chats run, so a confirmed install cancels them itself.
+    _route_gate()
+    import asyncio
+
+    from models.inference import InstallLatestTransformersRequest
+
+    ev = threading.Event()
+    inf_mod, calls = _stub_install_route(monkeypatch, in_flight_events = [ev])
+
+    with active_generations.ActiveGeneration(ev, thread_id = "t1", model = "org/M-GGUF"):
+        response = asyncio.run(
+            inf_mod.install_latest_transformers_route(
+                InstallLatestTransformersRequest(version = "5.0.0", force_cancel_active = True),
+                "tester",
+            )
+        )
+        assert ev.is_set()
+
+    assert response.success is True
+    assert calls["installed"] == ["5.0.0"]
+
+
+def test_unconfirmed_install_still_refuses_while_chats_stream(monkeypatch):
+    # Unchanged for every caller that never confirmed (second tab, desktop, curl): no flag, no cancel.
+    _route_gate()
+    import asyncio
+
+    from fastapi import HTTPException
+
+    from models.inference import InstallLatestTransformersRequest
+
+    ev = threading.Event()
+    inf_mod, calls = _stub_install_route(monkeypatch, in_flight_events = [ev])
+
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            asyncio.run(
+                inf_mod.install_latest_transformers_route(
+                    InstallLatestTransformersRequest(version = "5.0.0"),
+                    "tester",
+                )
+            )
+        assert not ev.is_set()
+        assert active_generations.count() == 1
+
+    assert exc.value.status_code == 409
+    assert calls["installed"] == []
+
+
+def test_a_confirmed_install_that_cannot_drain_refuses_instead_of_swapping(monkeypatch):
+    # A cancelled request that never observes its event keeps the in-flight count up, so the drain is
+    # bounded and cannot wedge the process holding the gate; the recheck behind it still refuses.
+    _route_gate()
+    import asyncio
+
+    from fastapi import HTTPException
+
+    from models.inference import InstallLatestTransformersRequest
+
+    ev = threading.Event()
+    stuck = threading.Event()
+    stuck.set()  # already "cancelled", yet still counted: it never unwinds
+    inf_mod, calls = _stub_install_route(monkeypatch, in_flight_events = [ev, stuck])
+    monkeypatch.setattr(inf_mod, "_POST_CANCEL_DRAIN_TIMEOUT_S", 0.05)
+
+    def _never_unwinds(current_request_counted = True, *, include_pending = True):
+        return 1
+
+    import core.inference.llama_keepwarm as keepwarm
+
+    monkeypatch.setattr(keepwarm, "other_inference_request_count", _never_unwinds)
+
+    async def _install():
+        # Deadline here too: a regression that drops the drain's bound must fail, not hang the suite.
+        return await asyncio.wait_for(
+            inf_mod.install_latest_transformers_route(
+                InstallLatestTransformersRequest(version = "5.0.0", force_cancel_active = True),
+                "tester",
+            ),
+            timeout = 5,
+        )
+
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            asyncio.run(_install())
+
+    assert exc.value.status_code == 409
+    assert calls["installed"] == []
+
+
+def test_confirmed_install_does_not_spend_its_cancel_on_an_install_that_will_refuse(monkeypatch):
+    # An unrelated counted request the cancel cannot stop must be waited out BEFORE the cancel: the
+    # recheck refuses while it is there, so cancelling first stopped chats for a doomed install.
+    _route_gate()
+    import asyncio
+
+    from fastapi import HTTPException
+
+    from models.inference import InstallLatestTransformersRequest
+
+    ev = threading.Event()
+    inf_mod, calls = _stub_install_route(monkeypatch, in_flight_events = [ev])
+
+    import core.inference.llama_keepwarm as keepwarm
+
+    def _never_drains(current_request_counted = True, *, include_pending = True):
+        # Discounting the registered chat still leaves the counted-only stranger: the drain must not clear.
+        return 2
+
+    monkeypatch.setattr(keepwarm, "other_inference_request_count", _never_drains)
+    monkeypatch.setattr(inf_mod, "_POST_CANCEL_DRAIN_TIMEOUT_S", 0.05)
+
+    async def _install():
+        return await asyncio.wait_for(
+            inf_mod.install_latest_transformers_route(
+                InstallLatestTransformersRequest(version = "5.0.0", force_cancel_active = True),
+                "tester",
+            ),
+            timeout = 5,
+        )
+
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        with pytest.raises(HTTPException) as exc:
+            asyncio.run(_install())
+        # The refusal is the same as before; what changed is that the chat lives.
+        assert not ev.is_set()
+        assert active_generations.count() == 1
+
+    assert exc.value.status_code == 409
+    assert calls["installed"] == []
+
+
+# ── draining before teardown ──────────────────────────────────────────
+
+
+def _drain_with_counts(monkeypatch, counts, **kwargs):
+    """Run _wait_for_model_switch_idle against a scripted in-flight count.
+
+    ``counts`` is consumed one entry per poll; the last value repeats, so a
+    trailing non-zero stands for a request that never unwinds.
+    """
+    _route_gate()
+    import asyncio
+
+    import core.inference.llama_keepwarm as keepwarm
+    import routes.inference as inf_mod
+
+    remaining = list(counts)
+    polls = {"n": 0}
+
+    def _count(current_request_counted = True, *, include_pending = True):
+        polls["n"] += 1
+        return remaining.pop(0) if len(remaining) > 1 else remaining[0]
+
+    monkeypatch.setattr(keepwarm, "other_inference_request_count", _count)
+    monkeypatch.setattr(inf_mod, "_switch_waiter_count", lambda: 0)
+
+    async def _run():
+        # Hard test-side deadline: a drain that regresses to waiting forever must fail red, not hang.
+        await asyncio.wait_for(
+            inf_mod._wait_for_model_switch_idle(current_request_counted = False, **kwargs),
+            timeout = 5,
+        )
+
+    asyncio.run(_run())
+    return polls["n"]
+
+
+def test_forced_swap_does_not_wait_out_the_generations_it_is_about_to_cancel(monkeypatch):
+    # cancel_pending discounts the registered generations, since the caller cancels them right after.
+    # Drop the discount and the drain waits on a count only that pending cancel can lower: forever.
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        polls = _drain_with_counts(monkeypatch, [1], cancel_pending = True)
+    assert polls == 1
+
+
+def test_the_same_drain_without_the_discount_would_keep_waiting(monkeypatch):
+    # The other half: that count really does block, so the previous test passes by the discount.
+    ev = threading.Event()
+    with active_generations.ActiveGeneration(ev, thread_id = "t1"):
+        polls = _drain_with_counts(monkeypatch, [1], timeout_s = 0.05)
+    assert polls > 1
+
+
+def test_post_cancel_drain_gives_up_on_a_request_that_never_unwinds(monkeypatch):
+    # TTS on the subprocess backend observes no cancel event, so a forced swap can cancel it and still
+    # see it counted forever. The post-cancel drains hold the gate, so they must expire and proceed.
+    polls = _drain_with_counts(monkeypatch, [1], timeout_s = 0.05)
+    assert polls > 1
+
+
+def test_drain_returns_as_soon_as_the_cancelled_requests_unwind(monkeypatch):
+    # The bound is a backstop: once the count drops the drain returns without sitting out the timeout.
+    polls = _drain_with_counts(monkeypatch, [2, 1, 0], timeout_s = 30)
+    assert polls == 3
+
+
+# ── queued chats must not cancel the running one ──────────────────────
+
+
+def _orchestrator_for_ownership():
+    """A real InferenceOrchestrator with just enough stubbed to drive the lock."""
+    _route_gate()
+    orch_mod = pytest.importorskip(
+        "core.inference.orchestrator", reason = "inference stack not installed"
+    )
+    orch = orch_mod.InferenceOrchestrator.__new__(orch_mod.InferenceOrchestrator)
+    orch._gen_lock = threading.Lock()
+    orch._active_cancel_events = []
+    orch._executing_cancel_events = []
+    orch._active_cancel_lock = threading.Lock()
+    orch._cancel_event = threading.Event()
+    orch._ensure_subprocess_alive = lambda: False  # stop before _send_cmd
+    return orch
+
+
+def test_a_queued_chat_cannot_reset_the_chat_that_is_generating():
+    # Safetensors generation serialises on _gen_lock and the worker has ONE cancel event: stopping
+    # queued chat B reset that shared event and killed running chat A. Scope the reset to the holder.
+    orch = _orchestrator_for_ownership()
+    a_event = threading.Event()
+    b_event = threading.Event()
+
+    orch._claim_worker(a_event)  # A holds the lock ...
+    orch._mark_worker_started(a_event)  # ... and the worker is answering it
+    orch.reset_generation_state(b_event)  # B is queued and gets stopped
+    assert not orch._cancel_event.is_set()
+
+    orch.reset_generation_state(a_event)  # A's own Stop still works
+    assert orch._cancel_event.is_set()
+
+
+def test_a_global_reset_still_cancels_whatever_is_running():
+    # Unload and switch pass nothing: they mean stop everything, else a generation survives teardown.
+    orch = _orchestrator_for_ownership()
+    _running = threading.Event()
+    orch._claim_worker(_running)
+    orch._mark_worker_started(_running)
+    orch.reset_generation_state()
+    assert orch._cancel_event.is_set()
+
+
+def test_a_reset_with_no_generation_running_is_not_dropped():
+    # Nothing holds the lock, so no chat to protect: a reset before any generation must still run.
+    orch = _orchestrator_for_ownership()
+    orch.reset_generation_state(threading.Event())
+    assert orch._cancel_event.is_set()
+
+
+def test_unload_waits_for_a_request_that_is_admitted_but_not_yet_registered(monkeypatch):
+    # The window between the keep-warm middleware and _TrackedCancel: counted in-flight, absent from
+    # the registry. Cancelling on the registry alone tore the backend down under an admitted request.
+    _route_gate()
+    import core.inference.llama_keepwarm as keepwarm
+    import routes.inference as inf_mod
+
+    # Counted for two polls, then the request registers/finishes and clears.
+    remaining = [1, 1, 0]
+    seen = {}
+
+    def _count(current_request_counted = True, *, include_pending = True):
+        return remaining.pop(0) if len(remaining) > 1 else remaining[0]
+
+    monkeypatch.setattr(keepwarm, "other_inference_request_count", _count)
+    monkeypatch.setattr(inf_mod, "_switch_waiter_count", lambda: 0)
+
+    torn_down: list[str] = []
+
+    def _record_teardown():
+        seen["counted_at_teardown"] = remaining[0]
+        torn_down.append("gguf")
+
+    # Registry deliberately empty: this is the unregistered case.
+    response = _run_unload(
+        inf_mod,
+        monkeypatch,
+        loaded_gguf = "org/A-GGUF",
+        requested = "org/A-GGUF",
+        force = True,
+        torn_down = torn_down,
+        unload_model = _record_teardown,
+    )
+
+    assert active_generations.count() == 0
+    assert torn_down == ["gguf"]
+    assert seen["counted_at_teardown"] == 0
+    assert response.status == "unloaded"
+
+
+def test_a_dispatched_chat_cannot_reset_its_concurrently_dispatched_sibling():
+    # Compare-mode / dispatched runs bypass _gen_lock and run concurrently, so with several claimed
+    # at once a Stop on one must still leave the others alone.
+    orch = _orchestrator_for_ownership()
+    a_event = threading.Event()
+    b_event = threading.Event()
+    c_event = threading.Event()
+
+    orch._claim_worker(a_event)
+    orch._mark_worker_started(a_event)
+    orch._claim_worker(b_event)
+    orch._mark_worker_started(b_event)
+
+    orch.reset_generation_state(c_event)  # a third, unrelated request
+    assert not orch._cancel_event.is_set()
+
+    orch.reset_generation_state(b_event)  # one of the running pair
+    assert orch._cancel_event.is_set()
+
+
+def test_releasing_one_generation_leaves_the_other_claimed():
+    orch = _orchestrator_for_ownership()
+    a_event = threading.Event()
+    b_event = threading.Event()
+    orch._claim_worker(a_event)
+    orch._mark_worker_started(a_event)
+    orch._claim_worker(b_event)
+    orch._mark_worker_started(b_event)
+    orch._release_worker(a_event)
+
+    orch.reset_generation_state(a_event)  # now a stranger
+    assert not orch._cancel_event.is_set()
+
+    orch._release_worker(b_event)
+    orch.reset_generation_state(a_event)  # nothing running: no one to protect
+    assert orch._cancel_event.is_set()
+
+
+def test_a_dispatched_request_queued_behind_another_is_not_an_owner():
+    # The subprocess runs generations one at a time, so admission is not execution: B can be claimed
+    # while the worker answers A. Counting B as an owner let its Stop signal the shared event and end A.
+    orch = _orchestrator_for_ownership()
+    a_event = threading.Event()
+    b_event = threading.Event()
+
+    orch._claim_worker(a_event)
+    orch._mark_worker_started(a_event)  # the worker answered A
+    orch._claim_worker(b_event)  # B is only queued behind it
+
+    orch.reset_generation_state(b_event)
+    assert not orch._cancel_event.is_set(), "a queued request must not reset A"
+
+    orch._mark_worker_started(b_event)  # the worker moves on to B
+    orch.reset_generation_state(b_event)
+    assert orch._cancel_event.is_set()
+
+
+def test_a_queued_request_cannot_reset_during_the_other_ones_prefill():
+    # Between _send_cmd and the first response A is claimed but not executing; treating that as
+    # "nobody to protect" let a queued request's Stop kill A mid-prefill.
+    orch = _orchestrator_for_ownership()
+    a_event = threading.Event()
+    b_event = threading.Event()
+
+    orch._claim_worker(a_event)  # A sent its command and is in prefill
+    orch._claim_worker(b_event)  # B is queued behind it
+
+    orch.reset_generation_state(b_event)
+    assert not orch._cancel_event.is_set(), "B must not reset A during prefill"
+
+    # A's own Stop still works before any token has arrived.
+    orch.reset_generation_state(a_event)
+    assert orch._cancel_event.is_set()
+
+
+def test_the_oldest_claim_is_the_one_the_worker_is_prefilling():
+    # The command queue is FIFO, so with nothing answering the oldest claim is the executor.
+    orch = _orchestrator_for_ownership()
+    a_event = threading.Event()
+    b_event = threading.Event()
+    orch._claim_worker(a_event)
+    orch._claim_worker(b_event)
+    orch._release_worker(a_event)
+
+    orch.reset_generation_state(b_event)
+    assert orch._cancel_event.is_set(), "B is now the oldest claim"
+
+
+def test_claim_order_matches_send_order_under_concurrent_dispatch():
+    # _owns_worker reads claim order to decide who is prefilling, so a claim not atomic with the
+    # enqueue can put A first in the list while B is first in the subprocess queue: stopping A kills B.
+    _route_gate()
+    orch_mod = pytest.importorskip(
+        "core.inference.orchestrator", reason = "inference stack not installed"
+    )
+    orch = orch_mod.InferenceOrchestrator.__new__(orch_mod.InferenceOrchestrator)
+    orch._active_cancel_events = []
+    orch._executing_cancel_events = []
+    orch._active_cancel_lock = threading.Lock()
+    orch._send_order_lock = threading.Lock()
+
+    sent: list = []
+    barrier = threading.Barrier(4)
+
+    def worker(ev):
+        barrier.wait(timeout = 10)
+        with orch._send_order_lock:
+            orch._claim_worker(ev)
+            # Stand in for _send_cmd: the enqueue must not be separable from the claim.
+            sent.append(ev)
+
+    events = [threading.Event() for _ in range(4)]
+    threads = [threading.Thread(target = worker, args = (e,)) for e in events]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join(timeout = 30)
+
+    assert orch._active_cancel_events == sent, "claim order must equal send order"
diff --git a/studio/backend/tests/test_anthropic_admission.py b/studio/backend/tests/test_anthropic_admission.py
new file mode 100644
index 0000000000..d4fcf85a45
--- /dev/null
+++ b/studio/backend/tests/test_anthropic_admission.py
@@ -0,0 +1,975 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Admission-control wiring for the Anthropic /v1/messages endpoint.
+
+The FIFO queue itself is unit-tested in test_llama_admission.py; here we exercise
+how anthropic_messages reserves a slot, queues when the backend is saturated,
+streams keep-alives while waiting, releases on completion, and maps rejects to
+429/503. Slot occupancy is driven directly through the shared queue (keyed by the
+backend base_url) so generation stays fast and no thread has to block.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import gc
+import os
+import re
+import sys
+import threading
+import time
+import warnings
+from types import SimpleNamespace
+
+import httpx
+import pytest
+
+_backend = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, _backend)
+
+import routes.inference as inf_mod
+from routes.inference import (
+    _anthropic_passthrough_retry_url,
+    _anthropic_passthrough_stream,
+    anthropic_messages,
+)
+from models.inference import AnthropicMessagesRequest
+from core.inference.api_monitor import ApiMonitor
+from core.inference.llama_admission import (
+    ADMISSION_CONTROL_ENV,
+    ADMISSION_KEEPALIVE_INTERVAL_ENV,
+    ADMISSION_MAX_QUEUE_ENV,
+    ADMISSION_QUEUE_PER_SLOT_ENV,
+    ADMISSION_QUEUE_TIMEOUT_ENV,
+    LlamaAdmissionConfig,
+    get_llama_admission_queue,
+    reset_llama_admission_queues,
+)
+from fastapi import HTTPException
+
+_KEY = "http://llama.admission.test:9999"
+
+
+@pytest.fixture(autouse = True)
+def _isolate(monkeypatch):
+    reset_llama_admission_queues()
+    monkeypatch.setattr(inf_mod, "api_monitor", ApiMonitor(max_entries = 64))
+    monkeypatch.setattr(inf_mod, "_CANCEL_REGISTRY", {})
+    for name in (
+        ADMISSION_CONTROL_ENV,
+        ADMISSION_QUEUE_TIMEOUT_ENV,
+        ADMISSION_KEEPALIVE_INTERVAL_ENV,
+        ADMISSION_MAX_QUEUE_ENV,
+        ADMISSION_QUEUE_PER_SLOT_ENV,
+        # Legacy spellings resolve too, so clear both for isolation.
+        "UNSLOTH_OPENAI_COMPAT_ADMISSION_CONTROL",
+        "UNSLOTH_OPENAI_COMPAT_ADMISSION_QUEUE_TIMEOUT",
+        "UNSLOTH_OPENAI_COMPAT_ADMISSION_KEEPALIVE_INTERVAL",
+        "UNSLOTH_OPENAI_COMPAT_ADMISSION_MAX_QUEUE",
+    ):
+        monkeypatch.delenv(name, raising = False)
+    yield
+    reset_llama_admission_queues()
+
+
+class _Request:
+    def __init__(self, disconnected = False):
+        self.state = SimpleNamespace()
+        self.url = SimpleNamespace(path = "/v1/messages")
+        self.method = "POST"
+        self._disconnected = disconnected
+
+    async def is_disconnected(self):
+        return self._disconnected
+
+
+def _install_backend(
+    monkeypatch,
+    *,
+    slots = 1,
+    base_url = _KEY,
+    count_tokens = None,
+):
+    def _gen_plain(**_kwargs):
+        yield "ok"
+
+    def _gen_tools(**_kwargs):
+        yield {"type": "content", "text": "ok"}
+
+    backend = SimpleNamespace(
+        is_loaded = True,
+        is_vision = False,
+        supports_tools = True,
+        supports_tool_passthrough = False,
+        model_identifier = "test-model",
+        context_length = 2048,
+        count_chat_tokens = count_tokens or (lambda *a, **k: 2),
+        generate_chat_completion = _gen_plain,
+        generate_chat_completion_with_tools = _gen_tools,
+        effective_parallel_slots = slots,
+        base_url = base_url,
+    )
+    monkeypatch.setattr(inf_mod, "get_llama_cpp_backend", lambda: backend)
+    return backend
+
+
+def _payload(**fields) -> AnthropicMessagesRequest:
+    base = {"max_tokens": 16, "messages": [{"role": "user", "content": "hi"}]}
+    base.update(fields)
+    return AnthropicMessagesRequest(**base)
+
+
+def _record_admission_logs(monkeypatch):
+    """Capture _llama_admission_log output.
+
+    Through the logger rather than caplog: this one is a structlog bound logger,
+    so it never reaches the stdlib handlers caplog installs.
+    """
+    records = []
+
+    def _record(level):
+        return lambda fmt, *args: records.append((level, fmt % args))
+
+    monkeypatch.setattr(
+        inf_mod,
+        "logger",
+        SimpleNamespace(
+            debug = _record("debug"),
+            info = _record("info"),
+            warning = _record("warning"),
+        ),
+    )
+    return records
+
+
+def _snapshot(key = _KEY):
+    return get_llama_admission_queue(key).snapshot()
+
+
+def _occupy(key, capacity, n):
+    """Hold ``n`` slots on the queue so the next reserve must wait; returns leases."""
+    leases = []
+    for _ in range(n):
+        reservation = get_llama_admission_queue(key).reserve(
+            capacity = capacity, config = LlamaAdmissionConfig()
+        )
+        lease = reservation.lease_nowait()
+        assert lease is not None
+        leases.append(lease)
+    return leases
+
+
+async def _consume(response):
+    chunks = []
+    async for chunk in response.body_iterator:
+        chunks.append(chunk.decode() if isinstance(chunk, (bytes, bytearray)) else chunk)
+    return "".join(chunks)
+
+
+# ── Non-streaming ─────────────────────────────────────────────
+
+
+def test_non_streaming_completes_and_releases_slot(monkeypatch):
+    _install_backend(monkeypatch, slots = 2)
+
+    async def _run():
+        response = await anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+        assert response.status_code == 200
+        snap = _snapshot()
+        assert snap.active == 0 and snap.queued == 0
+
+    asyncio.run(_run())
+
+
+def test_non_streaming_queue_full_returns_429(monkeypatch):
+    monkeypatch.setenv(ADMISSION_MAX_QUEUE_ENV, "1")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)  # slot busy
+        # One waiter fills the max_queue=1; the next reserve rejects.
+        get_llama_admission_queue(_KEY).reserve(
+            capacity = 1, config = LlamaAdmissionConfig(max_queue = 1)
+        )
+        with pytest.raises(HTTPException) as exc:
+            await anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+        assert exc.value.status_code == 429
+        # rate_limit_error is what Anthropic SDKs back off on; overloaded_error is 529.
+        # The type string alone does not pin the envelope, since OpenAI's 429 uses the
+        # same word. Assert the shape too, or emitting an OpenAI body still passes.
+        detail = exc.value.detail
+        assert detail["type"] == "error"
+        assert "request_id" in detail
+        assert set(detail["error"]) == {"type", "message"}
+        assert detail["error"]["type"] == "rate_limit_error"
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+def test_admission_events_are_logged_on_the_anthropic_surface(monkeypatch):
+    # The OpenAI passthrough logs these with a mode; without the same on /v1/messages
+    # an operator debugging a slow Anthropic client has nothing to look at, and the
+    # pool is shared, so it is the same triage.
+    records = _record_admission_logs(monkeypatch)
+    monkeypatch.setenv(ADMISSION_MAX_QUEUE_ENV, "1")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        get_llama_admission_queue(_KEY).reserve(
+            capacity = 1, config = LlamaAdmissionConfig(max_queue = 1)
+        )
+        with pytest.raises(HTTPException):
+            await anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+    full = [msg for _level, msg in records if "queue-full" in msg]
+    assert full, records
+    assert "llama admission queue-full" in full[0]
+    assert "mode=anthropic_nonstream" in full[0]
+
+
+def test_streaming_admission_waiting_is_logged(monkeypatch):
+    # queued and granted-after-wait were both emitted with nothing asserting them.
+    records = _record_admission_logs(monkeypatch)
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        task = asyncio.create_task(_consume(response))
+        await asyncio.sleep(0.15)
+        for lease in held:
+            lease.release()
+        await asyncio.wait_for(task, timeout = 5)
+
+    asyncio.run(_run())
+    events = [msg for _level, msg in records if "llama admission" in msg]
+    # "llama admission queued", not "queued": every line carries a queued=N field,
+    # so the bare substring matches any admission log at all.
+    assert any(
+        "llama admission queued" in m and "mode=anthropic_stream" in m for m in events
+    ), events
+    granted = [m for m in events if "granted-after-wait" in m]
+    assert granted, events
+    # wait_ms is the point of the event: a grant that reports nothing is useless.
+    assert re.search(r"wait_ms=\d+", granted[0]), granted
+
+
+def test_streaming_admission_timeout_is_logged(monkeypatch):
+    records = _record_admission_logs(monkeypatch)
+    monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "0.15")
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)  # never released, so the waiter times out
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        await _consume(response)
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+    timeouts = [msg for level, msg in records if "timeout" in msg and level == "warning"]
+    assert timeouts, records
+    assert "mode=anthropic_stream" in timeouts[0]
+
+
+def test_streaming_give_up_while_queued_is_logged(monkeypatch):
+    # cancelled-before-upstream is the one that tells an operator a client walked
+    # away rather than the backend being slow.
+    records = _record_admission_logs(monkeypatch)
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        response = await anthropic_messages(
+            _payload(stream = True),
+            request = _Request(disconnected = True),
+            current_subject = "t",
+        )
+        await _consume(response)
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+    events = [msg for _level, msg in records if "llama admission" in msg]
+    assert any("llama admission cancelled-before-upstream" in m for m in events), events
+
+
+def test_non_streaming_times_out_returns_503(monkeypatch):
+    monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "0.15")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)  # never released -> waiter times out
+        with pytest.raises(HTTPException) as exc:
+            await anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+        assert exc.value.status_code == 503
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+def test_non_streaming_queued_then_admitted(monkeypatch):
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        task = asyncio.create_task(
+            anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+        )
+        await asyncio.sleep(0.1)
+        assert _snapshot().queued == 1  # waiting on the busy slot
+        held[0].release()  # free it
+        response = await asyncio.wait_for(task, timeout = 2)
+        assert response.status_code == 200
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_capacity_enforced_from_effective_parallel_slots(monkeypatch):
+    _install_backend(monkeypatch, slots = 3)
+
+    async def _run():
+        held = _occupy(_KEY, 3, 3)  # all 3 slots busy
+        task = asyncio.create_task(
+            anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+        )
+        await asyncio.sleep(0.1)
+        snap = _snapshot()
+        assert snap.capacity == 3 and snap.active == 3 and snap.queued == 1
+        for lease in held:
+            lease.release()
+        response = await asyncio.wait_for(task, timeout = 2)
+        assert response.status_code == 200
+
+    asyncio.run(_run())
+
+
+def test_disabled_admission_bypasses_limit(monkeypatch):
+    monkeypatch.setenv(ADMISSION_CONTROL_ENV, "off")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)  # would block if admission were on
+        response = await asyncio.wait_for(
+            anthropic_messages(_payload(), request = _Request(), current_subject = "t"),
+            timeout = 2,
+        )
+        assert response.status_code == 200
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+# ── Streaming ─────────────────────────────────────────────────
+
+
+def test_streaming_completes_and_releases_slot(monkeypatch):
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        blob = await _consume(response)
+        assert "event: message_start" in blob
+        assert "event: message_stop" in blob
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_streaming_emits_keepalives_while_queued_then_streams(monkeypatch):
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        body = response.body_iterator
+        # First chunk must be a keep-alive comment (slot still busy).
+        first = await asyncio.wait_for(body.__anext__(), timeout = 2)
+        first = first.decode() if isinstance(first, (bytes, bytearray)) else first
+        assert first.startswith(":")  # SSE comment keep-alive
+        held[0].release()  # free the slot -> real stream follows
+        rest = await asyncio.wait_for(_drain(body), timeout = 2)
+        assert "event: message_start" in rest
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_streaming_queue_full_returns_429(monkeypatch):
+    monkeypatch.setenv(ADMISSION_MAX_QUEUE_ENV, "1")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        get_llama_admission_queue(_KEY).reserve(
+            capacity = 1, config = LlamaAdmissionConfig(max_queue = 1)
+        )
+        with pytest.raises(HTTPException) as exc:
+            await anthropic_messages(_payload(stream = True), request = _Request(), current_subject = "t")
+        assert exc.value.status_code == 429
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+def test_streaming_disconnect_while_queued_frees_slot(monkeypatch):
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        body = response.body_iterator
+        await asyncio.wait_for(body.__anext__(), timeout = 2)  # one keep-alive
+        assert _snapshot().queued == 1
+        await body.aclose()  # client goes away mid-wait
+        held[0].release()
+        await asyncio.sleep(0.05)
+        snap = _snapshot()
+        assert snap.queued == 0 and snap.active == 0
+
+    asyncio.run(_run())
+
+
+# ── Shared queue + fairness + speed ───────────────────────────
+
+
+def test_shares_queue_with_openai_by_base_url(monkeypatch):
+    """The two API surfaces must land on one pool of the same llama-server slots.
+
+    Reserves through the OpenAI helper the /v1/chat/completions path uses, rather
+    than poking the queue directly, so this fails if either side ever derives a
+    different key.
+    """
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        openai_reservation, _ = inf_mod._openai_llama_admission_reserve(
+            request = _Request(), llama_backend = inf_mod.get_llama_cpp_backend()
+        )
+        openai_lease = openai_reservation.lease_nowait()
+        assert openai_lease is not None
+        assert _snapshot().active == 1  # same key the Anthropic side will use
+
+        task = asyncio.create_task(
+            anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+        )
+        await asyncio.sleep(0.1)
+        assert _snapshot().queued == 1  # queued behind the OpenAI generation
+        openai_lease.release()
+        assert (await asyncio.wait_for(task, timeout = 2)).status_code == 200
+
+    asyncio.run(_run())
+
+
+def test_non_streaming_client_gone_while_queued_returns_499(monkeypatch):
+    # The disconnect-while-queued branch; nothing else exercised 499.
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        with pytest.raises(HTTPException) as exc:
+            await anthropic_messages(
+                _payload(), request = _Request(disconnected = True), current_subject = "t"
+            )
+        assert exc.value.status_code == 499
+        assert _snapshot().queued == 0  # waiter cleaned up, not left parked
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+def test_streaming_timeout_emits_an_error_event_and_frees_the_slot(monkeypatch):
+    # Only the non-streaming 503 was covered; streaming reports in-band instead.
+    monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "0.15")
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)  # never released, so the waiter times out
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        body = await _consume(response)
+        assert "event: error" in body
+        assert "message_start" not in body  # never reached the model
+        for lease in held:
+            lease.release()
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_fifo_fairness_across_many_waiters(monkeypatch):
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        order = []
+
+        async def _one(i):
+            resp = await anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+            order.append(i)
+            return resp
+
+        tasks = [asyncio.create_task(_one(i)) for i in range(8)]
+        await asyncio.sleep(0.2)
+        assert _snapshot().queued == 8
+        held[0].release()
+        await asyncio.wait_for(asyncio.gather(*tasks), timeout = 5)
+        assert order == list(range(8))  # granted in arrival order
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_uncontended_hot_path_is_fast(monkeypatch):
+    _install_backend(monkeypatch, slots = 4)
+
+    async def _run():
+        start = time.perf_counter()
+        for _ in range(50):
+            resp = await anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+            assert resp.status_code == 200
+        elapsed = time.perf_counter() - start
+        # Generous ceiling on purpose: this guards against admission accidentally
+        # serialising or sleeping on the uncontended path, not against a slow
+        # runner, so it must not flake on a loaded CI box.
+        assert elapsed < 10.0, f"50 uncontended round-trips took {elapsed:.2f}s"
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+async def _drain(body):
+    chunks = []
+    async for chunk in body:
+        chunks.append(chunk.decode() if isinstance(chunk, (bytes, bytearray)) else chunk)
+    return "".join(chunks)
+
+
+def test_streaming_midstream_cancel_finalizes_the_monitor(monkeypatch):
+    # A mid-stream disconnect is delivered as CancelledError so the monitored body
+    # can finalize its entry. Closing the inner iterator with aclose() instead
+    # delivers GeneratorExit, and the entry stays "running" for the process life.
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        body = response.body_iterator
+        await asyncio.wait_for(body.__anext__(), timeout = 2)  # stream started
+        assert inf_mod.api_monitor.active_count() == 1
+
+        # Propagates back out, as the un-admitted path did; what matters is that
+        # the monitored body saw it on the way through.
+        with pytest.raises(asyncio.CancelledError):
+            await body.athrow(asyncio.CancelledError())  # client vanished
+
+        assert inf_mod.api_monitor.active_count() == 0
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_streaming_give_up_while_queued_finalizes_the_monitor(monkeypatch):
+    # Cancelled before the body ever ran, so nothing downstream can close the
+    # entry out; the wrapper has to do it.
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        body = response.body_iterator
+        await asyncio.wait_for(body.__anext__(), timeout = 2)  # keep-alive, still queued
+        assert inf_mod.api_monitor.active_count() == 1
+
+        await body.aclose()  # give up while waiting
+
+        assert inf_mod.api_monitor.active_count() == 0
+        for lease in held:
+            lease.release()
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_every_dispatch_site_goes_through_admission():
+    """All six generation returns in anthropic_messages are admission-wrapped.
+
+    The tool paths need a passthrough-capable backend and a tools payload to reach
+    at runtime, so guard them structurally instead: a new dispatch site added
+    without admission (or one reverted to _monitored_anthropic) fails here.
+    """
+    import ast
+    import inspect
+
+    tree = ast.parse(inspect.getsource(inf_mod).replace("\t", "    "))
+    handler = next(
+        node
+        for node in ast.walk(tree)
+        if isinstance(node, ast.AsyncFunctionDef) and node.name == "anthropic_messages"
+    )
+    # The wrappers themselves call _monitored_anthropic (the non-streaming one
+    # through the swap-gate tracker); only the dispatch sites count.
+    nested = {
+        node
+        for node in ast.walk(handler)
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef))
+        and node.name.startswith(("_admitted_anthropic", "_tracked_anthropic"))
+    }
+    inner = {id(n) for wrapper in nested for n in ast.walk(wrapper)}
+
+    called = []
+    for node in ast.walk(handler):
+        if id(node) in inner or not isinstance(node, ast.Call):
+            continue
+        if isinstance(node.func, ast.Name):
+            called.append(node.func.id)
+
+    assert called.count("_admitted_anthropic") == 6
+    assert called.count("_monitored_anthropic") == 0
+
+
+def test_queued_give_up_runs_the_response_pre_start_cleanup(monkeypatch):
+    """A stream abandoned while queued must run the builder's eager cleanup.
+
+    The passthrough enters a _TrackedCancel before returning its response and
+    relies on the stream's finally to exit it. That finally never runs for a
+    generator that never started, so the response carries a pre-start hook and
+    the admission wrapper has to chain to it instead of replacing it.
+    """
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+    ran = []
+
+    async def _hook():
+        ran.append(True)
+
+    real = inf_mod._sse_streaming_response
+
+    def _tagged(content, *, unstarted_cleanup = None):
+        return real(content, unstarted_cleanup = _hook)
+
+    monkeypatch.setattr(inf_mod, "_sse_streaming_response", _tagged)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        body = response.body_iterator
+        await asyncio.wait_for(body.__anext__(), timeout = 2)  # keep-alive, still queued
+        await body.aclose()  # give up before the body ran
+
+        assert ran == [True]
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+def test_passthrough_stream_registers_a_pre_start_cleanup():
+    # Structural guard: the tracker is entered eagerly, so the response must
+    # carry the hook that exits it when the body never starts.
+    import ast
+    import inspect
+
+    src = inspect.getsource(inf_mod._anthropic_passthrough_stream)
+    tree = ast.parse(src.replace("\t", "    ").lstrip())
+    returns = [n for n in ast.walk(tree) if isinstance(n, ast.Return) and n.value is not None]
+    call = next(
+        n.value
+        for n in returns
+        if isinstance(n.value, ast.Call)
+        and getattr(n.value.func, "id", "") == "_sse_streaming_response"
+    )
+    hook = next(kw.value for kw in call.keywords if kw.arg == "unstarted_cleanup")
+    # Not just present: a literal None passes the keyword check and still leaks.
+    assert isinstance(hook, ast.Call)
+    assert getattr(hook.func, "id", None) == "_tracked_cancel_unstarted_cleanup"
+
+
+def test_slot_is_released_even_if_closing_the_body_raises(monkeypatch):
+    # A slot lost here never comes back: with no queue timeout the pool silently
+    # shrinks and later callers wait forever, so the release must not sit behind
+    # anything that can throw.
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _boom(iterator, *, cancelled):
+        raise RuntimeError("close failed")
+
+    monkeypatch.setattr(inf_mod, "_close_openai_admitted_stream_iterator", _boom)
+
+    async def _run():
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        body = response.body_iterator
+        await asyncio.wait_for(body.__anext__(), timeout = 2)  # stream started
+        assert _snapshot().active == 1
+
+        with pytest.raises(RuntimeError):
+            await body.aclose()
+
+        assert _snapshot().active == 0  # slot returned despite the failure
+        # And the pool still serves the next caller.
+        again = get_llama_admission_queue(_KEY).reserve(capacity = 1, config = LlamaAdmissionConfig())
+        lease = again.lease_nowait()
+        assert lease is not None
+        lease.release()
+
+    asyncio.run(_run())
+
+
+_CLIENT_TOOLS = [
+    {"name": "get_time", "description": "t", "input_schema": {"type": "object", "properties": {}}}
+]
+
+
+def _passthrough_payload(**fields):
+    # server_tools off + declared tools + a passthrough-capable backend routes
+    # anthropic_messages down the client-tool passthrough dispatch site.
+    return _payload(tools = _CLIENT_TOOLS, enable_tools = False, **fields)
+
+
+def test_response_pre_start_cleanup_leaves_no_passthrough_tracker(monkeypatch):
+    """A disconnect before the body starts must leave no tracker and no slot.
+
+    The passthrough registers from inside its body rather than eagerly, so a
+    generator that never runs registers nothing; the hook still has to hand the
+    admission slot back. Asserting through _CANCEL_REGISTRY and the pool rather
+    than the wiring, because the hook can be present and still be a no-op.
+    """
+    backend = _install_backend(monkeypatch, slots = 1)
+    backend.supports_tool_passthrough = True
+    monkeypatch.setattr(inf_mod, "_CANCEL_REGISTRY", {})
+
+    async def _run():
+        response = await anthropic_messages(
+            _passthrough_payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        assert inf_mod._CANCEL_REGISTRY == {}, "nothing runs the body's exit for it yet"
+
+        cleanup = getattr(response, "_unstarted_cleanup", None)
+        assert cleanup is not None
+        await cleanup()  # what _SameTaskStreamingResponse runs on a pre-start disconnect
+
+        assert inf_mod._CANCEL_REGISTRY == {}
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_passthrough_dispatch_site_reserves_and_releases(monkeypatch):
+    # Behavioural cover for a dispatch site the other tests never reach.
+    backend = _install_backend(monkeypatch, slots = 1)
+    backend.supports_tool_passthrough = True
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        task = asyncio.create_task(
+            anthropic_messages(_passthrough_payload(), request = _Request(), current_subject = "t")
+        )
+        await asyncio.sleep(0.1)
+        assert _snapshot().queued == 1  # queued behind the busy slot, not bypassing
+        for lease in held:
+            lease.release()
+        with contextlib.suppress(Exception):
+            await asyncio.wait_for(task, timeout = 2)  # upstream is not mocked
+        assert _snapshot().active == 0 and _snapshot().queued == 0
+
+    asyncio.run(_run())
+
+
+def test_stream_setup_failure_returns_the_slot(monkeypatch):
+    # count_chat_tokens makes a blocking HTTP call to llama-server, so a dead
+    # server raises here: after lease_nowait() took the slot, before a body
+    # exists to release it. Nothing else can hand the slot back.
+    def _boom(*_a, **_k):
+        raise RuntimeError("tokenizer unreachable")
+
+    _install_backend(monkeypatch, slots = 1, count_tokens = _boom)
+
+    async def _run():
+        with pytest.raises(RuntimeError):
+            await anthropic_messages(_payload(stream = True), request = _Request(), current_subject = "t")
+        snap = _snapshot()
+        assert snap.active == 0, f"slot leaked after stream setup failed: {snap}"
+        # And the pool still serves the next caller.
+        again = get_llama_admission_queue(_KEY).reserve(capacity = 1, config = LlamaAdmissionConfig())
+        assert again.lease_nowait() is not None
+
+    asyncio.run(_run())
+
+
+def test_queued_non_stream_cancel_does_not_leak_a_coroutine(monkeypatch):
+    # The non-stream path builds the generation coroutine before reserving and
+    # only awaits it once admitted. Giving up while queued must close it.
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)
+        task = asyncio.create_task(
+            anthropic_messages(_payload(), request = _Request(), current_subject = "t")
+        )
+        await asyncio.sleep(0.1)
+        assert _snapshot().queued == 1
+        task.cancel()
+        with contextlib.suppress(asyncio.CancelledError):
+            await task
+        for lease in held:
+            lease.release()
+
+    with warnings.catch_warnings(record = True) as caught:
+        warnings.simplefilter("always")
+        asyncio.run(_run())
+        gc.collect()
+    leaked = [w for w in caught if "never awaited" in str(w.message)]
+    assert not leaked, [str(w.message) for w in leaked]
+
+
+def test_stream_timeout_marks_the_monitor_entry_as_error(monkeypatch):
+    # The finally finishes the entry as "cancelled"; without the fail() first, a
+    # timed-out request is indistinguishable from a client hang-up in the
+    # monitor. api_monitor.finish is a no-op on an already terminal entry.
+    monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "0.15")
+    monkeypatch.setenv(ADMISSION_KEEPALIVE_INTERVAL_ENV, "0.05")
+    _install_backend(monkeypatch, slots = 1)
+
+    async def _run():
+        held = _occupy(_KEY, 1, 1)  # never released, so the waiter times out
+        response = await anthropic_messages(
+            _payload(stream = True), request = _Request(), current_subject = "t"
+        )
+        async for _ in response.body_iterator:
+            pass
+        entries = inf_mod.api_monitor.snapshot()
+        assert entries and entries[0]["status"] == "error", entries
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+class _RespawnBackend:
+    """Backend whose base_url moves to a new port once respawned."""
+
+    def __init__(
+        self,
+        *,
+        mtp_handled = False,
+        fallback_in_progress = False,
+    ):
+        self.base_url = "http://127.0.0.1:57953"
+        self.context_length = 4096
+        self.respawn_calls = 0
+        self._mtp_handled = mtp_handled
+        self._mtp_runtime_fallback_in_progress = fallback_in_progress
+
+    def count_chat_tokens(self, *_a, **_k):
+        return 2
+
+    def _maybe_recover_from_mtp_crash(self, _exc):
+        return self._mtp_handled
+
+    def _respawn_if_dead(self):
+        self.respawn_calls += 1
+        self.base_url = "http://127.0.0.1:62933"
+        return True
+
+
+def test_retry_url_stands_down_while_an_mtp_fallback_is_reloading():
+    # Only the first caller gets True from _maybe_recover_from_mtp_crash; the rest
+    # see False and must still stand down, or they respawn the same MTP config
+    # underneath the fallback already reloading without it.
+    backend = _RespawnBackend(mtp_handled = False, fallback_in_progress = True)
+
+    url = asyncio.run(_anthropic_passthrough_retry_url(backend, httpx.ConnectError("x")))
+
+    assert url is None
+    assert backend.respawn_calls == 0
+
+
+class _PtRequest:
+    async def is_disconnected(self):
+        return False
+
+
+async def _passthrough_response(backend):
+    return await _anthropic_passthrough_stream(
+        _PtRequest(),
+        threading.Event(),
+        backend,
+        [{"role": "user", "content": "hi"}],
+        [],
+        0.7,
+        0.95,
+        20,
+        16,
+        "msg_tracker_probe",
+        "test-model",
+    )
+
+
+def test_disconnect_during_the_opening_lines_exits_the_tracker():
+    # Suspended inside emitter.start()'s yields the generator has not reached the
+    # try/finally that exits the tracker, so those yields need their own.
+    backend = _RespawnBackend()
+
+    async def _run():
+        response = await _passthrough_response(backend)
+        body = response.body_iterator
+        await asyncio.wait_for(body.__anext__(), timeout = 2)  # first start line
+        assert inf_mod._CANCEL_REGISTRY, "tracker should be registered"
+        await body.aclose()
+        assert inf_mod._CANCEL_REGISTRY == {}, "tracker leaked"
+
+    asyncio.run(_run())
+
+
+def test_cancel_during_the_opening_lines_exits_the_tracker():
+    # Same window, delivered the way _SameTaskStreamingResponse delivers it.
+    backend = _RespawnBackend()
+
+    async def _run():
+        response = await _passthrough_response(backend)
+        body = response.body_iterator
+        await asyncio.wait_for(body.__anext__(), timeout = 2)
+        assert inf_mod._CANCEL_REGISTRY, "tracker should be registered"
+        with pytest.raises(asyncio.CancelledError):
+            await body.athrow(asyncio.CancelledError())
+        assert inf_mod._CANCEL_REGISTRY == {}, "tracker leaked"
+
+    asyncio.run(_run())
diff --git a/studio/backend/tests/test_anthropic_messages.py b/studio/backend/tests/test_anthropic_messages.py
index 621ac9aaca..9c6bf5f8aa 100644
--- a/studio/backend/tests/test_anthropic_messages.py
+++ b/studio/backend/tests/test_anthropic_messages.py
@@ -28,6 +28,7 @@ from models.inference import (
 )
 from core.inference.anthropic_compat import (
     anthropic_messages_to_openai,
+    anthropic_schema_client_tool_kind,
     anthropic_tools_to_openai,
     build_anthropic_sse_event,
     AnthropicStreamEmitter,
@@ -626,6 +627,41 @@ class TestAnthropicToolsToOpenAI:
         ]
         assert anthropic_tools_to_openai(tools) == []
 
+    @pytest.mark.parametrize(
+        ("type_", "name", "kind"),
+        [
+            ("bash_20250124", "bash", "bash"),
+            ("text_editor_20250728", "str_replace_based_edit_tool", "text_editor"),
+            ("computer_20251124", "computer", "computer"),
+            ("memory_20250818", "memory", "memory"),
+        ],
+    )
+    def test_schema_client_tools_are_converted_to_openai_functions(self, type_, name, kind):
+        tool = {"type": type_, "name": name}
+
+        [result] = anthropic_tools_to_openai([tool])
+
+        assert anthropic_schema_client_tool_kind(tool) == kind
+        assert result["function"]["name"] == name
+        assert result["function"]["parameters"]["type"] == "object"
+
+    @pytest.mark.parametrize(
+        ("type_", "supports_undo"),
+        [
+            ("text_editor_20241022", True),
+            ("text_editor_20250124", True),
+            ("text_editor_20250429", False),
+            ("text_editor_20250728", False),
+        ],
+    )
+    def test_text_editor_commands_follow_tool_version(self, type_, supports_undo):
+        [result] = anthropic_tools_to_openai(
+            [{"type": type_, "name": "str_replace_based_edit_tool"}]
+        )
+
+        commands = result["function"]["parameters"]["properties"]["command"]["enum"]
+        assert ("undo_edit" in commands) is supports_undo
+
     def test_server_tool_selection_merges_enabled_tools_extension(self):
         all_tools = [
             {"type": "function", "function": {"name": "web_search"}},
@@ -1523,6 +1559,17 @@ def _reset_policy():
     reset_tool_policy()
 
 
+@pytest.fixture(autouse = True)
+def _reset_admission_queues():
+    # The admission queue is process-global; isolate the shared "llama-server" key
+    # so one test's leftover reservation can't stall the next.
+    from core.inference.llama_admission import reset_llama_admission_queues
+
+    reset_llama_admission_queues()
+    yield
+    reset_llama_admission_queues()
+
+
 class TestAnthropicMessagesToolRouting:
     class _Request:
         state = SimpleNamespace()
@@ -1724,6 +1771,116 @@ class TestAnthropicMessagesToolRouting:
         assert exc.value.status_code == 400
         assert "Mixing Anthropic server tools" in exc.value.detail
 
+    def test_explicit_server_loop_and_client_tools_rejected_with_400(self, monkeypatch):
+        _mock_backend(monkeypatch)
+        payload = _basic_payload(
+            enable_tools = True,
+            tools = [{"name": "Write", "input_schema": {"type": "object"}}],
+        )
+
+        with pytest.raises(HTTPException) as exc:
+            _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+        assert exc.value.status_code == 400
+        assert "Mixing Anthropic server tools" in exc.value.detail
+
+    def test_explicit_server_loop_and_schema_client_tools_rejected_with_400(self, monkeypatch):
+        _mock_backend(monkeypatch)
+        payload = _basic_payload(
+            enable_tools = True,
+            tools = [{"type": "bash_20250124", "name": "bash"}],
+        )
+
+        with pytest.raises(HTTPException) as exc:
+            _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+        assert exc.value.status_code == 400
+        assert "Mixing Anthropic server tools" in exc.value.detail
+
+    def test_process_tool_policy_does_not_steal_schema_client_tools(self, monkeypatch):
+        import routes.inference as inf_mod
+        from fastapi.responses import JSONResponse
+
+        backend = _mock_backend(monkeypatch)
+        captured = {}
+
+        async def _passthrough(*args, **kwargs):
+            captured["tools"] = args[2]
+            return JSONResponse(
+                {
+                    "id": "msg_test",
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [{"type": "text", "text": "ok"}],
+                    "model": "test-model",
+                    "stop_reason": "end_turn",
+                    "stop_sequence": None,
+                    "usage": {"input_tokens": 1, "output_tokens": 1},
+                }
+            )
+
+        monkeypatch.setattr(inf_mod, "_anthropic_passthrough_non_streaming", _passthrough)
+        set_tool_policy(True)
+        payload = _basic_payload(tools = [{"type": "bash_20250124", "name": "bash"}])
+
+        _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+
+        assert backend.calls == []
+        assert captured["tools"][0]["function"]["name"] == "bash"
+
+    @pytest.mark.parametrize("permission_mode", [None, "ask"])
+    @pytest.mark.parametrize(
+        ("tool_policy", "enable_tools"),
+        [(True, None), (False, True)],
+    )
+    def test_process_tool_policy_does_not_steal_client_tools(
+        self, monkeypatch, permission_mode, tool_policy, enable_tools
+    ):
+        """A server-wide tool default must not replace Claude Code's own tools."""
+        import routes.inference as inf_mod
+        from fastapi.responses import JSONResponse
+
+        backend = _mock_backend(monkeypatch)
+        captured = {}
+
+        async def _passthrough(*args, **kwargs):
+            captured["tools"] = args[2]
+            return JSONResponse(
+                {
+                    "id": "msg_test",
+                    "type": "message",
+                    "role": "assistant",
+                    "content": [{"type": "text", "text": "ok"}],
+                    "model": "test-model",
+                    "stop_reason": "end_turn",
+                    "stop_sequence": None,
+                    "usage": {"input_tokens": 1, "output_tokens": 1},
+                }
+            )
+
+        monkeypatch.setattr(inf_mod, "_anthropic_passthrough_non_streaming", _passthrough)
+        set_tool_policy(tool_policy)
+        fields = {
+            "tools": [
+                {
+                    "name": "Write",
+                    "description": "Write a file",
+                    "input_schema": {
+                        "type": "object",
+                        "properties": {"path": {"type": "string"}},
+                    },
+                }
+            ],
+        }
+        if enable_tools is not None:
+            fields["enable_tools"] = enable_tools
+        if permission_mode is not None:
+            fields["permission_mode"] = permission_mode
+        payload = _basic_payload(**fields)
+
+        _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+
+        assert backend.calls == []
+        assert captured["tools"][0]["function"]["name"] == "Write"
+
     def test_mixed_rejected_when_client_tool_name_collides_with_server_alias(self, monkeypatch):
         # Regression: a client tool sharing a name with a mapped server tool
         # (e.g. a custom "web_search") must still trigger the mixed-mode 400;
@@ -1769,6 +1926,15 @@ class TestAnthropicMessagesToolRouting:
         assert exc.value.status_code == 400
         assert "name" in exc.value.detail
 
+    def test_schema_client_tool_missing_name_rejected_with_400(self, monkeypatch):
+        _mock_backend(monkeypatch)
+        payload = _basic_payload(tools = [{"type": "bash_20250124"}])
+
+        with pytest.raises(HTTPException) as exc:
+            _drive(anthropic_messages(payload, request = None, current_subject = "t"))
+        assert exc.value.status_code == 400
+        assert "name" in exc.value.detail
+
     def test_client_tool_empty_name_rejected_with_400(self, monkeypatch):
         # Same silent-disable class as missing-name: `name: ""` passes the
         # isinstance check but is dropped by anthropic_tools_to_openai's
diff --git a/studio/backend/tests/test_anthropic_passthrough_respawn.py b/studio/backend/tests/test_anthropic_passthrough_respawn.py
new file mode 100644
index 0000000000..daa30e39c2
--- /dev/null
+++ b/studio/backend/tests/test_anthropic_passthrough_respawn.py
@@ -0,0 +1,266 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Restart survival for the Anthropic /v1/messages passthrough.
+
+A crashed llama-server relaunches on a NEW ephemeral port. Before the retry the
+passthrough kept posting to the dead port, so a Claude Code session stayed broken
+until the next explicit load. These cover the respawn-and-retry on both the
+streaming and non-streaming passthroughs.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import sys
+import threading
+from types import SimpleNamespace
+
+import httpx
+import pytest
+
+_backend = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, _backend)
+
+import routes.inference as inf_mod
+from routes.inference import (
+    _anthropic_passthrough_non_streaming,
+    _anthropic_passthrough_retry_url,
+    _anthropic_passthrough_stream,
+)
+
+_DEAD = "http://127.0.0.1:57953"
+_FRESH = "http://127.0.0.1:62933"
+
+
+class _Backend:
+    """Stub llama backend whose base_url moves to a new port once respawned."""
+
+    def __init__(
+        self,
+        *,
+        respawn_ok = True,
+        mtp_handled = False,
+    ):
+        self.base_url = _DEAD
+        self.context_length = 4096
+        self.respawn_calls = 0
+        self.mtp_calls = 0
+        self._respawn_ok = respawn_ok
+        self._mtp_handled = mtp_handled
+
+    def count_chat_tokens(self, *_args, **_kwargs):
+        return 2
+
+    def _maybe_recover_from_mtp_crash(self, _exc):
+        self.mtp_calls += 1
+        return self._mtp_handled
+
+    def _respawn_if_dead(self):
+        self.respawn_calls += 1
+        if not self._respawn_ok:
+            return False
+        self.base_url = _FRESH
+        return True
+
+
+class _Request:
+    async def is_disconnected(self):
+        return False
+
+
+class _FakeNonStreamingClient:
+    def __init__(self):
+        self.urls = []
+        self.closed = False
+
+    async def aclose(self):
+        self.closed = True
+
+    async def post(self, url, **_kwargs):
+        self.urls.append(url)
+        if url.startswith(_DEAD):
+            raise httpx.ConnectError("connection refused")
+        return httpx.Response(
+            200,
+            json = {
+                "choices": [{"message": {"content": "ok"}, "finish_reason": "stop"}],
+                "usage": {"prompt_tokens": 2, "completion_tokens": 1},
+            },
+        )
+
+
+def _install_stream_transport(monkeypatch, calls):
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls.append(str(request.url))
+        if str(request.url).startswith(_DEAD):
+            raise httpx.ConnectError("connection refused")
+        content = (
+            f"data: {json.dumps({'choices': [{'delta': {'content': 'hi'}}]})}\n\n"
+            "data: [DONE]\n\n"
+        )
+        return httpx.Response(
+            200,
+            content = content.encode(),
+            headers = {"content-type": "text/event-stream"},
+        )
+
+    transport = httpx.MockTransport(handler)
+    real_client = httpx.AsyncClient
+
+    def _client(*_args, **kwargs):
+        return real_client(transport = transport, timeout = kwargs.get("timeout", 600))
+
+    monkeypatch.setattr(inf_mod.httpx, "AsyncClient", _client)
+
+
+async def _run_stream(backend):
+    response = await _anthropic_passthrough_stream(
+        _Request(),
+        threading.Event(),
+        backend,
+        [{"role": "user", "content": "hi"}],
+        [],
+        0.7,
+        0.95,
+        20,
+        16,
+        "msg_1",
+        "test-model",
+    )
+    chunks = []
+    async for chunk in response.body_iterator:
+        chunks.append(chunk.decode() if isinstance(chunk, (bytes, bytearray)) else chunk)
+    return "".join(chunks)
+
+
+async def _run_non_streaming(backend):
+    return await _anthropic_passthrough_non_streaming(
+        backend,
+        [{"role": "user", "content": "hi"}],
+        [],
+        0.7,
+        0.95,
+        20,
+        16,
+        "msg_1",
+        "test-model",
+    )
+
+
+# ── Helper ────────────────────────────────────────────────────
+
+
+def test_retry_url_rebuilds_from_the_respawned_base_url():
+    backend = _Backend()
+
+    url = asyncio.run(_anthropic_passthrough_retry_url(backend, httpx.ConnectError("x")))
+
+    assert url == f"{_FRESH}/v1/chat/completions"
+    assert backend.respawn_calls == 1
+
+
+def test_retry_url_is_none_when_nothing_respawned():
+    backend = _Backend(respawn_ok = False)
+
+    url = asyncio.run(_anthropic_passthrough_retry_url(backend, httpx.ConnectError("x")))
+
+    assert url is None
+
+
+def test_retry_url_defers_to_the_mtp_crash_recovery():
+    # An MTP+tensor crash schedules its own reload; retrying would race it.
+    backend = _Backend(mtp_handled = True)
+
+    url = asyncio.run(_anthropic_passthrough_retry_url(backend, httpx.ConnectError("x")))
+
+    assert url is None
+    assert backend.respawn_calls == 0
+
+
+def test_retry_url_tolerates_a_backend_without_respawn_hooks():
+    backend = SimpleNamespace(base_url = _DEAD)
+
+    url = asyncio.run(_anthropic_passthrough_retry_url(backend, httpx.ConnectError("x")))
+
+    assert url is None
+
+
+# ── Non-streaming ─────────────────────────────────────────────
+
+
+def test_non_streaming_retries_against_the_new_port(monkeypatch):
+    client = _FakeNonStreamingClient()
+    monkeypatch.setattr(inf_mod, "_cancelable_nonstreaming_client", lambda: client)
+    backend = _Backend()
+
+    response = asyncio.run(_run_non_streaming(backend))
+
+    assert response.status_code == 200
+    assert backend.respawn_calls == 1
+    assert client.urls == [f"{_DEAD}/v1/chat/completions", f"{_FRESH}/v1/chat/completions"]
+
+
+def test_non_streaming_raises_when_the_server_stays_dead(monkeypatch):
+    client = _FakeNonStreamingClient()
+    monkeypatch.setattr(inf_mod, "_cancelable_nonstreaming_client", lambda: client)
+    backend = _Backend(respawn_ok = False)
+
+    with pytest.raises(httpx.ConnectError):
+        asyncio.run(_run_non_streaming(backend))
+
+    assert client.urls == [f"{_DEAD}/v1/chat/completions"]  # no blind retry
+
+
+def test_non_streaming_does_not_retry_an_mtp_crash(monkeypatch):
+    client = _FakeNonStreamingClient()
+    monkeypatch.setattr(inf_mod, "_cancelable_nonstreaming_client", lambda: client)
+    backend = _Backend(mtp_handled = True)
+
+    with pytest.raises(httpx.ConnectError):
+        asyncio.run(_run_non_streaming(backend))
+
+    assert backend.respawn_calls == 0
+
+
+# ── Streaming ─────────────────────────────────────────────────
+
+
+def test_streaming_retries_against_the_new_port(monkeypatch):
+    calls = []
+    _install_stream_transport(monkeypatch, calls)
+    backend = _Backend()
+
+    blob = asyncio.run(_run_stream(backend))
+
+    assert backend.respawn_calls == 1
+    assert calls == [f"{_DEAD}/v1/chat/completions", f"{_FRESH}/v1/chat/completions"]
+    # The retried stream really produced the turn, not just a clean-looking stop.
+    assert "event: message_start" in blob
+    assert "event: message_stop" in blob
+    assert "hi" in blob
+
+
+def test_streaming_emits_an_error_event_when_the_server_stays_dead(monkeypatch):
+    calls = []
+    _install_stream_transport(monkeypatch, calls)
+    backend = _Backend(respawn_ok = False)
+
+    blob = asyncio.run(_run_stream(backend))
+
+    assert calls == [f"{_DEAD}/v1/chat/completions"]  # no blind retry
+    assert "event: error" in blob
+
+
+def test_streaming_does_not_retry_an_mtp_crash(monkeypatch):
+    calls = []
+    _install_stream_transport(monkeypatch, calls)
+    backend = _Backend(mtp_handled = True)
+
+    blob = asyncio.run(_run_stream(backend))
+
+    assert backend.respawn_calls == 0
+    assert calls == [f"{_DEAD}/v1/chat/completions"]
+    assert "event: error" in blob
diff --git a/studio/backend/tests/test_api_monitor.py b/studio/backend/tests/test_api_monitor.py
index 56bc404350..4602b5cf62 100644
--- a/studio/backend/tests/test_api_monitor.py
+++ b/studio/backend/tests/test_api_monitor.py
@@ -258,3 +258,157 @@ def test_api_monitor_append_reply_exact_cap_then_more_marks_truncated():
     monitor.append_reply(entry_id, "y")
     reply = monitor.snapshot()[0]["reply"]
     assert len(reply) == m._MAX_REPLY_CHARS and reply.endswith("...")
+
+
+def test_api_monitor_disabled_is_noop():
+    monitor = ApiMonitor(max_entries = 3, enabled = False)
+
+    request_id = monitor.start(
+        endpoint = "/v1/chat/completions",
+        method = "POST",
+        model = "local-model",
+        prompt = "user: hello",
+        context_length = 100,
+    )
+    load_id = monitor.record_lifecycle(
+        event = "load",
+        model = "local-model",
+        running = True,
+    )
+    unload_id = monitor.record_lifecycle(
+        event = "unload",
+        model = "local-model",
+    )
+    assert request_id == load_id == unload_id == ""
+
+    # Every mutator must be a safe no-op on the falsy id.
+    monitor.append_reply(request_id, "hi")
+    monitor.set_reply(request_id, "hi")
+    monitor.set_usage(request_id, prompt_tokens = 4, completion_tokens = 6)
+    monitor.relabel(load_id, "renamed-model")
+    monitor.set_progress(load_id, 50)
+    monitor.finish(load_id)
+    monitor.fail_open(load_id, "boom")
+    monitor.fail(request_id, "boom")
+    monitor.discard(unload_id)
+
+    assert monitor.snapshot() == []
+    assert monitor.active_count() == 0
+    assert monitor.get(request_id) is None
+
+
+def test_api_monitor_disable_env_var_truthy(monkeypatch):
+    import core.inference.api_monitor as m
+    for value in ("1", "true", "yes", "on", "TRUE", "On", " yes "):
+        monkeypatch.setenv(m._DISABLE_ENV, value)
+        assert m._api_monitor_disabled() is True, value
+
+
+def test_api_monitor_disable_env_var_falsy(monkeypatch):
+    import core.inference.api_monitor as m
+    for value in ("", "0", "false", "no", "off", "disabled"):
+        monkeypatch.setenv(m._DISABLE_ENV, value)
+        assert m._api_monitor_disabled() is False, value
+
+
+def test_api_monitor_disable_env_var_unset(monkeypatch):
+    import core.inference.api_monitor as m
+    monkeypatch.delenv(m._DISABLE_ENV, raising = False)
+    assert m._api_monitor_disabled() is False
+
+
+# ── model lifecycle rows (load / unload) ────────────────────────────
+
+
+def test_lifecycle_load_row_opens_running_then_closes():
+    monitor = ApiMonitor(max_entries = 5)
+    event_id = monitor.record_lifecycle(event = "load", model = "org/A-GGUF", running = True)
+    row = monitor.snapshot()[0]
+    assert row["kind"] == "lifecycle" and row["event"] == "load"
+    assert row["status"] == "running" and row["duration_ms"] is None
+    # A load in progress is not an in-flight API request.
+    assert monitor.active_count() == 0
+
+    monitor.relabel(event_id, "org/A-GGUF:Q4_K_M")
+    monitor.finish(event_id)
+    row = monitor.snapshot()[0]
+    assert row["status"] == "completed"
+    assert row["model"] == "org/A-GGUF:Q4_K_M"
+    assert row["duration_ms"] is not None
+
+
+def test_lifecycle_unload_row_is_terminal_on_arrival():
+    monitor = ApiMonitor(max_entries = 5)
+    monitor.record_lifecycle(event = "unload", model = "org/A-GGUF", reason = "idle")
+    row = monitor.snapshot()[0]
+    assert row["status"] == "completed"
+    assert (row["event"], row["reason"]) == ("unload", "idle")
+    assert monitor.active_count() == 0
+
+
+def test_lifecycle_rows_are_visible_to_every_subject():
+    # A load is server-wide, so it must not vanish for other API keys like a request does.
+    monitor = ApiMonitor(max_entries = 5)
+    monitor.start(
+        endpoint = "/v1/chat/completions",
+        method = "POST",
+        model = "m",
+        prompt = "hi",
+        subject = "alice",
+    )
+    event_id = monitor.record_lifecycle(event = "unload", model = "org/A-GGUF")
+
+    bob = monitor.snapshot(subject = "bob")
+    assert [r["kind"] for r in bob] == ["lifecycle"]
+    assert monitor.get(event_id, subject = "bob") is not None
+    assert len(monitor.snapshot(subject = "alice")) == 2
+
+
+def test_request_rows_stay_private_to_their_subject():
+    monitor = ApiMonitor(max_entries = 5)
+    rid = monitor.start(
+        endpoint = "/v1/chat/completions",
+        method = "POST",
+        model = "m",
+        prompt = "hi",
+        subject = "alice",
+    )
+    assert monitor.snapshot(subject = "bob") == []
+    assert monitor.get(rid, subject = "bob") is None
+
+
+def test_discard_drops_a_row_that_never_happened():
+    # A load that found the model already resident must leave no trace.
+    monitor = ApiMonitor(max_entries = 5)
+    event_id = monitor.record_lifecycle(event = "load", model = "org/A-GGUF", running = True)
+    monitor.discard(event_id)
+    assert monitor.snapshot() == []
+    monitor.discard(event_id)  # idempotent
+
+
+def test_fail_open_never_touches_a_finished_row():
+    # Called from a finally, so it must not stamp an error onto a load that succeeded.
+    monitor = ApiMonitor(max_entries = 5)
+    event_id = monitor.record_lifecycle(event = "load", model = "org/A-GGUF", running = True)
+    monitor.finish(event_id)
+    monitor.fail_open(event_id, "Load did not complete")
+    row = monitor.snapshot()[0]
+    assert row["status"] == "completed" and row["error"] is None
+
+    still_open = monitor.record_lifecycle(event = "load", model = "org/B-GGUF", running = True)
+    monitor.fail_open(still_open, "Load did not complete")
+    assert monitor.snapshot()[0]["status"] == "error"
+
+
+def test_lifecycle_rows_share_the_retention_budget():
+    monitor = ApiMonitor(max_entries = 2)
+    for i in range(4):
+        monitor.record_lifecycle(event = "unload", model = f"org/M{i}")
+    models = [r["model"] for r in monitor.snapshot()]
+    assert models == ["org/M3", "org/M2"]
+
+
+def test_request_rows_report_kind_request():
+    monitor = ApiMonitor(max_entries = 2)
+    monitor.start(endpoint = "/v1/chat/completions", method = "POST", model = "m", prompt = "hi")
+    assert monitor.snapshot()[0]["kind"] == "request"
diff --git a/studio/backend/tests/test_chat_template_tool_arguments.py b/studio/backend/tests/test_chat_template_tool_arguments.py
index 13d1ecabaa..8a927ea93c 100644
--- a/studio/backend/tests/test_chat_template_tool_arguments.py
+++ b/studio/backend/tests/test_chat_template_tool_arguments.py
@@ -6,10 +6,14 @@ from the OpenAI JSON-string form to a dict before rendering. Strict tool
 templates (e.g. mlx-community Qwen3.5 checkpoints) iterate arguments.items() and
 raise "Can only get item pairs from a mapping." on the string form when a prior
 tool call is re-rendered on the next turn (MLX + transformers paths).
+
+It must likewise split parallel tool calls for templates that render only one
+call per message (Llama 3.x).
 """
 
 from __future__ import annotations
 
+import json
 import sys
 from pathlib import Path
 
@@ -21,6 +25,7 @@ if str(_BACKEND) not in sys.path:
 
 from core.inference.chat_template_helpers import (  # noqa: E402
     _normalize_tool_call_arguments,
+    _split_parallel_tool_calls,
     apply_chat_template_for_generation,
 )
 
@@ -155,3 +160,152 @@ def test_unrelated_template_error_still_propagates_with_dict_args():
 
     with pytest.raises(ValueError, match = "broken"):
         apply_chat_template_for_generation(_AlwaysRaises(), _conv({"query": "x"}))
+
+
+def _parallel_conv(
+    *,
+    ids = ("c1", "c2"),
+    results_have_ids = True,
+    content = "sure",
+):
+    a, b = ids
+    return [
+        {"role": "user", "content": "search then render"},
+        {
+            "role": "assistant",
+            "content": content,
+            "tool_calls": [
+                {
+                    "type": "function",
+                    "id": a,
+                    "function": {"name": "web_search", "arguments": {"query": "x"}},
+                },
+                {
+                    "type": "function",
+                    "id": b,
+                    "function": {"name": "render_html", "arguments": {"html": "<canvas>"}},
+                },
+            ],
+        },
+        {
+            "role": "tool",
+            "name": "web_search",
+            **({"tool_call_id": a} if results_have_ids else {}),
+            "content": "no text",
+        },
+        {
+            "role": "tool",
+            "name": "render_html",
+            **({"tool_call_id": b} if results_have_ids else {}),
+            "content": "ok",
+        },
+    ]
+
+
+class _SingleToolCallTokenizer:
+    """Mimics the Llama 3.x template: rejects >1 call per message."""
+
+    def apply_chat_template(
+        self,
+        messages,
+        *,
+        tokenize = False,
+        add_generation_prompt = True,
+        **kw,
+    ):
+        for msg in messages:
+            if len(msg.get("tool_calls") or ()) > 1:
+                raise ValueError("This model only supports single tool-calls at once!")
+        return "RENDERED"
+
+
+def test_parallel_calls_split_into_sequential_single_call_turns():
+    out = _split_parallel_tool_calls(_parallel_conv())
+    assert [(m["role"], m.get("name")) for m in out] == [
+        ("user", None),
+        ("assistant", None),
+        ("tool", "web_search"),
+        ("assistant", None),
+        ("tool", "render_html"),
+    ]
+    assert [len(m["tool_calls"]) for m in out if m.get("tool_calls")] == [1, 1]
+    assert out[1]["tool_calls"][0]["function"]["name"] == "web_search"
+    assert out[3]["tool_calls"][0]["function"]["name"] == "render_html"
+
+
+def test_split_pairs_results_by_tool_call_id_not_position():
+    conv = _parallel_conv()
+    conv[2], conv[3] = conv[3], conv[2]  # results arrive out of order
+    out = _split_parallel_tool_calls(conv)
+    assert out[1]["tool_calls"][0]["id"] == "c1" and out[2]["tool_call_id"] == "c1"
+    assert out[3]["tool_calls"][0]["id"] == "c2" and out[4]["tool_call_id"] == "c2"
+
+
+def test_split_falls_back_to_order_when_results_have_no_ids():
+    out = _split_parallel_tool_calls(_parallel_conv(results_have_ids = False))
+    assert [m["role"] for m in out] == ["user", "assistant", "tool", "assistant", "tool"]
+    assert out[2]["name"] == "web_search" and out[4]["name"] == "render_html"
+
+
+def test_split_keeps_content_on_first_piece_only():
+    out = _split_parallel_tool_calls(_parallel_conv(content = "sure"))
+    assert out[1]["content"] == "sure"
+    assert out[3]["content"] == ""
+
+
+def test_split_keeps_unmatched_results_after_the_split():
+    conv = _parallel_conv()
+    del conv[3]  # second call never returned a result
+    out = _split_parallel_tool_calls(conv)
+    assert [m["role"] for m in out] == ["user", "assistant", "tool", "assistant"]
+
+
+def test_split_leaves_later_turns_intact():
+    conv = _parallel_conv() + [
+        {"role": "assistant", "content": "done"},
+        {"role": "user", "content": "thanks"},
+    ]
+    out = _split_parallel_tool_calls(conv)
+    assert [m["role"] for m in out[-2:]] == ["assistant", "user"]
+    assert out[-2]["content"] == "done"
+
+
+def test_single_call_and_plain_conversations_pass_through_unchanged():
+    conv = _conv({"query": "x"})
+    assert _split_parallel_tool_calls(conv) is conv
+    plain = [{"role": "user", "content": "hi"}]
+    assert _split_parallel_tool_calls(plain) is plain
+
+
+def test_render_succeeds_on_single_call_template_with_parallel_calls():
+    # Regression: two calls in one turn used to break every later render.
+    result = apply_chat_template_for_generation(_SingleToolCallTokenizer(), _parallel_conv())
+    assert result == "RENDERED"
+
+
+def test_string_arguments_and_parallel_calls_are_repaired_together():
+    conv = _parallel_conv()
+    for call in conv[1]["tool_calls"]:
+        call["function"]["arguments"] = json.dumps(call["function"]["arguments"])
+
+    class _StrictAndSingleCall(_SingleToolCallTokenizer):
+        def apply_chat_template(self, messages, **kw):
+            for msg in messages:
+                for call in msg.get("tool_calls", []) or []:
+                    if isinstance(call.get("function", {}).get("arguments"), str):
+                        raise TypeError("Can only get item pairs from a mapping.")
+            return super().apply_chat_template(messages, **kw)
+
+    assert apply_chat_template_for_generation(_StrictAndSingleCall(), conv) == "RENDERED"
+
+
+def test_lenient_template_never_sees_a_split_conversation():
+    seen = {}
+
+    class _Lenient:
+        def apply_chat_template(self, messages, **kw):
+            seen["n"] = len(messages)
+            return "RENDERED"
+
+    apply_chat_template_for_generation(_Lenient(), _parallel_conv())
+    assert seen["n"] == 4  # unsplit
diff --git a/studio/backend/tests/test_gpu_memory_mode.py b/studio/backend/tests/test_gpu_memory_mode.py
index fdfcbc1610..4259171da9 100644
--- a/studio/backend/tests/test_gpu_memory_mode.py
+++ b/studio/backend/tests/test_gpu_memory_mode.py
@@ -304,12 +304,16 @@ def test_load_request_accepts_valid_tensor_split(good):
 def test_route_normalizes_explicit_extras_before_reload_dedupe():
     route_src = (Path(_BACKEND_DIR) / "routes" / "inference.py").read_text(encoding = "utf-8")
     load_impl = route_src[route_src.index("async def _load_model_impl") :]
+    preserve = load_impl.index("_gpu_layers_override = parse_gpu_layers_override")
+    translate = load_impl.index(
+        'request = request.model_copy(update = {"gpu_layers": _gpu_layers_override})'
+    )
     strip = load_impl.index("_stripped_explicit = strip_shadowing_flags")
     normalize = load_impl.index(
         'request = request.model_copy(update = {"llama_extra_args": extra_llama_args})'
     )
     dedupe = load_impl.index("and _request_matches_loaded_settings(")
-    assert strip < normalize < dedupe
+    assert preserve < translate < strip < normalize < dedupe
 
 
 @pytest.mark.parametrize("model_cls", [LoadResponse, InferenceStatusResponse])
@@ -1048,7 +1052,7 @@ def _rocm_torch_stub(monkeypatch):
 def test_subset_pin_masks_via_rocr_on_rocm(monkeypatch):
     # A GPU-subset pin must exclude the rest at the ROCr/HSA layer: HIP masking
     # still enumerates every agent first, which segfaults the build on an
-    # unsupported deselected GPU (e.g. a gfx1103 iGPU under a gfx110X prebuilt).
+    # unsupported deselected GPU (e.g. a gfx1036 iGPU under a gfx103X prebuilt).
     # ROCR drops it at the driver layer; only one mask is set (HIP cleared).
     _rocm_torch_stub(monkeypatch)
     env = {"HIP_VISIBLE_DEVICES": "9"}  # stale/inherited HIP mask must not survive
diff --git a/studio/backend/tests/test_gpu_selection.py b/studio/backend/tests/test_gpu_selection.py
index 362c751baa..7999eb4f73 100644
--- a/studio/backend/tests/test_gpu_selection.py
+++ b/studio/backend/tests/test_gpu_selection.py
@@ -427,14 +427,16 @@ class TestVisibleGpuUtilization(_GpuCacheResetMixin, unittest.TestCase):
 
         self.assertTrue(result["available"])
         self.assertEqual(result["backend"], "vulkan")
-        self.assertEqual(result["index_kind"], "relative")
+        # ggml Vulkan ordinals are the space `--device Vulkan<i>` pins, so they
+        # are selectable, unlike a torch-xpu relative ordinal.
+        self.assertEqual(result["index_kind"], "vulkan")
         self.assertEqual(result["parent_visible_gpu_ids"], [])
         self.assertEqual(
             result["devices"],
             [
                 {
                     "index": 0,
-                    "index_kind": "relative",
+                    "index_kind": "vulkan",
                     "visible_ordinal": 0,
                     "name": "Vulkan0",
                     "memory_total_gb": 8.0,
diff --git a/studio/backend/tests/test_inference_dispatcher_resilience.py b/studio/backend/tests/test_inference_dispatcher_resilience.py
index 6184496d78..ea903a6ce0 100644
--- a/studio/backend/tests/test_inference_dispatcher_resilience.py
+++ b/studio/backend/tests/test_inference_dispatcher_resilience.py
@@ -39,6 +39,7 @@ def _dispatcher():
     o._dispatcher_stop = threading.Event()
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     return o
 
 
@@ -118,3 +119,68 @@ def test_route_llama_streaming_async_clients_disable_proxy_env():
             kw.arg == "trust_env" and isinstance(kw.value, ast.Constant) and kw.value.value is False
             for kw in call.keywords
         ), f"httpx.AsyncClient at line {call.lineno} must set trust_env=False"
+
+
+def _direct_reader_host():
+    """Orchestrator with only what _direct_reader and the ownership helpers touch."""
+    o = InferenceOrchestrator.__new__(InferenceOrchestrator)
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._direct_mailboxes = {}
+    o._request_cancel_events = {}
+    o._active_cancel_lock = threading.Lock()
+    o._active_cancel_events = []
+    o._executing_cancel_events = []
+    o._dispatcher_thread = None
+    return o
+
+
+def test_rerouting_a_foreign_response_moves_worker_ownership():
+    # A _gen_lock reader already blocked on resp_queue can beat the compare dispatcher to
+    # that request's first response. The compare consumer passes mark_started=False, so if
+    # this path does not promote it nothing does: the direct request stays recorded as the
+    # executor, so the compare chat's Stop is ignored and a late reset from the direct one
+    # cancels the compare generation instead.
+    o = _direct_reader_host()
+    mine, theirs = threading.Event(), threading.Event()
+    o._request_cancel_events = {"mine": mine, "theirs": theirs}
+    o._claim_worker(mine)
+    o._mark_worker_started(mine)
+    o._claim_worker(theirs)
+    compare_mailbox = queue.Queue()
+    o._mailboxes["theirs"] = compare_mailbox
+
+    read_one, _drain, release = _direct_reader_calls(o, "mine")
+    o._scripted = [{"request_id": "theirs", "type": "token", "text": "hi"}]
+
+    assert read_one(timeout = 0.1) is None, "a foreign response is routed, not returned"
+    assert compare_mailbox.get_nowait()["text"] == "hi"
+    assert o._owns_worker(theirs), "the compare request is the one the worker answered"
+    assert not o._owns_worker(mine), "so a late reset from the direct request must not fire"
+    release()
+
+
+def test_rerouting_a_foreign_gen_done_retires_that_request():
+    # The other half of the dispatcher's move: once its last response is routed, the
+    # request no longer owns the worker, or a Stop for it would end whatever starts next.
+    o = _direct_reader_host()
+    mine, theirs = threading.Event(), threading.Event()
+    o._request_cancel_events = {"mine": mine, "theirs": theirs}
+    o._claim_worker(theirs)
+    o._mark_worker_started(theirs)
+    o._claim_worker(mine)
+    o._mailboxes["theirs"] = queue.Queue()
+
+    read_one, _drain, release = _direct_reader_calls(o, "mine")
+    o._scripted = [{"request_id": "theirs", "type": "gen_done"}]
+
+    assert read_one(timeout = 0.1) is None
+    assert not o._owns_worker(theirs), "retired once its last response was routed"
+    assert o._owns_worker(mine), "the next claim takes over"
+    release()
+
+
+def _direct_reader_calls(o, request_id):
+    """_direct_reader wired to a scripted _read_resp (o._scripted, popped in order)."""
+    o._read_resp = lambda timeout = 1.0: o._scripted.pop(0) if o._scripted else None
+    return o._direct_reader(request_id)
diff --git a/studio/backend/tests/test_install_resolve_prebuilt.py b/studio/backend/tests/test_install_resolve_prebuilt.py
index 02ccc68b11..957ef7e574 100644
--- a/studio/backend/tests/test_install_resolve_prebuilt.py
+++ b/studio/backend/tests/test_install_resolve_prebuilt.py
@@ -6,7 +6,9 @@ by default; --published-repo overrides).
 
 These back the in-app update for source-build (markerless) installs: the backend
 asks the installer whether an official prebuilt exists for this host without
-downloading. Network and host detection are stubbed; no GPU or internet needed.
+downloading. Network and host detection are stubbed; no GPU or internet needed. The one
+exception is the windows-rocm floor guard, which reads the fork's published manifest
+because nothing in-tree mirrors it, and skips when that release is unreachable.
 """
 
 from __future__ import annotations
@@ -32,6 +34,18 @@ FORK = ilp.DEFAULT_PUBLISHED_REPO  # unslothai/llama.cpp
 UPSTREAM = ilp.UPSTREAM_REPO  # ggml-org/llama.cpp
 
 
+@pytest.fixture(autouse = True)
+def _no_ambient_hip_device_mask(monkeypatch):
+    """These tests describe hosts through HostInfo, not through the environment.
+
+    A mask inherited from the shell (ML boxes commonly export CUDA_VISIBLE_DEVICES) means
+    the arch probe saw only part of the GPUs, which the Windows auto-Vulkan guard treats as
+    an unknown physical inventory. Clear all three so a host is described by its fields
+    alone; the tests that are about the mask set it explicitly."""
+    for _env in ("HIP_VISIBLE_DEVICES", "ROCR_VISIBLE_DEVICES", "CUDA_VISIBLE_DEVICES"):
+        monkeypatch.delenv(_env, raising = False)
+
+
 def _host(**kw):
     base = dict(
         system = "Linux",
@@ -407,7 +421,9 @@ def test_route_to_vulkan_prebuilt_auto_intel_goes_upstream_and_drops_fork_pin():
     # Routing fork -> upstream also drops the fork release pin, which is in a
     # different tag namespace and would make the upstream resolver miss.
     host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True)
-    routed, repo, tag = ilp._route_to_vulkan_prebuilt(host, FORK, "b9596-mix-abc", force_cpu = False)
+    routed, repo, tag, _persist = ilp._route_to_vulkan_prebuilt(
+        host, FORK, "b9596-mix-abc", force_cpu = False
+    )
     assert repo == UPSTREAM
     assert tag == ""
     assert routed.has_intel_gpu is True
@@ -416,7 +432,9 @@ def test_route_to_vulkan_prebuilt_auto_intel_goes_upstream_and_drops_fork_pin():
 def test_route_to_vulkan_prebuilt_preserves_explicit_upstream_pin():
     # A pin set WITH an explicit upstream repo is already on upstream -> kept.
     host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True)
-    _routed, repo, tag = ilp._route_to_vulkan_prebuilt(host, UPSTREAM, "b9596", force_cpu = False)
+    _routed, repo, tag, _persist = ilp._route_to_vulkan_prebuilt(
+        host, UPSTREAM, "b9596", force_cpu = False
+    )
     assert repo == UPSTREAM
     assert tag == "b9596"
 
@@ -424,7 +442,9 @@ def test_route_to_vulkan_prebuilt_preserves_explicit_upstream_pin():
 def test_route_to_vulkan_prebuilt_cpu_fallback_wins():
     # --cpu-fallback suppresses Vulkan routing even for an Intel host.
     host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True)
-    routed, repo, tag = ilp._route_to_vulkan_prebuilt(host, FORK, "b9596-mix-abc", force_cpu = True)
+    routed, repo, tag, _persist = ilp._route_to_vulkan_prebuilt(
+        host, FORK, "b9596-mix-abc", force_cpu = True
+    )
     assert repo == FORK
     assert tag == "b9596-mix-abc"
     assert routed is host
@@ -536,20 +556,20 @@ def test_route_to_vulkan_prebuilt_hidden_nvidia_not_rerouted():
         has_physical_nvidia = True,
         has_usable_nvidia = False,
     )
-    _routed, repo, _tag = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
+    _routed, repo, _tag, _persist = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
     assert repo == FORK
 
 
 def test_route_to_vulkan_prebuilt_rocm_host_not_rerouted():
     # An Intel iGPU alongside a usable ROCm GPU stays on its ROCm/fork path.
     host = _host(is_linux = True, is_x86_64 = True, has_intel_gpu = True, has_rocm = True)
-    _routed, repo, _tag = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
+    _routed, repo, _tag, _persist = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
     assert repo == FORK
 
 
 def test_route_to_vulkan_prebuilt_non_intel_unchanged():
     host = _host(is_linux = True, is_x86_64 = True)
-    routed, repo, _tag = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
+    routed, repo, _tag, _persist = ilp._route_to_vulkan_prebuilt(host, FORK, "", force_cpu = False)
     assert repo == FORK
     assert routed is host
 
@@ -797,3 +817,800 @@ def test_detect_host_cim_rescues_exploding_registry(monkeypatch):
     )
     assert host.has_intel_gpu is True
     assert "powershell" in captured
+
+
+def _windows_amd_host(**overrides):
+    defaults = dict(
+        system = "Windows",
+        machine = "amd64",
+        is_windows = True,
+        is_linux = False,
+        is_macos = False,
+        is_x86_64 = True,
+        is_arm64 = False,
+        nvidia_smi = None,
+        driver_cuda_version = None,
+        compute_caps = [],
+        visible_cuda_devices = None,
+        has_physical_nvidia = False,
+        has_usable_nvidia = False,
+        has_rocm = True,
+        has_intel_gpu = False,
+    )
+    defaults.update(overrides)
+    return ilp.HostInfo(**defaults)
+
+
+def test_route_to_vulkan_prebuilt_auto_fallback_for_legacy_amd_gfx():
+    host = _windows_amd_host(rocm_gfx_target = "gfx803", rocm_gfx_targets = ["gfx803"])
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+    assert routed.has_intel_gpu is True
+    assert routed.has_rocm is False
+
+
+def test_route_to_vulkan_prebuilt_keeps_hip_when_one_gpu_is_supported():
+    host = _windows_amd_host(
+        rocm_gfx_target = "gfx1201",
+        rocm_gfx_targets = ["gfx1201", "gfx803"],
+    )
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+
+
+def test_route_to_vulkan_prebuilt_auto_fallback_skips_hip_masked_hosts():
+    # A HIP mask can hide a HIP-capable dGPU, but the Vulkan runtime honours none of them,
+    # so auto-routing would let the installed backend grab the gfx1201 the user masked
+    # off.
+    host = _windows_amd_host(
+        rocm_gfx_target = "gfx803",
+        rocm_gfx_targets = ["gfx1201", "gfx803"],
+    )
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == FORK
+    assert persist is None
+    assert routed is host
+
+
+def test_route_to_vulkan_prebuilt_auto_fallback_when_no_amd_gpu_reaches_floor():
+    # Every physical AMD device is below the floor, so no card can be exposed to HIP and
+    # the #7357 auto-Vulkan fallback still fires.
+    host = _windows_amd_host(
+        rocm_gfx_target = "gfx900",
+        rocm_gfx_targets = ["gfx803", "gfx900"],
+    )
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+    assert routed.has_rocm is False
+
+
+@pytest.mark.parametrize(
+    "mask_env", ["HIP_VISIBLE_DEVICES", "ROCR_VISIBLE_DEVICES", "CUDA_VISIBLE_DEVICES"]
+)
+def test_auto_vulkan_declines_when_a_hip_device_mask_filtered_the_probe(mask_env, monkeypatch):
+    # hipinfo is a HIP application, so under a mask rocm_gfx_targets is the VISIBLE set and
+    # a HIP-capable card can be hidden entirely. "No AMD GPU here reaches the floor" is then
+    # unprovable, and Vulkan honours none of these masks, so the auto fallback must decline
+    # rather than hand it the reserved card.
+    monkeypatch.setenv(mask_env, "1")
+    host = _windows_amd_host(rocm_gfx_target = "gfx803", rocm_gfx_targets = ["gfx803"])
+    assert ilp._should_auto_vulkan_for_amd_windows(host, FORK) is False
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+
+
+@pytest.mark.parametrize("mask_value", ["", "  ", "-1"])
+def test_auto_vulkan_declines_when_the_mask_hides_every_amd_gpu(mask_value, monkeypatch):
+    # An all-hiding mask is the strongest form of the same signal, not an exemption:
+    # detect_host() resolves no arch under it, but a forwarded --rocm-gfx still reconstructs
+    # one (setup infers it from the display-adapter name, which no HIP mask touches), so
+    # auto-routing would hand Vulkan every AMD GPU the user hid from HIP.
+    monkeypatch.setenv("HIP_VISIBLE_DEVICES", mask_value)
+    host = _windows_amd_host(rocm_gfx_target = None, rocm_gfx_targets = [])
+    host = ilp._apply_host_overrides(host, override_rocm_gfx = "gfx803")
+    assert ilp._active_rocm_gfx_target(host) == "gfx803"
+    assert ilp._should_auto_vulkan_for_amd_windows(host, FORK) is False
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+
+
+def test_hip_device_mask_check_is_presence_not_value(monkeypatch):
+    # Presence is the whole test: any value means the HIP view is not the physical one, and
+    # no value can be read as "the probe saw everything".
+    assert ilp._hip_visible_device_mask_set() is False
+    for value in ("", "  ", "-1", "0", "1", "0,1"):
+        monkeypatch.setenv("HIP_VISIBLE_DEVICES", value)
+        assert ilp._hip_visible_device_mask_set() is True, value
+    monkeypatch.delenv("HIP_VISIBLE_DEVICES")
+    monkeypatch.setenv("ROCR_VISIBLE_DEVICES", "0")
+    assert ilp._hip_visible_device_mask_set() is True
+    monkeypatch.delenv("ROCR_VISIBLE_DEVICES")
+    monkeypatch.setenv("CUDA_VISIBLE_DEVICES", "0")
+    assert ilp._hip_visible_device_mask_set() is True
+
+
+def test_masked_probe_suppression_does_not_touch_non_amd_auto_paths(monkeypatch):
+    # The mask says nothing about an Intel iGPU, whose Vulkan auto path is unrelated.
+    monkeypatch.setenv("HIP_VISIBLE_DEVICES", "1")
+    host = _host(
+        system = "Windows",
+        is_windows = True,
+        has_intel_gpu = True,
+        has_rocm = False,
+        has_physical_nvidia = False,
+        has_usable_nvidia = False,
+    )
+    _routed, repo, _tag, _persist = ilp._route_to_vulkan_prebuilt(
+        host, FORK, "pin", force_cpu = False
+    )
+    assert repo == UPSTREAM
+
+
+def test_route_to_vulkan_prebuilt_hip_masked_host_still_honours_explicit_optin(monkeypatch):
+    # The mask guard only suppresses the AUTOMATIC fallback; an explicit opt-in is the user
+    # taking responsibility for the Vulkan device mask themselves.
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    host = _windows_amd_host(
+        rocm_gfx_target = "gfx803",
+        rocm_gfx_targets = ["gfx1201", "gfx803"],
+    )
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(
+        host, FORK, "pin", force_cpu = False, llama_backend = "vulkan"
+    )
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+
+
+def test_auto_vulkan_is_repository_specific_for_fork_only_gfx():
+    # gfx1034 is served only by the fork's gfx103X bundle: ggml-org's windows-hip radeon
+    # build does not target it and direct_upstream_release_plan() offers win-hip then CPU
+    # with no Vulkan branch, so the predicate must answer per repo.
+    host = _windows_amd_host(rocm_gfx_target = "gfx1034", rocm_gfx_targets = ["gfx1034"])
+    assert ilp._should_auto_vulkan_for_amd_windows(host, FORK) is False
+    assert ilp._should_auto_vulkan_for_amd_windows(host, UPSTREAM) is True
+    # An arch upstream really does build stays on HIP for both repos.
+    supported = _windows_amd_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
+    assert ilp._should_auto_vulkan_for_amd_windows(supported, FORK) is False
+    assert ilp._should_auto_vulkan_for_amd_windows(supported, UPSTREAM) is False
+    # A family label is a bundle name, not an arch: upstream builds every member but
+    # gfx1034 / gfx1103, and the label cannot say which card this is, so it stays on HIP
+    # rather than moving the covered members onto Vulkan.
+    family = _windows_amd_host(rocm_gfx_target = "gfx110X", rocm_gfx_targets = ["gfx110X"])
+    assert ilp._should_auto_vulkan_for_amd_windows(family, UPSTREAM) is False
+
+
+@pytest.mark.parametrize(
+    "repo", ["acme/llama.cpp-mirror", "GGML-ORG/llama.cpp", "unslothAI/llama.cpp"]
+)
+def test_fork_only_gfx_coverage_is_not_granted_to_other_repos(repo):
+    # Only the fork is planned from a manifest: resolve_simple_install_release_plans()
+    # compares == DEFAULT_PUBLISHED_REPO and sends everything else, mirrors and differently
+    # cased spellings alike, to direct_upstream_release_plan(). Granting a fork-only arch
+    # coverage there lands it on win-hip-radeon or CPU instead of Vulkan, so the predicate
+    # must gate on the fork rather than exempt one name.
+    host = _windows_amd_host(rocm_gfx_target = "gfx1034", rocm_gfx_targets = ["gfx1034"])
+    assert ilp._should_auto_vulkan_for_amd_windows(host, repo) is True
+    supported = _windows_amd_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
+    assert ilp._should_auto_vulkan_for_amd_windows(supported, repo) is False
+
+
+@pytest.mark.parametrize("repo", [None, ""])
+def test_empty_published_repo_gets_fork_coverage(repo):
+    # Negative control: the resolver defaults an empty repo to the fork, so the predicate
+    # must too, or the default install path loses its fork-only archs.
+    host = _windows_amd_host(rocm_gfx_target = "gfx1034", rocm_gfx_targets = ["gfx1034"])
+    assert ilp._should_auto_vulkan_for_amd_windows(host, repo) is False
+
+
+def test_upstream_windows_hip_targets_are_a_subset_of_the_combined_floor():
+    # The floor must stay a superset, else auto-Vulkan steals a host upstream builds for.
+    assert ilp.UPSTREAM_WINDOWS_HIP_GFX_TARGETS <= ilp.WINDOWS_HIP_PREBUILT_GFX_TARGETS
+    # The fork-only extras are exactly the archs that must route to Vulkan upstream.
+    assert ilp.WINDOWS_HIP_PREBUILT_GFX_TARGETS - ilp.UPSTREAM_WINDOWS_HIP_GFX_TARGETS == {
+        "gfx908",
+        "gfx90a",
+        "gfx1034",
+        "gfx1103",
+    }
+
+
+def test_route_to_vulkan_prebuilt_unknown_gfx_does_not_auto_fallback():
+    host = _windows_amd_host(
+        has_rocm = True,
+        rocm_gfx_target = None,
+        rocm_gfx_targets = [],
+    )
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+
+
+def test_route_to_vulkan_prebuilt_family_gfx_token_keeps_rocm():
+    host = _windows_amd_host(rocm_gfx_target = "gfx110X", rocm_gfx_targets = ["gfx110X"])
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+
+
+def test_route_to_vulkan_prebuilt_gfx1103_keeps_rocm():
+    host = _windows_amd_host(rocm_gfx_target = "gfx1103", rocm_gfx_targets = ["gfx1103"])
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+
+
+def test_route_to_vulkan_prebuilt_gfx1034_keeps_rocm():
+    # gfx1034 (RX 6500/6400-class) is covered by the fork's gfx103X bundle.
+    host = _windows_amd_host(rocm_gfx_target = "gfx1034", rocm_gfx_targets = ["gfx1034"])
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+
+
+def test_route_to_vulkan_prebuilt_explicit_opt_in_on_mixed_amd(monkeypatch):
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "vulkan")
+    host = _windows_amd_host(
+        rocm_gfx_target = "gfx1201",
+        rocm_gfx_targets = ["gfx1201", "gfx803"],
+    )
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+    assert routed.has_rocm is False
+
+
+def test_direct_upstream_windows_amd_legacy_gfx_routes_to_vulkan():
+    host = _windows_amd_host(rocm_gfx_target = "gfx803", rocm_gfx_targets = ["gfx803"])
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    rel = _upstream_release(
+        "b9925",
+        [
+            "llama-b9925-bin-win-hip-radeon-x64.zip",
+            "llama-b9925-bin-win-vulkan-x64.zip",
+            "llama-b9925-bin-win-cpu-x64.zip",
+        ],
+    )
+    plan = ilp.direct_upstream_release_plan(rel, routed, repo, "latest")
+    assert persist == "vulkan"
+    assert plan.attempts[0].install_kind == "windows-vulkan"
+
+
+def test_llama_backend_env_requests_vulkan(monkeypatch):
+    assert ilp.llama_backend_from_env() is None
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "vulkan")
+    assert ilp.llama_backend_from_env() == "vulkan"
+    assert ilp.force_vulkan_requested() is True
+
+
+def test_llama_cpp_backend_env_does_not_trigger_vulkan(monkeypatch):
+    # UNSLOTH_LLAMA_CPP_BACKEND is a separate setup variable (auto/cpu) whose other values
+    # setup warns about and ignores, so reading it here would opt in behind that warning.
+    monkeypatch.delenv("UNSLOTH_LLAMA_BACKEND", raising = False)
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    monkeypatch.setenv("UNSLOTH_LLAMA_CPP_BACKEND", "vulkan")
+    assert ilp.llama_backend_from_env() is None
+    assert ilp.force_vulkan_requested() is False
+
+
+def test_route_to_vulkan_prebuilt_hidden_physical_nvidia_amd_not_rerouted():
+    # Vulkan ignores CUDA_VISIBLE_DEVICES, so a CUDA-masked NVIDIA card next to a legacy
+    # AMD gfx must not auto-route: Vulkan could grab the reserved NVIDIA GPU.
+    host = _windows_amd_host(
+        rocm_gfx_target = "gfx803",
+        rocm_gfx_targets = ["gfx803"],
+        has_physical_nvidia = True,
+        has_usable_nvidia = False,
+    )
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+
+
+def test_route_to_vulkan_prebuilt_explicit_opt_in_overrides_hidden_nvidia(monkeypatch):
+    # The physical-NVIDIA guard only gates the AMD auto path; an explicit opt-in wins.
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "vulkan")
+    host = _windows_amd_host(
+        rocm_gfx_target = "gfx803",
+        rocm_gfx_targets = ["gfx803"],
+        has_physical_nvidia = True,
+        has_usable_nvidia = False,
+    )
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+
+
+# The gfx archs the fork's llama-prebuilt-manifest.json maps to a windows-rocm bundle.
+# Static because parametrisation happens at import time and the routing tests below must
+# stay offline; the guard further down re-derives it from the published manifest and fails
+# on drift, so this is a checked mirror, not a second source of truth.
+_FORK_WINDOWS_ROCM_GFX = (
+    "gfx908",
+    "gfx90a",
+    "gfx1030",
+    "gfx1031",
+    "gfx1032",
+    "gfx1034",
+    "gfx1100",
+    "gfx1101",
+    "gfx1102",
+    "gfx1103",
+    "gfx1150",
+    "gfx1151",
+    "gfx1200",
+    "gfx1201",
+)
+
+
+def _published_fork_windows_rocm_artifacts():
+    """The fork's windows-rocm artifact records, read the way an install reads them.
+
+    _download_host_resolved_release is the path a default fork install takes first: it
+    resolves the latest release off the download host and hands llama-prebuilt-manifest.json
+    to parse_published_release_bundle, so these are the very records
+    published_rocm_choice_for_host later matches a host gfx against. No api.github.com call,
+    hence no shared rate-limit bucket to exhaust.
+
+    The manifest ships only as a release asset and nothing in-tree mirrors it, so this is
+    the one honest source. Only OSError and the release-side PrebuiltFallback become a skip,
+    so an offline run stays quiet while a manifest that fetches but no longer parses still
+    fails loudly."""
+    try:
+        resolved = ilp._download_host_resolved_release(FORK)
+    except OSError as exc:
+        pytest.skip(f"{FORK} release manifest unreachable: {exc}")
+    except ilp.PrebuiltFallback as exc:
+        pytest.skip(f"{FORK} latest release was rejected before its manifest parsed: {exc}")
+    if resolved is None:
+        pytest.skip(f"{FORK} published no resolvable latest release")
+    tag = resolved.bundle.release_tag
+    artifacts = [
+        artifact
+        for artifact in resolved.bundle.artifacts
+        if artifact.install_kind == "windows-rocm"
+    ]
+    assert artifacts, f"{FORK}@{tag} manifest listed no windows-rocm artifacts"
+    return tag, artifacts
+
+
+def test_windows_hip_gfx_floor_covers_every_fork_windows_rocm_bundle():
+    # Derived from the published manifest, not a second literal: a gfx the fork builds but
+    # the floor omits bypasses the fork manifest, downgrading a hash-approved windows-rocm
+    # bundle to an unhashed upstream Vulkan build. A newly published arch must redden here.
+    tag, artifacts = _published_fork_windows_rocm_artifacts()
+    # published_rocm_choice_for_host serves a bundle on a concrete mapped_targets entry or on
+    # the umbrella gfx_target itself, so both spellings must clear a floor. A gfx_target
+    # absent from its own mapped_targets is the family label (gfx110X); one present in it is
+    # a standalone bundle (gfx908) already counted as concrete.
+    concrete = {target.lower() for artifact in artifacts for target in artifact.mapped_targets}
+    labels = {
+        artifact.gfx_target.lower()
+        for artifact in artifacts
+        if artifact.gfx_target and artifact.gfx_target.lower() not in concrete
+    }
+    unfloored = sorted(concrete - ilp.WINDOWS_HIP_PREBUILT_GFX_TARGETS)
+    assert (
+        not unfloored
+    ), f"auto-Vulkan would steal windows-rocm archs published in {FORK}@{tag}: {unfloored}"
+    unlabelled = sorted(labels - ilp.WINDOWS_ROCM_FAMILY_GFX_LABELS)
+    assert not unlabelled, (
+        f"update markers forward family labels {FORK}@{tag} publishes but "
+        f"WINDOWS_ROCM_FAMILY_GFX_LABELS omits: {unlabelled}"
+    )
+    # Keep the import-time tuple the offline routing tests parametrise on an exact mirror.
+    assert set(_FORK_WINDOWS_ROCM_GFX) == concrete, (
+        f"_FORK_WINDOWS_ROCM_GFX drifted from {FORK}@{tag}: "
+        f"gained {sorted(concrete - set(_FORK_WINDOWS_ROCM_GFX))}, "
+        f"lost {sorted(set(_FORK_WINDOWS_ROCM_GFX) - concrete)}"
+    )
+
+
+@pytest.mark.parametrize("gfx", _FORK_WINDOWS_ROCM_GFX)
+def test_route_to_vulkan_prebuilt_keeps_every_fork_windows_rocm_arch(gfx, monkeypatch):
+    # No ambient opt-in: this asserts the AUTO path leaves covered archs alone.
+    monkeypatch.delenv("UNSLOTH_LLAMA_BACKEND", raising = False)
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    host = _windows_amd_host(rocm_gfx_target = gfx, rocm_gfx_targets = [gfx])
+    routed, repo, tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert (repo, tag) == (FORK, "pin")
+    assert persist is None
+
+
+def test_forwarded_gfx_does_not_undo_visible_device_auto_vulkan(monkeypatch):
+    # Mixed-AMD Windows host: GPU 0 = gfx1100 (HIP prebuilt exists), GPU 1 = gfx1010 (none).
+    # Under CUDA_VISIBLE_DEVICES=1 setup.ps1 still resolves GPU 0 and forwards gfx1100, but
+    # detect_host() resolved the visible gfx1010, so folding the forward in must not
+    # reinstate gfx1100 and install a HIP bundle the visible GPU cannot run.
+    monkeypatch.delenv("UNSLOTH_LLAMA_BACKEND", raising = False)
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+    host = _windows_amd_host(rocm_gfx_target = "gfx1010", rocm_gfx_targets = ["gfx1100", "gfx1010"])
+    host = ilp._apply_host_overrides(host, override_rocm_gfx = "gfx1100")
+    assert ilp._active_rocm_gfx_target(host) == "gfx1010"
+    assert host.rocm_gfx_targets == ["gfx1100", "gfx1010"]
+    # gfx1100 is masked off, not absent, and Vulkan does not honour the HIP mask, so the
+    # automatic fallback stays off and the HIP / fork path is kept.
+    assert ilp._should_auto_vulkan_for_amd_windows(host, FORK) is False
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == FORK
+    assert persist is None
+
+
+def test_forwarded_gfx_absent_from_probe_keeps_the_physical_hip_card(monkeypatch):
+    # Mixed-AMD Windows host: GPU 0 = gfx1100 (HIP prebuilt exists), GPU 1 = gfx803 (below
+    # the floor). CUDA_VISIBLE_DEVICES=1 reserves the gfx1100, so detect_host() picks gfx803
+    # as active but still reports both cards, and setup forwards a third arch the probe never
+    # saw (a stale env var, or name inference reading the other card). That forward selects
+    # the HIP target but must not delete the probe's inventory, or the floor check concludes
+    # no AMD GPU here reaches HIP and auto-routes to Vulkan, which ignores the HIP mask and
+    # enumerates the reserved gfx1100.
+    monkeypatch.delenv("UNSLOTH_LLAMA_BACKEND", raising = False)
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+    host = _windows_amd_host(rocm_gfx_target = "gfx803", rocm_gfx_targets = ["gfx1100", "gfx803"])
+    host = ilp._apply_host_overrides(host, override_rocm_gfx = "gfx900")
+    assert ilp._active_rocm_gfx_target(host) == "gfx900"
+    assert host.rocm_gfx_targets == ["gfx1100", "gfx803", "gfx900"]
+    assert ilp._should_auto_vulkan_for_amd_windows(host, FORK) is False
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == FORK
+    assert persist is None
+
+
+def test_forwarded_gfx_absent_from_probe_keeps_a_single_probed_hip_card(monkeypatch):
+    # Same rule on a single-GPU box: a stale below-floor forward over a probe-confirmed
+    # gfx1100 must not auto-route that machine to Vulkan.
+    monkeypatch.delenv("UNSLOTH_LLAMA_BACKEND", raising = False)
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+    host = _windows_amd_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
+    host = ilp._apply_host_overrides(host, override_rocm_gfx = "gfx803")
+    assert ilp._active_rocm_gfx_target(host) == "gfx803"
+    assert host.rocm_gfx_targets == ["gfx1100", "gfx803"]
+    assert ilp._should_auto_vulkan_for_amd_windows(host, FORK) is False
+
+
+def test_forwarded_gfx_absent_from_probe_still_allows_explicit_vulkan(monkeypatch):
+    # The physical-inventory rule gates the AUTO path only; naming the backend wins.
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "vulkan")
+    monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+    host = _windows_amd_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
+    host = ilp._apply_host_overrides(host, override_rocm_gfx = "gfx803")
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+
+
+def test_forwarded_gfx_on_unprobed_host_still_auto_vulkans(monkeypatch):
+    # Negative control: a driver-only AMD host runs no successful probe (no hipinfo, amd-smi
+    # suppressed), so --rocm-gfx is the ONLY source of the arch and there is no inventory to
+    # preserve. This is the #7357 path the feature exists for; it must still reach Vulkan.
+    monkeypatch.delenv("UNSLOTH_LLAMA_BACKEND", raising = False)
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+    host = _windows_amd_host(rocm_gfx_target = None, rocm_gfx_targets = [])
+    host = ilp._apply_host_overrides(host, override_rocm_gfx = "gfx803")
+    assert host.rocm_gfx_targets == ["gfx803"]
+    assert ilp._should_auto_vulkan_for_amd_windows(host, FORK) is True
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+
+
+def test_forwarded_gfx_still_fills_an_unprobed_arch(monkeypatch):
+    # Negative control: on an amd-smi-only host detect_host() reports no arch, so the
+    # forward is the only source and must still apply.
+    monkeypatch.delenv("UNSLOTH_LLAMA_BACKEND", raising = False)
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+    host = _windows_amd_host(rocm_gfx_target = None, rocm_gfx_targets = [])
+    host = ilp._apply_host_overrides(host, override_rocm_gfx = "gfx1151")
+    assert ilp._active_rocm_gfx_target(host) == "gfx1151"
+    assert ilp._should_auto_vulkan_for_amd_windows(host) is False
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == FORK
+    assert persist is None
+
+
+def test_llama_backend_hip_opts_out_of_auto_vulkan(monkeypatch):
+    # hip names a backend, so it keeps the fork path even on an auto-fallback arch.
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "hip")
+    host = _windows_amd_host(rocm_gfx_target = "gfx803", rocm_gfx_targets = ["gfx803"])
+    routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert routed is host
+    assert repo == FORK
+    assert persist is None
+    assert ilp.force_vulkan_requested() is False
+
+
+def test_explicit_backend_beats_legacy_force_vulkan(monkeypatch):
+    # A stale UNSLOTH_FORCE_VULKAN must not overrule UNSLOTH_LLAMA_BACKEND=rocm (== hip).
+    monkeypatch.setenv("UNSLOTH_FORCE_VULKAN", "1")
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "rocm")
+    assert ilp.resolved_llama_backend() == "hip"
+    assert ilp.force_vulkan_requested() is False
+    host = _windows_amd_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == FORK
+    assert persist is None
+
+
+def test_unknown_llama_backend_value_falls_through_to_legacy_flag(monkeypatch):
+    # An unrecognised value is ignored, not an error, so the legacy flag still works.
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "banana")
+    assert ilp.resolved_llama_backend() is None
+    assert ilp.force_vulkan_requested() is False
+    monkeypatch.setenv("UNSLOTH_FORCE_VULKAN", "1")
+    assert ilp.force_vulkan_requested() is True
+
+
+def test_llama_backend_flag_beats_conflicting_env(monkeypatch):
+    # --llama-backend is the caller's explicit request and outranks the env.
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "hip")
+    assert ilp.force_vulkan_requested("vulkan") is True
+    host = _windows_amd_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(
+        host, FORK, "pin", force_cpu = False, llama_backend = "vulkan"
+    )
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+
+
+def _windows_arm64_host(**overrides):
+    defaults = dict(
+        system = "Windows",
+        machine = "ARM64",
+        is_windows = True,
+        is_linux = False,
+        is_macos = False,
+        is_x86_64 = False,
+        is_arm64 = True,
+        nvidia_smi = None,
+        driver_cuda_version = None,
+        compute_caps = [],
+        visible_cuda_devices = None,
+        has_physical_nvidia = False,
+        has_usable_nvidia = False,
+        has_rocm = False,
+        has_intel_gpu = False,
+    )
+    defaults.update(overrides)
+    return ilp.HostInfo(**defaults)
+
+
+@pytest.mark.parametrize(
+    "env, flag",
+    [
+        ({"UNSLOTH_LLAMA_BACKEND": "vulkan"}, None),
+        ({"UNSLOTH_FORCE_VULKAN": "1"}, None),
+        ({}, "vulkan"),
+    ],
+)
+def test_vulkan_opt_in_ignored_on_windows_arm64(monkeypatch, env, flag):
+    # Upstream builds win-vulkan for x64 only (arm64 gets CPU + opencl-adreno), so rewriting
+    # the host would only swap the published arm64 bundle for the upstream CPU one.
+    for name, value in env.items():
+        monkeypatch.setenv(name, value)
+    host = _windows_arm64_host()
+    routed, repo, tag, persist = ilp._route_to_vulkan_prebuilt(
+        host, FORK, "pin", force_cpu = False, llama_backend = flag
+    )
+    assert routed is host
+    assert (repo, tag) == (FORK, "pin")
+    assert persist is None
+
+
+def test_vulkan_opt_in_still_routes_on_windows_x64(monkeypatch):
+    # Negative control for the arm64 guard: x64 keeps its Vulkan routing.
+    monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", "vulkan")
+    host = _windows_amd_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
+    _routed, repo, _tag, persist = ilp._route_to_vulkan_prebuilt(host, FORK, "pin", force_cpu = False)
+    assert repo == UPSTREAM
+    assert persist == "vulkan"
+
+
+def _choice(install_kind, name = "asset.zip"):
+    return ilp.AssetChoice(
+        repo = UPSTREAM,
+        tag = "b9925",
+        name = name,
+        url = f"https://example/{name}",
+        source_label = "upstream",
+        install_kind = install_kind,
+    )
+
+
+@pytest.mark.parametrize("kind", ["windows-vulkan", "linux-vulkan"])
+def test_persisted_llama_backend_keeps_vulkan_for_a_vulkan_bundle(kind):
+    assert ilp.persisted_llama_backend("vulkan", _choice(kind)) == "vulkan"
+
+
+@pytest.mark.parametrize("kind", ["windows-arm64", "windows-cpu", "linux-cpu", "windows-rocm"])
+def test_persisted_llama_backend_drops_vulkan_for_a_non_vulkan_bundle(kind):
+    # _plan_llama_phase re-asserts the marker's backend on every later update, so a Vulkan
+    # request that fell through to CPU must not leave a marker claiming Vulkan.
+    assert ilp.persisted_llama_backend("vulkan", _choice(kind)) is None
+
+
+def test_persisted_llama_backend_passes_none_through():
+    assert ilp.persisted_llama_backend(None, _choice("windows-vulkan")) is None
+
+
+def test_marker_records_no_backend_when_vulkan_fell_back_to_cpu(tmp_path):
+    # End to end over write_prebuilt_metadata: describe the CPU attempt that actually won,
+    # so the next update re-detects instead of re-asserting Vulkan forever.
+    checksums = ilp.ApprovedReleaseChecksums(
+        repo = UPSTREAM,
+        release_tag = "b9925",
+        upstream_tag = "b9925",
+        source_repo = UPSTREAM,
+        source_repo_url = f"https://github.com/{UPSTREAM}",
+    )
+    cpu = _choice("windows-arm64", "llama-b9925-bin-win-cpu-arm64.zip")
+    ilp.write_prebuilt_metadata(
+        tmp_path,
+        requested_tag = "latest",
+        llama_tag = "b9925",
+        release_tag = "b9925",
+        choice = cpu,
+        approved_checksums = checksums,
+        prebuilt_fallback_used = False,
+        llama_backend = "vulkan",
+    )
+    marker = json.loads((tmp_path / "UNSLOTH_PREBUILT_INFO.json").read_text())
+    assert marker["asset"] == "llama-b9925-bin-win-cpu-arm64.zip"
+    assert marker["llama_backend"] is None
+
+    vulkan = _choice("windows-vulkan", "llama-b9925-bin-win-vulkan-x64.zip")
+    ilp.write_prebuilt_metadata(
+        tmp_path,
+        requested_tag = "latest",
+        llama_tag = "b9925",
+        release_tag = "b9925",
+        choice = vulkan,
+        approved_checksums = checksums,
+        prebuilt_fallback_used = False,
+        llama_backend = "vulkan",
+    )
+    marker = json.loads((tmp_path / "UNSLOTH_PREBUILT_INFO.json").read_text())
+    assert marker["llama_backend"] == "vulkan"
+
+
+# UNSLOTH_LLAMA_CPP_BACKEND (setup.sh/setup.ps1, "auto"|"cpu") and
+# UNSLOTH_LLAMA_BACKEND (this module, a backend name) are different variables at
+# different layers, and both accept "cpu". setup translates its own =cpu into
+# --force-cpu to pin the CPU-only bundle on a GPU host, which is what keeps Intel
+# iGPU Vulkan crashes away (#7213). Vulkan is opt-in here, so no trigger it adds
+# may outrank that flag on any host.
+_SIM_PLATFORMS = {
+    # WSL presents as Linux to this resolver, so it rides the Linux row.
+    "Linux": dict(
+        system = "Linux",
+        is_windows = False,
+        is_linux = True,
+        is_macos = False,
+        machine = "x86_64",
+        is_x86_64 = True,
+        is_arm64 = False,
+    ),
+    "Windows": dict(
+        system = "Windows",
+        is_windows = True,
+        is_linux = False,
+        is_macos = False,
+        machine = "amd64",
+        is_x86_64 = True,
+        is_arm64 = False,
+    ),
+    "macOS": dict(
+        system = "Darwin",
+        is_windows = False,
+        is_linux = False,
+        is_macos = True,
+        machine = "arm64",
+        is_x86_64 = False,
+        is_arm64 = True,
+    ),
+}
+_SIM_GPUS = {
+    "nvidia": dict(
+        has_physical_nvidia = True,
+        has_usable_nvidia = True,
+        has_rocm = False,
+        has_intel_gpu = False,
+        nvidia_smi = "/usr/bin/nvidia-smi",
+        driver_cuda_version = "12.4",
+        compute_caps = ["8.9"],
+    ),
+    "amd": dict(
+        has_physical_nvidia = False,
+        has_usable_nvidia = False,
+        has_rocm = True,
+        has_intel_gpu = False,
+        nvidia_smi = None,
+        driver_cuda_version = None,
+        compute_caps = [],
+        rocm_gfx_target = "gfx803",
+        rocm_gfx_targets = ["gfx803"],
+    ),
+    "intel": dict(
+        has_physical_nvidia = False,
+        has_usable_nvidia = False,
+        has_rocm = False,
+        has_intel_gpu = True,
+        nvidia_smi = None,
+        driver_cuda_version = None,
+        compute_caps = [],
+    ),
+    "cpu_only": dict(
+        has_physical_nvidia = False,
+        has_usable_nvidia = False,
+        has_rocm = False,
+        has_intel_gpu = False,
+        nvidia_smi = None,
+        driver_cuda_version = None,
+        compute_caps = [],
+    ),
+}
+
+
+def _sim_host(platform_name, gpu_name):
+    base = dict(visible_cuda_devices = None)
+    base.update(_SIM_PLATFORMS[platform_name])
+    base.update(_SIM_GPUS[gpu_name])
+    return ilp.HostInfo(**base)
+
+
+@pytest.mark.parametrize("platform_name", sorted(_SIM_PLATFORMS))
+@pytest.mark.parametrize("gpu_name", sorted(_SIM_GPUS))
+@pytest.mark.parametrize("backend_env", [None, "vulkan", "hip", "rocm", "cpu"])
+def test_forced_cpu_outranks_every_vulkan_trigger(
+    monkeypatch, platform_name, gpu_name, backend_env
+):
+    """A deliberate CPU install stays CPU on every host, whatever asks for Vulkan."""
+    monkeypatch.delenv("UNSLOTH_FORCE_VULKAN", raising = False)
+    if backend_env is None:
+        monkeypatch.delenv("UNSLOTH_LLAMA_BACKEND", raising = False)
+    else:
+        monkeypatch.setenv("UNSLOTH_LLAMA_BACKEND", backend_env)
+    # The legacy switch too, so a stale one cannot smuggle Vulkan past --force-cpu.
+    monkeypatch.setenv("UNSLOTH_FORCE_VULKAN", "1")
+
+    repo, tag = "unslothai/llama.cpp-prebuilt", "latest"
+    _, out_repo, _, persist = ilp._route_to_vulkan_prebuilt(
+        _sim_host(platform_name, gpu_name),
+        repo,
+        tag,
+        force_cpu = True,
+        llama_backend = "vulkan",
+    )
+    assert out_repo == repo, (platform_name, gpu_name, backend_env)
+    assert persist is None, (platform_name, gpu_name, backend_env)
+
+
+def test_the_forced_cpu_guard_is_not_vacuous():
+    """The same host DOES take Vulkan once the CPU pin is gone, or the check above
+    would pass on a resolver that had stopped routing to Vulkan entirely."""
+    repo, tag = "unslothai/llama.cpp-prebuilt", "latest"
+    _, out_repo, _, persist = ilp._route_to_vulkan_prebuilt(
+        _sim_host("Linux", "amd"),
+        repo,
+        tag,
+        force_cpu = False,
+        llama_backend = "vulkan",
+    )
+    assert out_repo != repo or persist == "vulkan"
diff --git a/studio/backend/tests/test_llama_admission.py b/studio/backend/tests/test_llama_admission.py
index 2f04e81926..9ff19ec27d 100644
--- a/studio/backend/tests/test_llama_admission.py
+++ b/studio/backend/tests/test_llama_admission.py
@@ -16,6 +16,7 @@ from core.inference.llama_admission import (
     ADMISSION_CONTROL_ENV,
     ADMISSION_KEEPALIVE_INTERVAL_ENV,
     ADMISSION_MAX_QUEUE_ENV,
+    ADMISSION_QUEUE_PER_SLOT_ENV,
     ADMISSION_QUEUE_TIMEOUT_ENV,
     DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S,
     DEFAULT_ADMISSION_MAX_QUEUE,
@@ -28,8 +29,23 @@ from core.inference.llama_admission import (
 )
 
 
+_ADMISSION_ENV = (
+    ADMISSION_CONTROL_ENV,
+    ADMISSION_QUEUE_TIMEOUT_ENV,
+    ADMISSION_KEEPALIVE_INTERVAL_ENV,
+    ADMISSION_MAX_QUEUE_ENV,
+    ADMISSION_QUEUE_PER_SLOT_ENV,
+    *llama_admission._LEGACY_ENV.values(),
+)
+
+
 @pytest.fixture(autouse = True)
-def _reset_queues():
+def _reset_queues(monkeypatch):
+    # Clear ambient settings for every test, not just the ones that remember to:
+    # a canonical name set on the machine silently beats the legacy name a test
+    # is exercising, and the queue registry is process-global.
+    for name in _ADMISSION_ENV:
+        monkeypatch.delenv(name, raising = False)
     reset_llama_admission_queues()
     yield
     reset_llama_admission_queues()
@@ -41,15 +57,25 @@ def test_admission_config_defaults(monkeypatch):
         ADMISSION_QUEUE_TIMEOUT_ENV,
         ADMISSION_KEEPALIVE_INTERVAL_ENV,
         ADMISSION_MAX_QUEUE_ENV,
+        ADMISSION_QUEUE_PER_SLOT_ENV,
+        "UNSLOTH_OPENAI_COMPAT_ADMISSION_CONTROL",
+        "UNSLOTH_OPENAI_COMPAT_ADMISSION_QUEUE_TIMEOUT",
+        "UNSLOTH_OPENAI_COMPAT_ADMISSION_KEEPALIVE_INTERVAL",
+        "UNSLOTH_OPENAI_COMPAT_ADMISSION_MAX_QUEUE",
     ):
         monkeypatch.delenv(name, raising = False)
 
     config = llama_admission_config_from_env()
 
+    # Literals, not the module constants: comparing a default to itself would let
+    # any future value change through silently.
     assert config.enabled is True
-    assert config.queue_timeout_s == DEFAULT_ADMISSION_QUEUE_TIMEOUT_S
-    assert config.keepalive_interval_s == DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S
-    assert config.max_queue == DEFAULT_ADMISSION_MAX_QUEUE
+    assert config.queue_timeout_s is None  # wait forever
+    assert config.keepalive_interval_s == 5.0
+    assert config.max_queue is None  # no absolute cap
+    assert config.queue_per_slot == 16
+    assert (DEFAULT_ADMISSION_QUEUE_TIMEOUT_S, DEFAULT_ADMISSION_MAX_QUEUE) == (None, None)
+    assert DEFAULT_ADMISSION_KEEPALIVE_INTERVAL_S == 5.0
 
 
 def test_admission_config_env_overrides(monkeypatch):
@@ -66,6 +92,25 @@ def test_admission_config_env_overrides(monkeypatch):
     assert config.max_queue is None
 
 
+def test_admission_config_honors_legacy_openai_compat_env(monkeypatch):
+    # The queue is shared with /v1/messages now, but existing OPENAI_COMPAT
+    # settings must keep working.
+    monkeypatch.setenv("UNSLOTH_OPENAI_COMPAT_ADMISSION_MAX_QUEUE", "7")
+    monkeypatch.setenv("UNSLOTH_OPENAI_COMPAT_ADMISSION_CONTROL", "off")
+
+    config = llama_admission_config_from_env()
+
+    assert config.max_queue == 7
+    assert config.enabled is False
+
+
+def test_admission_config_prefers_neutral_env_over_legacy(monkeypatch):
+    monkeypatch.setenv("UNSLOTH_OPENAI_COMPAT_ADMISSION_MAX_QUEUE", "7")
+    monkeypatch.setenv(ADMISSION_MAX_QUEUE_ENV, "3")
+
+    assert llama_admission_config_from_env().max_queue == 3
+
+
 def test_admission_config_positive_queue_timeout_env(monkeypatch):
     monkeypatch.setenv(ADMISSION_QUEUE_TIMEOUT_ENV, "600")
 
@@ -106,6 +151,160 @@ def test_fifo_capacity_one_grants_next_waiter_on_release():
     asyncio.run(_run())
 
 
+def test_pool_hands_out_distinct_slots_and_reuses_them():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        leases = [queue.reserve(capacity = 3, config = config).lease_nowait() for _ in range(3)]
+        assert sorted(lease.slot for lease in leases) == [0, 1, 2]  # one slot each
+        snapshot = queue.snapshot()
+        assert (snapshot.active, snapshot.free, snapshot.capacity) == (3, 0, 3)
+
+        # A freed slot returns to the pool and is handed to the next caller.
+        freed = leases[1].slot
+        leases[1].release()
+        assert queue.snapshot().free == 1
+        reused = queue.reserve(capacity = 3, config = config).lease_nowait()
+        assert reused.slot == freed
+
+        reused.release()
+        leases[0].release()
+        leases[2].release()
+        snapshot = queue.snapshot()
+        assert (snapshot.active, snapshot.free) == (0, 3)
+
+    asyncio.run(_run())
+
+
+def test_pool_waiter_is_handed_a_real_slot():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        held = queue.reserve(capacity = 1, config = config).lease_nowait()
+        waiting = queue.reserve(capacity = 1, config = config)
+        assert waiting.lease_nowait() is None
+        assert queue.snapshot().free == 0
+
+        held.release()
+        granted = await waiting.wait(0.1)
+        assert granted is not None and granted.slot == 0  # the slot just freed
+        granted.release()
+
+    asyncio.run(_run())
+
+
+def test_shrinking_capacity_retires_slots_beyond_the_new_pool():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        leases = [queue.reserve(capacity = 4, config = config).lease_nowait() for _ in range(4)]
+        assert queue.snapshot().capacity == 4
+
+        # llama-server reloaded with fewer --parallel slots; in-flight holders keep
+        # running and their slots retire instead of returning to the smaller pool.
+        shrunk = queue.reserve(capacity = 2, config = config)
+        assert shrunk.lease_nowait() is None  # all 4 still held, nothing free
+        for lease in leases:
+            lease.release()
+
+        granted = await shrunk.wait(0.1)
+        assert granted is not None and granted.slot < 2
+        granted.release()
+        snapshot = queue.snapshot()
+        assert (snapshot.capacity, snapshot.active, snapshot.free) == (2, 0, 2)
+
+    asyncio.run(_run())
+
+
+def test_queue_limit_scales_with_the_serving_slots():
+    # The wait line follows --parallel: 16 per slot, floored at 64 so a 1-slot
+    # backend keeps the depth it had before scaling existed.
+    config = LlamaAdmissionConfig()
+    assert config.queue_limit(4) == 64  # --parallel 4  (the default)
+    assert config.queue_limit(8) == 128  # --parallel 8
+    assert config.queue_limit(16) == 256
+    assert config.queue_limit(1) == 64  # floor, not 16
+    assert config.queue_limit(2) == 64  # floor, not 32
+    # An explicit cap wins, and a None multiplier means an unbounded line.
+    assert LlamaAdmissionConfig(max_queue = 5).queue_limit(8) == 5
+    assert LlamaAdmissionConfig(queue_per_slot = None).queue_limit(8) is None
+    # Non-positive settings mean unbounded, never "reject everything".
+    assert LlamaAdmissionConfig(max_queue = 0).queue_limit(4) is None
+    assert LlamaAdmissionConfig(max_queue = -1).queue_limit(4) is None
+    assert LlamaAdmissionConfig(queue_per_slot = 0).queue_limit(4) is None
+    assert LlamaAdmissionConfig(queue_per_slot = -3).queue_limit(4) is None
+
+
+def test_queue_limit_rejects_only_once_the_line_is_full():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        # Explicit cap, so the test drives rejection without standing up the 64
+        # waiters the scaled floor would otherwise require.
+        config = LlamaAdmissionConfig(max_queue = 4)
+
+        held = [queue.reserve(capacity = 2, config = config).lease_nowait() for _ in range(2)]
+        parked = [queue.reserve(capacity = 2, config = config) for _ in range(4)]
+        assert queue.snapshot().queued == 4
+
+        with pytest.raises(LlamaAdmissionQueueFull):
+            queue.reserve(capacity = 2, config = config)
+
+        for reservation in parked:
+            reservation.cancel()
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+def test_waiting_is_never_timed_out_by_default():
+    # "Wait forever": the default config sets no queue timeout at all.
+    assert llama_admission_config_from_env().queue_timeout_s is None
+    assert LlamaAdmissionConfig().queue_timeout_s is None
+
+
+def test_single_request_at_a_time_never_queues_or_allocates_waiters():
+    # The common serving case: one request in flight at a time must take a slot
+    # straight away and never touch the wait line.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+        for _ in range(50):
+            reservation = queue.reserve(capacity = 4, config = config)
+            lease = reservation.lease_nowait()
+            assert lease is not None  # admitted immediately
+            assert queue.snapshot().queued == 0  # nobody ever lined up
+            lease.release()
+        snapshot = queue.snapshot()
+        assert (snapshot.active, snapshot.free, snapshot.queued) == (0, 4, 0)
+
+    asyncio.run(_run())
+
+
+def test_unbounded_queue_keeps_waiting_instead_of_rejecting():
+    # queue_per_slot None is the "pool + unbounded wait line" mode: nothing is
+    # ever rejected, callers just line up for the next free slot.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig(max_queue = None, queue_per_slot = None)
+
+        held = queue.reserve(capacity = 1, config = config).lease_nowait()
+        waiters = [queue.reserve(capacity = 1, config = config) for _ in range(200)]
+        assert queue.snapshot().queued == 200  # no LlamaAdmissionQueueFull
+
+        held.release()
+        first = await waiters[0].wait(0.1)
+        assert first is not None
+        first.release()
+        for waiter in waiters[1:]:
+            waiter.cancel()
+
+    asyncio.run(_run())
+
+
 def test_queue_full_rejects_excess_waiter():
     async def _run():
         queue = get_llama_admission_queue("http://llama.test")
@@ -288,6 +487,105 @@ def test_lease_release_is_idempotent_under_concurrent_calls():
     asyncio.run(_run())
 
 
+def test_releasing_a_stale_lease_does_not_free_someone_elses_slot():
+    # The concurrent test above passes without the _released guard: the racing
+    # calls all target a still-live slot, which the bitmask already absorbs. The
+    # case the guard exists for is a slot released twice with a reuse in between.
+    # It is live: _wait_for_openai_admission_non_streaming releases and re-raises,
+    # then the caller's finally cancels the reservation and releases the same
+    # lease again, by which point the slot can belong to another request.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        stale = queue.reserve(capacity = 1, config = config).lease_nowait()
+        stale.release()
+        other = queue.reserve(capacity = 1, config = config).lease_nowait()
+        assert other.slot == stale.slot  # the slot got reused
+
+        stale.release()
+        assert queue.snapshot().active == 1, "stale release handed back a live slot"
+        other.release()
+        assert queue.snapshot().active == 0
+
+    asyncio.run(_run())
+
+
+def test_grant_reclaims_the_slot_when_the_waiters_loop_is_gone():
+    # _grant_waiters_locked takes the slot before scheduling delivery, so if the
+    # schedule fails the bit is already set. Leaving it set strands the slot for
+    # good, because _free is rebuilt from the bitmask.
+    queue = get_llama_admission_queue("http://llama.test")
+    config = LlamaAdmissionConfig()
+    held = None
+
+    dead = asyncio.new_event_loop()
+    try:
+
+        async def _fill_and_queue():
+            nonlocal held
+            held = queue.reserve(capacity = 1, config = config).lease_nowait()
+            assert queue.reserve(capacity = 1, config = config).lease_nowait() is None
+
+        dead.run_until_complete(_fill_and_queue())
+    finally:
+        dead.close()
+
+    held.release()  # grant path now hits the closed loop
+    assert queue.snapshot().active == 0
+    assert queue.is_idle()
+
+
+def test_cancel_returns_the_granted_slot_when_the_waiters_loop_is_gone():
+    # Routes cancel() from finally blocks, so a raise here would mask their
+    # exception and skip the release that hands the granted slot back.
+    queue = get_llama_admission_queue("http://llama.test")
+    config = LlamaAdmissionConfig()
+    held = reservation = None
+
+    dead = asyncio.new_event_loop()
+    try:
+
+        async def _fill_and_queue():
+            nonlocal held, reservation
+            held = queue.reserve(capacity = 1, config = config).lease_nowait()
+            reservation = queue.reserve(capacity = 1, config = config)
+
+        dead.run_until_complete(_fill_and_queue())
+        held.release()  # promotes the waiter, so cancel() has a lease to return
+    finally:
+        dead.close()
+
+    reservation.cancel()
+    assert queue.snapshot().active == 0
+    assert queue.is_idle()
+
+
+def test_delivery_to_an_already_finished_waiter_releases_the_slot():
+    # A slot is taken before delivery is scheduled, so if the waiter finishes in
+    # that window someone has to hand it back. _deliver_lease does it twice over,
+    # in the dead-waiter branch and in the InvalidStateError backstop; this pins
+    # the outcome, not which one. Reaches into the waiter because no public call
+    # leaves that window open: queue.cancel() reclaims granted_lease itself.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        held = queue.reserve(capacity = 1, config = config).lease_nowait()
+        reservation = queue.reserve(capacity = 1, config = config)
+        waiter = reservation._waiter
+
+        held.release()  # schedules _deliver_lease, sets granted_lease
+        waiter.future.cancel()  # finishes the future before the callback runs
+        assert waiter.granted_lease is not None
+        await asyncio.sleep(0)  # let the callback run
+
+        assert queue.snapshot().active == 0
+        assert queue.is_idle()
+
+    asyncio.run(_run())
+
+
 def test_new_key_evicts_idle_prior_load_queues():
     # Each model load carries a fresh ephemeral port, so a new base_url key must
     # not leave the drained queues from earlier loads accumulating forever.
@@ -318,3 +616,453 @@ def test_new_key_retains_in_flight_prior_load_queue():
         assert set(llama_admission._QUEUES) == {"http://127.0.0.1:2003"}
 
     asyncio.run(_run())
+
+
+def test_capacity_shrink_never_admits_past_the_new_ceiling():
+    # A load that downshifts --parallel (or an unload resetting it to 1) shrinks the
+    # pool while slots are still held. Those holdovers keep occupying the backend, so
+    # they must count against the ceiling; sizing on free ids alone over-admits.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        held = [queue.reserve(capacity = 4, config = config).lease_nowait() for _ in range(4)]
+        assert all(lease is not None for lease in held)
+        waiter = queue.reserve(capacity = 4, config = config)
+
+        queue.reserve(capacity = 1, config = config)  # capacity collapses to 1
+        # Release the one id that still falls inside the shrunk pool, so it goes
+        # back on the free list; ids at or above capacity retire instead.
+        low = min(held, key = lambda lease: lease.slot)
+        assert low.slot == 0
+        low.release()
+
+        # The other 3 holdovers are still generating, which already meets the new
+        # ceiling, so the freed id must not be handed on. Gating on "is an id free"
+        # alone grants it here and puts 4 generations on a 1-slot backend.
+        with pytest.raises(asyncio.TimeoutError):
+            await waiter.wait(0.2)
+        assert queue.snapshot().active == 3
+
+        waiter.cancel()
+        for lease in held:
+            if lease is not low:
+                lease.release()
+
+    asyncio.run(_run())
+
+
+def test_queue_per_slot_env_is_parsed(monkeypatch):
+    monkeypatch.setenv(ADMISSION_QUEUE_PER_SLOT_ENV, "4")
+    assert llama_admission_config_from_env().queue_limit(32) == 128
+    # Non-positive asks for an unbounded line rather than rejecting everything.
+    monkeypatch.setenv(ADMISSION_QUEUE_PER_SLOT_ENV, "0")
+    assert llama_admission_config_from_env().queue_limit(32) is None
+
+
+def test_max_queue_zero_from_env_is_unbounded_end_to_end(monkeypatch):
+    # Guards the whole env path, not just the parsed field: a regression that let
+    # queue_per_slot survive MAX_QUEUE=0 would silently re-bound the line.
+    monkeypatch.setenv(ADMISSION_MAX_QUEUE_ENV, "0")
+    config = llama_admission_config_from_env()
+    assert config.max_queue is None and config.queue_per_slot is None
+    assert config.queue_limit(1) is None and config.queue_limit(64) is None
+
+
+def test_legacy_env_fallback_covers_every_setting(monkeypatch):
+    for canonical, legacy in llama_admission._LEGACY_ENV.items():
+        monkeypatch.delenv(canonical, raising = False)
+        monkeypatch.setenv(legacy, "0" if "CONTROL" in canonical else "7")
+    config = llama_admission_config_from_env()
+    assert config.enabled is False
+    assert config.queue_timeout_s == 7.0
+    assert config.keepalive_interval_s == 7.0
+    assert config.max_queue == 7
+
+
+def test_empty_canonical_env_falls_through_to_legacy(monkeypatch):
+    # The branch _raw_env exists for: set but blank must not mask the legacy name.
+    monkeypatch.setenv(ADMISSION_CONTROL_ENV, "   ")
+    monkeypatch.setenv(llama_admission._LEGACY_ENV[ADMISSION_CONTROL_ENV], "0")
+    assert llama_admission_config_from_env().enabled is False
+
+
+def test_explicit_queue_per_slot_is_not_floored(monkeypatch):
+    # The floor exists so a 1-slot backend keeps its old depth by default, not to
+    # override an operator who asked for a shallow line.
+    monkeypatch.setenv(ADMISSION_QUEUE_PER_SLOT_ENV, "2")
+    config = llama_admission_config_from_env()
+    assert config.queue_limit(1) == 2
+    assert config.queue_limit(8) == 16
+
+    # Unset, the default multiplier is floored instead.
+    monkeypatch.delenv(ADMISSION_QUEUE_PER_SLOT_ENV, raising = False)
+    assert llama_admission_config_from_env().queue_limit(1) == 64
+
+    # A value that does not parse falls back to the default multiplier, so it has
+    # to keep the default's floor. Otherwise a typo quietly shrinks the line 4x.
+    for garbage in ("abc", "1e3", "16.0"):
+        monkeypatch.setenv(ADMISSION_QUEUE_PER_SLOT_ENV, garbage)
+        assert llama_admission_config_from_env().queue_limit(1) == 64, garbage
+
+
+def test_module_imports_on_python_39(monkeypatch):
+    """No 3.10+ API on an import path. The package declares >=3.9 but CI only
+    runs 3.12, so a regression here would ship broken."""
+    import ast
+    import pathlib
+
+    src = pathlib.Path(llama_admission.__file__).read_text(encoding = "utf-8")
+    tree = ast.parse(src)
+
+    # int.bit_count() (3.10+)
+    assert not [
+        n
+        for n in ast.walk(tree)
+        if isinstance(n, ast.Call)
+        and isinstance(n.func, ast.Attribute)
+        and n.func.attr == "bit_count"
+    ]
+    # dataclass(slots = ...) is 3.10+, so every dataclass must take it through
+    # the version gate instead of naming it. A new one that forgets the gate
+    # loses slots silently, so require the **_SLOTS unpack rather than allow it.
+    seen = 0
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Call):
+            continue
+        name = getattr(node.func, "id", None) or getattr(node.func, "attr", None)
+        if name != "dataclass":
+            continue
+        seen += 1
+        assert "slots" not in {kw.arg for kw in node.keywords}
+        assert [
+            kw
+            for kw in node.keywords
+            if kw.arg is None and getattr(kw.value, "id", None) == "_SLOTS"
+        ], ast.dump(node)
+    assert seen
+
+
+def test_slots_gate_matches_the_running_interpreter():
+    """The gate is only worth having if it actually applies where it can."""
+    import sys
+
+    gated = (LlamaAdmissionConfig, llama_admission.LlamaAdmissionSnapshot, llama_admission._Waiter)
+    if sys.version_info >= (3, 10):
+        assert llama_admission._SLOTS == {"slots": True}
+        for cls in gated:
+            assert getattr(cls, "__slots__", None), cls
+    else:
+        assert llama_admission._SLOTS == {}
+
+    # Construct through the gate either way: slots=True rebuilds the class, so a
+    # field it cannot carry over would only show up on instantiation.
+    config = LlamaAdmissionConfig(max_queue = 7)
+    assert config.max_queue == 7 and config.queue_limit(4) == 7
+    assert llama_admission.LlamaAdmissionSnapshot("k", 1, 1, 0).capacity == 1
+
+
+def test_held_count_tracks_the_bitmask():
+    # _held replaces int.bit_count(); the two must never drift apart.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+        popcount = lambda: bin(queue._in_use).count("1")
+
+        leases = [queue.reserve(capacity = 4, config = config).lease_nowait() for _ in range(4)]
+        assert queue._held == popcount() == 4
+        leases[1].release()
+        assert queue._held == popcount() == 3
+        shrunk = queue.reserve(capacity = 2, config = config)  # shrink with slots held
+        assert queue._held == popcount() == 3
+        shrunk.cancel()  # else it is granted a slot as the others drain
+        for lease in leases:
+            lease.release()
+        assert queue._held == popcount() == 0
+
+    asyncio.run(_run())
+
+
+def test_snapshot_free_never_exceeds_what_can_be_admitted():
+    # After a shrink, low ids can sit in _free while holdovers fill the ceiling.
+    # Reporting them as free made the admission log contradict itself.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        held = [queue.reserve(capacity = 4, config = config).lease_nowait() for _ in range(4)]
+        queue.reserve(capacity = 1, config = config)  # capacity collapses to 1
+        min(held, key = lambda lease: lease.slot).release()
+
+        snapshot = queue.snapshot()
+        assert snapshot.free == 0, snapshot  # nothing is actually takeable
+        assert snapshot.active == 3
+        for lease in held:
+            lease.release()
+
+    asyncio.run(_run())
+
+
+def test_a_newcomer_does_not_barge_past_a_parked_waiter():
+    # Anti-starvation, pinned as behaviour rather than as the `if not self._waiters`
+    # check: _take_slot_locked consults _can_admit_locked anyway, so either alone
+    # refuses the newcomer. This fails if both ever go.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        held = queue.reserve(capacity = 1, config = config).lease_nowait()
+        parked = queue.reserve(capacity = 1, config = config)
+        assert parked.lease_nowait() is None
+
+        held.release()
+        newcomer = queue.reserve(capacity = 1, config = config)
+        assert newcomer.lease_nowait() is None, "newcomer barged past the parked waiter"
+        assert (await parked.wait(0.1)) is not None
+
+    asyncio.run(_run())
+
+
+def test_dead_waiters_stop_counting_against_the_queue_limit():
+    # A future cancelled out of band leaves the entry in the deque: cancel() is not
+    # called, so only the prune drops it. Without that, depth, is_idle() and the
+    # queue-full limit all drift for the life of the queue.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig(max_queue = 2)
+
+        held = queue.reserve(capacity = 1, config = config).lease_nowait()
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+        assert queue.snapshot().queued == 2
+        with pytest.raises(LlamaAdmissionQueueFull):
+            queue.reserve(capacity = 1, config = config)
+
+        first._waiter.future.cancel()
+        second._waiter.future.cancel()
+        assert queue.snapshot().queued == 0, "dead waiters still occupy the line"
+        # The freed depth is usable again, and an idle queue is evictable.
+        queue.reserve(capacity = 1, config = config).cancel()
+        held.release()
+        assert queue.is_idle()
+
+    asyncio.run(_run())
+
+
+def test_parking_frees_the_slot_for_a_waiter():
+    """A holder waiting on a tool approval must not hold a decode slot.
+
+    It is not generating, and with several prompts unanswered every slot would
+    be held by a run parked on a human while llama-server sits idle.
+    """
+
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        first = queue.reserve(capacity = 1, config = config)
+        second = queue.reserve(capacity = 1, config = config)
+        first_lease = first.lease_nowait()
+        assert first_lease is not None
+        assert second.lease_nowait() is None
+
+        first_lease.park()
+        assert first_lease.slot is None, "the slot went back to the pool"
+        second_lease = await second.wait(0.1)
+        assert second_lease is not None, "parking did not free the slot"
+
+        # The parked holder keeps its lease, so releasing it is still correct.
+        first_lease.unpark()
+        first_lease.release()
+        second_lease.release()
+        assert queue.snapshot().active == 0
+
+    asyncio.run(_run())
+
+
+def test_unpark_without_park_is_a_no_op():
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        first = queue.reserve(capacity = 1, config = config)
+        first_lease = first.lease_nowait()
+        assert first_lease is not None
+        first_lease.unpark()
+        first_lease.unpark()
+
+        second = queue.reserve(capacity = 1, config = config)
+        assert second.lease_nowait() is None, "capacity leaked past the limit"
+
+    asyncio.run(_run())
+
+
+def test_releasing_a_parked_lease_leaves_the_queue_evictable():
+    # is_idle() drives registry eviction, and a parked holder owns no slot, so
+    # nothing but the parked count keeps its queue alive. A stuck count would
+    # pin every dead queue for the life of the process.
+    async def _run():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        lease = queue.reserve(capacity = 1, config = config).lease_nowait()
+        lease.park()
+        assert not queue.is_idle(), "a parked holder is coming back to this queue"
+        lease.release()
+        assert queue.is_idle()
+
+    asyncio.run(_run())
+
+
+def test_unpark_waits_instead_of_putting_two_holders_on_one_slot():
+    # park() hands the freed slot to a waiter, so by the time the user answers an approval
+    # prompt someone else may be decoding in it. Resuming regardless left two holders
+    # against capacity 1, and the resumed tool loop went past the admission limit.
+    async def scenario():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        a = queue.reserve(capacity = 1, config = config)
+        a_lease = a.lease_nowait()
+        assert a_lease is not None, "A takes the only slot"
+        b = queue.reserve(capacity = 1, config = config)
+        assert b.lease_nowait() is None, "B waits behind A"
+
+        a_lease.park()  # A parks on an approval prompt; its slot goes to B
+        b_lease = await asyncio.wait_for(b.wait(timeout_s = 1), timeout = 2)
+        assert b_lease is not None, "B was granted the parked slot"
+
+        # A answers the prompt while B is still decoding: it must WAIT.
+        resumed = asyncio.ensure_future(a_lease.unpark_async(poll_s = 0.01))
+        await asyncio.sleep(0.05)
+        assert not resumed.done(), "A must not resume while B holds the slot"
+        assert queue.snapshot().active <= 1, "never over capacity while waiting"
+
+        b_lease.release()
+        await asyncio.wait_for(resumed, timeout = 2)
+        assert a_lease.slot is not None, "A took a real slot back"
+        assert queue.snapshot().active <= 1, "still within capacity after resuming"
+
+    asyncio.run(scenario())
+
+
+def test_unpark_gives_up_when_the_caller_is_cancelled():
+    # A holder being torn down must not sit in the wait loop.
+    async def scenario():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+        a = queue.reserve(capacity = 1, config = config)
+        a_lease = a.lease_nowait()
+        assert a_lease is not None
+        b = queue.reserve(capacity = 1, config = config)
+        a_lease.park()
+        assert await asyncio.wait_for(b.wait(timeout_s = 1), timeout = 2) is not None
+
+        ev = threading.Event()
+        waiting = asyncio.ensure_future(a_lease.unpark_async(cancel_event = ev, poll_s = 0.01))
+        await asyncio.sleep(0.03)
+        assert not waiting.done()
+        ev.set()
+        await asyncio.wait_for(waiting, timeout = 2)
+        assert a_lease.slot is None, "gave up without a slot rather than over-admitting"
+
+    asyncio.run(scenario())
+
+
+def test_an_approved_chat_is_not_overtaken_by_later_arrivals():
+    # A parks on an approval prompt, B takes the slot, C arrives afterwards. release() grants
+    # under the same lock, so a plain poll in unpark_async never saw a free slot: A waited
+    # behind every later arrival and starved.
+    async def scenario():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        a = queue.reserve(capacity = 1, config = config)
+        a_lease = a.lease_nowait()
+        assert a_lease is not None
+        b = queue.reserve(capacity = 1, config = config)
+        a_lease.park()  # A's slot goes to B
+        b_lease = await asyncio.wait_for(b.wait(timeout_s = 1), timeout = 2)
+        assert b_lease is not None
+
+        # A is approved and starts waiting; C arrives only after that.
+        resumed = asyncio.ensure_future(a_lease.unpark_async(poll_s = 0.01))
+        await asyncio.sleep(0.03)
+        c = queue.reserve(capacity = 1, config = config)
+        assert c.lease_nowait() is None
+
+        b_lease.release()  # the slot frees exactly once
+        await asyncio.wait_for(resumed, timeout = 2)
+        # A resumed; C is still queued behind it rather than having overtaken it.
+        assert c.lease_nowait() is None
+        assert queue.snapshot().active <= 1
+
+    asyncio.run(scenario())
+
+
+def test_two_approved_chats_do_not_block_each_other():
+    # A bare pending-count made every approved holder count against every other: park A, admit
+    # and park B, admit C, approve both, and once C released the predicate stayed false forever.
+    async def scenario():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        a = queue.reserve(capacity = 1, config = config)
+        a_lease = a.lease_nowait()
+        assert a_lease is not None
+        b = queue.reserve(capacity = 1, config = config)
+        a_lease.park()  # A parks; B is admitted
+        b_lease = await asyncio.wait_for(b.wait(timeout_s = 1), timeout = 2)
+        assert b_lease is not None
+
+        c = queue.reserve(capacity = 1, config = config)
+        b_lease.park()  # B parks too; C is admitted
+        c_lease = await asyncio.wait_for(c.wait(timeout_s = 1), timeout = 2)
+        assert c_lease is not None
+
+        # Both approvals come back while C is still decoding.
+        first = asyncio.ensure_future(a_lease.unpark_async(poll_s = 0.01))
+        await asyncio.sleep(0.02)
+        second = asyncio.ensure_future(b_lease.unpark_async(poll_s = 0.01))
+        await asyncio.sleep(0.02)
+        assert not first.done() and not second.done()
+
+        c_lease.release()
+        # The earlier approval goes first; the other follows once it releases.
+        await asyncio.wait_for(first, timeout = 2)
+        assert not second.done(), "the second approval waits its turn, not forever"
+        a_lease.release()
+        await asyncio.wait_for(second, timeout = 2)
+        assert queue.snapshot().active <= 1
+
+    asyncio.run(scenario())
+
+
+def test_an_immediate_arrival_cannot_take_an_approved_chats_slot():
+    # The fairness reservation lived only in _grant_waiters_locked. reserve()'s fast path
+    # ignored it, so a request arriving in the window between the slot freeing and the
+    # approved chat's next poll took the slot straight off the top.
+    async def scenario():
+        queue = get_llama_admission_queue("http://llama.test")
+        config = LlamaAdmissionConfig()
+
+        a = queue.reserve(capacity = 1, config = config)
+        a_lease = a.lease_nowait()
+        assert a_lease is not None
+        a_lease.park()  # A is on an approval prompt; its slot is up for grabs
+        b = queue.reserve(capacity = 1, config = config)
+        b_lease = b.lease_nowait()
+        assert b_lease is not None
+
+        resumed = asyncio.ensure_future(a_lease.unpark_async(poll_s = 0.01))
+        await asyncio.sleep(0.03)  # A is approved and now holds a ticket
+
+        # No await between these two: C arrives before A's poll can run again.
+        b_lease.release()
+        c = queue.reserve(capacity = 1, config = config)
+        assert c.lease_nowait() is None, "the freed slot is reserved for the approved chat"
+
+        await asyncio.wait_for(resumed, timeout = 2)
+        assert queue.snapshot().active <= 1
+
+    asyncio.run(scenario())
diff --git a/studio/backend/tests/test_llama_cpp_tool_loop.py b/studio/backend/tests/test_llama_cpp_tool_loop.py
index cf41d540f1..7b20063892 100644
--- a/studio/backend/tests/test_llama_cpp_tool_loop.py
+++ b/studio/backend/tests/test_llama_cpp_tool_loop.py
@@ -2076,6 +2076,50 @@ def test_large_python_tool_call_emits_early_provisional_start(monkeypatch):
     assert any(e.get("type") == "tool_end" and e.get("tool_name") == "python" for e in events)
 
 
+def test_gated_python_call_still_streams_its_arguments(monkeypatch):
+    """A call awaiting approval still streams its code into the card.
+
+    Suppressing it left the chat completely blank for as long as the model took
+    to write the payload, which for a large file is minutes. Nothing runs before
+    the decision either way, and the code is what the user is approving.
+    """
+
+    big_code = "total = 0\n" + "\n".join(f"total += {i}" for i in range(120))
+    assert len(json.dumps({"code": big_code})) > _PROVISIONAL_ARGS_MIN_CHARS
+
+    first_stream = _streamed_structured_tool_call("python", {"code": big_code}, "call_gated")
+    final_stream = [_sse({"content": "Done."}), _done()]
+    payloads: list[dict] = []
+    backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
+
+    monkeypatch.setattr("core.inference.tools.execute_tool", lambda name, arguments, **_k: "OK")
+    monkeypatch.setattr("core.inference.llama_cpp.wait_tool_decision", lambda *_a, **_k: "allow")
+
+    events = list(
+        backend.generate_chat_completion_with_tools(
+            messages = [{"role": "user", "content": "write code"}],
+            tools = [{"type": "function", "function": {"name": "python"}}],
+            confirm_tool_calls = True,
+            permission_mode = "ask",
+            max_tool_iterations = 1,
+        )
+    )
+
+    tool_starts = [e for e in events if e.get("type") == "tool_start"]
+    provisional = [e for e in tool_starts if not e.get("arguments")]
+    assert len(provisional) == 1, tool_starts
+    assert provisional[0]["tool_call_id"] == "call_gated"
+
+    args_events = [e for e in events if e.get("type") == "tool_args"]
+    assert args_events, "gated call streamed no arguments"
+    assert "total += 119" in "".join(e["text"] for e in args_events)
+
+    # The approval prompt still fires, and it comes after the code is on screen.
+    gated = [e for e in tool_starts if e.get("awaiting_confirmation")]
+    assert gated, tool_starts
+    assert events.index(provisional[0]) < events.index(gated[0])
+
+
 def test_auto_mode_render_html_suppresses_provisional_card_under_confirm(monkeypatch):
     """render_html is no longer unconditionally safe (a networked canvas asks), so
     with confirm_tool_calls set under permission_mode="auto" its early provisional
diff --git a/studio/backend/tests/test_llama_cpp_update.py b/studio/backend/tests/test_llama_cpp_update.py
index 9e23242b97..8579e6bffb 100644
--- a/studio/backend/tests/test_llama_cpp_update.py
+++ b/studio/backend/tests/test_llama_cpp_update.py
@@ -473,6 +473,7 @@ def test_start_update_preserves_vulkan_via_env(monkeypatch, tmp_path):
     monkeypatch.setattr(freshness, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9518")
 
     def _on_start(cmd):
+        captured["cmd"] = cmd
         _write_install(
             install_dir,
             "b9518",
@@ -480,6 +481,7 @@ def test_start_update_preserves_vulkan_via_env(monkeypatch, tmp_path):
             asset = "llama-b9518-bin-ubuntu-vulkan-x64.tar.gz",
         )
 
+    captured: dict = {}
     popen_kwargs: dict = {}
     _patch_installer_popen(
         monkeypatch,
@@ -497,6 +499,8 @@ def test_start_update_preserves_vulkan_via_env(monkeypatch, tmp_path):
         time.sleep(0.05)
     assert job["state"] == "success", job
     assert popen_kwargs["env"]["UNSLOTH_FORCE_VULKAN"] == "1"
+    assert popen_kwargs["env"]["UNSLOTH_LLAMA_BACKEND"] == "vulkan"
+    assert "--llama-backend" in captured["cmd"] and "vulkan" in captured["cmd"]
 
 
 @pytest.mark.parametrize(
diff --git a/studio/backend/tests/test_llama_server_args.py b/studio/backend/tests/test_llama_server_args.py
index 3247578104..58fdbc972c 100644
--- a/studio/backend/tests/test_llama_server_args.py
+++ b/studio/backend/tests/test_llama_server_args.py
@@ -26,6 +26,7 @@ is_managed_flag = _lsa.is_managed_flag
 parse_cache_override = _lsa.parse_cache_override
 parse_cache_override_per_axis = _lsa.parse_cache_override_per_axis
 parse_ctx_override = _lsa.parse_ctx_override
+parse_gpu_layers_override = _lsa.parse_gpu_layers_override
 parse_split_mode_override = _lsa.parse_split_mode_override
 resolve_cache_type_kv = _lsa.resolve_cache_type_kv
 resolve_tensor_parallel = _lsa.resolve_tensor_parallel
@@ -453,6 +454,45 @@ def test_validate_extra_args_rejects_malformed_ctx_override():
         validate_extra_args(["--ctx-size", "abc"])
 
 
+# ── parse_gpu_layers_override ────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    "args,expected",
+    [
+        (None, None),
+        ([], None),
+        (["--top-k", "20"], None),
+        (["--gpu-layers", "20"], 20),
+        (["--gpu-layers=20"], 20),
+        (["--n-gpu-layers", "0"], 0),
+        (["-ngl", "-1"], -1),
+        (["-ngl", "12", "--gpu-layers", "20"], 20),
+    ],
+)
+def test_parse_gpu_layers_override(args, expected):
+    assert parse_gpu_layers_override(args) == expected
+
+
+@pytest.mark.parametrize(
+    "args",
+    [
+        ["--gpu-layers"],
+        ["--gpu-layers", "--top-k"],
+        ["--gpu-layers", "abc"],
+        ["--gpu-layers=-2"],
+    ],
+)
+def test_parse_gpu_layers_override_rejects_malformed_values(args):
+    with pytest.raises(ValueError, match = "gpu-layers|GPU layers"):
+        parse_gpu_layers_override(args)
+
+
+def test_validate_extra_args_rejects_malformed_gpu_layers_override():
+    with pytest.raises(ValueError, match = "GPU layers"):
+        validate_extra_args(["-ngl", "abc"])
+
+
 # ── parse_cache_override ─────────────────────────────────────────────
 
 
diff --git a/studio/backend/tests/test_mlx_inference_backend.py b/studio/backend/tests/test_mlx_inference_backend.py
index d49a2281a0..3d20dd4bcc 100644
--- a/studio/backend/tests/test_mlx_inference_backend.py
+++ b/studio/backend/tests/test_mlx_inference_backend.py
@@ -1,8 +1,11 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
+import json
+import subprocess
 import sys
 import types
 from contextlib import contextmanager
+from pathlib import Path
 from types import SimpleNamespace
 
 import pytest
@@ -376,6 +379,128 @@ def test_worker_share_object_receives_distributed_payload(monkeypatch):
     assert response["object"] == shared_obj
 
 
+def test_worker_activates_mlx_sidecar_before_hardware_detection(tmp_path):
+    backend_dir = Path(__file__).resolve().parent.parent
+    fake_modules = tmp_path / "base"
+    sidecar = tmp_path / ".venv_t5_530"
+    packages = {
+        fake_modules / "transformers" / "__init__.py": '__version__ = "4.57.6"\n',
+        fake_modules / "mlx" / "__init__.py": "",
+        fake_modules / "mlx" / "core.py": "",
+        fake_modules / "mlx_lm" / "__init__.py": "import transformers\n",
+        fake_modules / "mlx_lm" / "sample_utils.py": "",
+        fake_modules / "mlx_vlm" / "__init__.py": "",
+        sidecar / "transformers" / "__init__.py": '__version__ = "5.3.0"\n',
+    }
+    for path, contents in packages.items():
+        path.parent.mkdir(parents = True, exist_ok = True)
+        path.write_text(contents)
+
+    script = r"""
+import json
+import os
+import sys
+
+sys.path.insert(0, os.environ["FAKE_MODULES"])
+from core.inference import worker
+from utils.hardware import hardware
+import utils.mlx_repair as mlx_repair
+import utils.transformers_version as transformers_version
+
+bootstrap_roots = sorted(
+    {
+        name.split(".", 1)[0]
+        for name in sys.modules
+        if name.split(".", 1)[0]
+        in {
+            "huggingface_hub",
+            "mlx",
+            "mlx_lm",
+            "mlx_vlm",
+            "torch",
+            "transformers",
+            "unsloth",
+            "unsloth_zoo",
+        }
+    }
+)
+assert not bootstrap_roots, f"worker bootstrap imported ML modules: {bootstrap_roots}"
+
+worker.is_apple_silicon = lambda: True
+hardware.is_apple_silicon = lambda: True
+hardware._has_torch = lambda: False
+mlx_repair._mlx_versions_satisfy_minimums = lambda: True
+transformers_version._VENV_T5_530_DIR = os.environ["SIDECAR"]
+transformers_version._ensure_venv_t5_530_exists = lambda: True
+
+observed = {"bootstrap_roots": bootstrap_roots}
+
+def capture_active_version(_backend, _config, _responses):
+    module = sys.modules["transformers"]
+    observed["active"] = module.__version__
+    observed["file"] = module.__file__
+    observed["device"] = hardware.DEVICE.value
+
+class CommandQueue:
+    def get(self, timeout):
+        return {"type": "shutdown"}
+
+class ResponseQueue:
+    def put(self, _response):
+        pass
+
+worker._handle_load = capture_active_version
+worker.run_inference_process(
+    cmd_queue = CommandQueue(),
+    resp_queue = ResponseQueue(),
+    cancel_event = None,
+    config = {
+        "model_name": "Ministral-3-regression",
+        "hf_token": "",
+        "resolved_gpu_ids": None,
+        "device_backend": "mlx",
+    },
+)
+observed["tier"] = transformers_version.get_transformers_tier(
+    "Ministral-3-regression"
+)
+print("RESULT " + json.dumps(observed, sort_keys = True))
+"""
+    result = subprocess.run(
+        [sys.executable, "-c", script],
+        cwd = backend_dir,
+        env = {
+            **__import__("os").environ,
+            "FAKE_MODULES": str(fake_modules),
+            "SIDECAR": str(sidecar),
+            "UNSLOTH_STUDIO_HOME": str(tmp_path),
+            "HF_HOME": str(tmp_path / "hf"),
+            "HF_HUB_CACHE": str(tmp_path / "hf" / "hub"),
+            "HF_HUB_OFFLINE": "1",
+            "TRANSFORMERS_OFFLINE": "1",
+        },
+        capture_output = True,
+        text = True,
+    )
+
+    assert result.returncode == 0, result.stdout + result.stderr
+    result_line = next(
+        (
+            line.removeprefix("RESULT ")
+            for line in result.stdout.splitlines()
+            if line.startswith("RESULT ")
+        ),
+        None,
+    )
+    assert result_line is not None, result.stdout + result.stderr
+    observed = json.loads(result_line)
+    assert observed["bootstrap_roots"] == []
+    assert observed["tier"] == "530"
+    assert observed["device"] == "mlx"
+    assert observed["active"] == "5.3.0"
+    assert observed["file"] == str(sidecar / "transformers" / "__init__.py")
+
+
 def test_worker_share_object_oversize_notifies_peers(monkeypatch):
     from core.inference import worker
 
diff --git a/studio/backend/tests/test_model_ids.py b/studio/backend/tests/test_model_ids.py
index f9116afec3..38392c3906 100644
--- a/studio/backend/tests/test_model_ids.py
+++ b/studio/backend/tests/test_model_ids.py
@@ -37,6 +37,23 @@ def test_directory_path_uses_basename():
     assert public_model_id("a/b/c") == "c"
 
 
+def test_hf_cache_snapshot_recovers_the_repo_id():
+    from core.inference.model_ids import hf_cache_repo_id
+
+    # The snapshot basename is a commit sha, so recover org/name instead.
+    snapshot = (
+        "/home/u/.cache/huggingface/hub/models--unsloth--gemma-4-31B-it-GGUF"
+        "/snapshots/c1ac76e99d5513b141e8adde7288b85c3f9c32ec"
+    )
+    assert public_model_id(snapshot) == "unsloth/gemma-4-31B-it-GGUF"
+    # A file inside the snapshot resolves the same way, not to the file stem.
+    assert public_model_id(snapshot + "/gemma-4-31B-it-UD-Q5_K_XL.gguf") == (
+        "unsloth/gemma-4-31B-it-GGUF"
+    )
+    assert hf_cache_repo_id("/opt/models/plain.gguf") is None
+    assert hf_cache_repo_id(None) is None
+
+
 def test_relative_and_home_paths_are_sanitized():
     # ./ ../ ~ prefixed paths are local and must not be echoed raw.
     assert public_model_id("./model.gguf") == "model"
diff --git a/studio/backend/tests/test_openai_auto_download.py b/studio/backend/tests/test_openai_auto_download.py
new file mode 100644
index 0000000000..b1dde175da
--- /dev/null
+++ b/studio/backend/tests/test_openai_auto_download.py
@@ -0,0 +1,1782 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Opt-in auto-download of a GGUF a /v1 request names but this server lacks.
+
+No network: huggingface_hub, the consent probe and the Hub download service are
+all mocked. The invariant: with the setting off nothing here runs at all, and
+with it on a name not shaped like a repo still falls through to the resident model.
+"""
+
+import asyncio
+import time
+
+import pytest
+from fastapi import HTTPException
+
+import routes.inference as inference_route
+from core.inference import openai_auto_download as auto_dl
+from core.inference.local_model_resolver import warm_index_soon as _real_warm_index_soon
+from utils import openai_auto_switch_settings as settings
+
+
+class _Sibling:
+    def __init__(
+        self,
+        rfilename,
+        size = 0,
+        blob_id = None,
+    ):
+        self.rfilename = rfilename
+        self.size = size
+        self.blob_id = blob_id
+
+
+class _Info:
+    def __init__(
+        self,
+        siblings,
+        sha = "abc123",
+        gated = False,
+        private = False,
+    ):
+        self.siblings = siblings
+        self.sha = sha
+        self.gated = gated
+        self.private = private
+
+
+def _gguf_repo_info():
+    gb = 1024**3
+    return _Info(
+        [
+            _Sibling("model-UD-Q4_K_XL.gguf", 4 * gb),
+            _Sibling("model-UD-Q5_K_XL.gguf", 5 * gb),
+            _Sibling("model-Q8_0-00001-of-00002.gguf", 4 * gb),
+            _Sibling("model-Q8_0-00002-of-00002.gguf", 4 * gb),
+            _Sibling("mmproj-F16.gguf", 1 * gb),
+            _Sibling("mtp-model.gguf", 1 * gb),
+            _Sibling("README.md", 1024),
+        ]
+    )
+
+
+@pytest.fixture(autouse = True)
+def _clean_slot():
+    from core.inference import local_model_resolver
+
+    auto_dl.reset_for_tests()
+    # The hook warms the index in the background; drop it so a scan never leaks between tests.
+    local_model_resolver.invalidate_index()
+    yield
+    auto_dl.reset_for_tests()
+    local_model_resolver.invalidate_index()
+
+
+def _repo_not_found_error():
+    from huggingface_hub.utils import RepositoryNotFoundError
+    return RepositoryNotFoundError
+
+
+def _gated_error():
+    from huggingface_hub.utils import GatedRepoError
+    return GatedRepoError
+
+
+def _hub_error(error_type, status_code: int, message: str):
+    """Build a Hub exception across huggingface_hub majors.
+
+    huggingface_hub 1.x made ``response`` a required keyword-only argument and the
+    project floor is 0.34, so construct positionally and fall back. The positional
+    form carries no response, which hf_error_status reads, so attach one either way.
+    """
+    try:
+        exc = error_type(message)
+    except TypeError:
+        import httpx
+        exc = error_type(
+            message,
+            response = httpx.Response(
+                status_code,
+                request = httpx.Request("GET", "https://huggingface.co/api/models/org/repo"),
+            ),
+        )
+    if getattr(getattr(exc, "response", None), "status_code", None) != status_code:
+        from types import SimpleNamespace
+        try:
+            exc.response = SimpleNamespace(status_code = status_code)
+        except AttributeError:
+            pass
+    return exc
+
+
+def test_the_hub_error_helper_carries_a_status_on_both_majors():
+    # CI runs huggingface_hub 1.x and this box 0.x, and each takes only one of the
+    # constructor shapes. A helper that silently dropped the response would make an
+    # error-mapping test pass here and fail there.
+    from hub.utils.hf_errors import hf_error_status
+
+    class _Legacy(Exception):
+        """0.x: response is optional and unset when built positionally."""
+
+    class _Modern(Exception):
+        """1.x: response is required and keyword-only."""
+
+        def __init__(self, message, *, response):
+            super().__init__(message)
+            self.response = response
+
+    for error_type in (_Legacy, _Modern):
+        assert hf_error_status(_hub_error(error_type, 401, "unauthorized")) == 401
+
+
+@pytest.fixture
+def hub(monkeypatch):
+    """Wire the whole remote surface to fakes and record what was dispatched."""
+    import huggingface_hub
+    from hub.services.models import downloads
+
+    state = {
+        "info": _gguf_repo_info(),
+        "raise": None,
+        "auto_map": False,
+        "started": [],
+        "watched": [],
+        # What the hub service returns; accepted=False means no worker was launched.
+        "dispatch_result": {"job_key": "k", "state": "running", "accepted": True},
+        "on_probe": None,
+        "probes": 0,
+        "auth_denied": False,
+        "allow_ambient": None,
+    }
+
+    class _FakeApi:
+        def __init__(self, token = None):
+            state["token"] = token
+
+        def model_info(self, repo_id, **kwargs):
+            state["probes"] += 1
+            if state["on_probe"] is not None:
+                state["on_probe"]()
+            if state["raise"] is not None:
+                raise state["raise"]
+            return state["info"]
+
+    async def _start(
+        body,
+        hf_token = None,
+        *,
+        allow_ambient_token = True,
+    ):
+        state["started"].append((body.repo_id, body.gguf_variant, hf_token))
+        state["allow_ambient"] = allow_ambient_token
+        return state["dispatch_result"]
+
+    async def _no_watch(active, hf_token):
+        state["watched"].append(active)
+        return None
+
+    monkeypatch.setattr(huggingface_hub, "HfApi", _FakeApi)
+    monkeypatch.setattr(downloads, "download_model_response", _start)
+    # Keep the real watcher reachable: one test drives its cleanup directly.
+    state["real_watch"] = auto_dl._watch
+    monkeypatch.setattr(auto_dl, "_watch", _no_watch)
+    monkeypatch.setattr(auto_dl, "_enough_disk", lambda need: (True, 10 * 1024**4))
+    monkeypatch.setattr(auto_dl, "_auth_denied", lambda repo, token: state["auth_denied"])
+    monkeypatch.setattr(
+        "utils.security.consent._config_has_auto_map",
+        lambda repo, token = None: state["auto_map"],
+    )
+    return state
+
+
+def _run(model, hf_token = None):
+    return asyncio.run(auto_dl.maybe_auto_download(model, hf_token = hf_token))
+
+
+# --- pure helpers ------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "raw,expected",
+    [
+        ("org/repo:UD-Q4_K_XL", ("org/repo", "UD-Q4_K_XL")),
+        ("org/repo", ("org/repo", None)),
+        ("gpt-4", ("gpt-4", None)),
+        # A colon followed by a path segment is not a quant.
+        ("C:/models/x.gguf", ("C:/models/x.gguf", None)),
+        ("org/repo:", ("org/repo:", None)),
+        # An unrecognized GGUF below a subdirectory keys on its path, and that key is
+        # what the catalog advertises, so pinning it has to parse.
+        ("org/repo:build/llama-13b", ("org/repo", "build/llama-13b")),
+        # Still a path, not a variant: no Hub repo precedes the colon.
+        ("/home/me/models/x:build/llama-13b", ("/home/me/models/x:build/llama-13b", None)),
+        ("D:/models/repo:build/llama-13b", ("D:/models/repo:build/llama-13b", None)),
+    ],
+)
+def test_split_model_ref(raw, expected):
+    assert auto_dl.split_model_ref(raw) == expected
+
+
+@pytest.mark.parametrize(
+    "raw",
+    [
+        "gpt-4",  # no namespace: a foreign id, must keep falling through
+        "gpt-4o-mini",
+        "../../etc/passwd",
+        "https://evil.example/x",
+        "/abs/path/model.gguf",
+        "org/repo/extra",
+        "org/re..po",
+        "org/repo\nX-Injected: 1",
+        "",
+    ],
+)
+def test_not_downloadable(raw):
+    assert auto_dl.is_downloadable_ref(raw) is False
+
+
+@pytest.mark.parametrize(
+    "raw", ["unsloth/gemma-4-31B-it-GGUF", "unsloth/gemma-4-31B-it-GGUF:UD-Q5_K_XL"]
+)
+def test_downloadable(raw):
+    assert auto_dl.is_downloadable_ref(raw) is True
+
+
+def test_gguf_variants_skips_companions():
+    variants = auto_dl._gguf_variants(_gguf_repo_info().siblings)
+    # Companions are not quants of their own...
+    assert set(variants) == {"UD-Q4_K_XL", "UD-Q5_K_XL", "Q8_0"}
+    # ...but every quant fetches them, so they count, and shards sum on top.
+    companions = 2 * 1024**3  # mmproj + MTP drafter
+    assert variants["Q8_0"] == 8 * 1024**3 + companions
+    assert variants["UD-Q4_K_XL"] == 4 * 1024**3 + companions
+
+
+def test_looks_like_quant_separates_quants_from_foreign_tags():
+    assert auto_dl.looks_like_quant("UD-Q6_K_XL")
+    assert auto_dl.looks_like_quant("q4_k_m")
+    assert auto_dl.looks_like_quant("F16")
+    # Ollama-style tags are not quants and must not read as a GGUF reference.
+    assert not auto_dl.looks_like_quant("latest")
+    assert not auto_dl.looks_like_quant("8b")
+    assert not auto_dl.looks_like_quant(None)
+
+
+def test_match_variant_is_case_insensitive_and_exact():
+    variants = {"UD-Q4_K_XL": 1, "Q8_0": 2}
+    assert auto_dl._match_variant("ud-q4_k_xl", variants) == "UD-Q4_K_XL"
+    assert auto_dl._match_variant("Q5_K_M", variants) is None
+    # A bare id picks a real local label, never invents one.
+    assert auto_dl._match_variant(None, variants) in variants
+
+
+# --- admission ---------------------------------------------------------------
+
+
+def test_foreign_id_never_probes(hub):
+    assert _run("gpt-4") is None
+    assert hub["started"] == []
+
+
+def test_starts_download_and_asks_for_a_retry(hub):
+    refusal = _run("unsloth/x-GGUF:UD-Q5_K_XL")
+    assert refusal.status == 503
+    assert refusal.code == "model_downloading"
+    assert refusal.retry_after and refusal.retry_after > 0
+    assert "unsloth/x-GGUF:UD-Q5_K_XL" in refusal.message
+    assert hub["started"] == [("unsloth/x-GGUF", "UD-Q5_K_XL", None)]
+
+
+def test_bare_id_freezes_the_same_quant_a_manual_load_would_pick(hub):
+    from utils.models.model_config import _extract_quant_label, _pick_best_gguf
+
+    refusal = _run("unsloth/x-GGUF")
+    assert refusal.status == 503
+    repo, variant, _token = hub["started"][0]
+    expected = _extract_quant_label(
+        _pick_best_gguf([s.rfilename for s in _gguf_repo_info().siblings])
+    )
+    assert (repo, variant) == ("unsloth/x-GGUF", expected)
+    assert variant == "UD-Q4_K_XL"
+
+
+def test_missing_quant_lists_the_real_ones(hub):
+    refusal = _run("unsloth/x-GGUF:Q2_K")
+    assert refusal.status == 404 and refusal.code == "model_not_found"
+    assert "UD-Q4_K_XL" in refusal.message and "Q8_0" in refusal.message
+    assert hub["started"] == []
+
+
+def test_missing_repo_is_404_without_confirming_existence(hub):
+    hub["raise"] = _hub_error(_repo_not_found_error(), 404, "nope")
+    # An explicit quant is a deliberate GGUF reference, so a miss is answered.
+    refusal = _run("unsloth/not-real:UD-Q4_K_XL")
+    assert refusal.status == 404 and refusal.code == "model_not_found"
+    assert "not accessible" in refusal.message
+    assert hub["started"] == []
+
+
+def test_an_id_the_hub_does_not_know_falls_through(hub):
+    hub["raise"] = _hub_error(_repo_not_found_error(), 404, "nope")
+    # "vendor/model" is how LiteLLM names providers, so an unknown id stays a foreign label.
+    for foreign in (
+        "anthropic/claude-3.5-sonnet",
+        "openai/gpt-4o",
+        "meta-llama/llama-3-70b-instruct",
+    ):
+        assert _run(foreign) is None
+    assert hub["started"] == []
+
+
+def test_a_foreign_id_is_probed_once_then_cached(hub):
+    hub["raise"] = _hub_error(_repo_not_found_error(), 404, "nope")
+    assert _run("anthropic/claude-3.5-sonnet") is None
+    assert hub["probes"] == 1
+    # Every later request would otherwise pay another Hub round trip.
+    assert _run("anthropic/claude-3.5-sonnet") is None
+    assert hub["probes"] == 1
+
+
+def test_an_anonymous_404_does_not_silence_an_authorised_caller(hub):
+    # The Hub 404s a private repo, so a global verdict would hide it from the token holder.
+    hub["raise"] = _hub_error(_repo_not_found_error(), 404, "nope")
+    assert _run("myorg/private-GGUF") is None
+    assert hub["probes"] == 1
+
+    hub["raise"] = None
+    refusal = _run("myorg/private-GGUF", hf_token = "hf_caller_own")
+    assert hub["probes"] == 2
+    assert refusal.code == "model_downloading"
+
+
+def test_the_cache_is_per_token(hub):
+    hub["raise"] = _hub_error(_repo_not_found_error(), 404, "nope")
+    assert _run("myorg/private-GGUF", hf_token = "hf_a") is None
+    assert _run("myorg/private-GGUF", hf_token = "hf_a") is None
+    assert hub["probes"] == 1
+    # A different credential gets its own verdict.
+    assert _run("myorg/private-GGUF", hf_token = "hf_b") is None
+    assert hub["probes"] == 2
+
+
+def test_the_gated_message_names_the_header_that_actually_works(hub):
+    # Auto-download never uses the server's token, so a Studio setting would loop the caller.
+    hub["info"] = _Info(_gguf_repo_info().siblings, gated = "manual")
+    hub["auth_denied"] = True
+    refusal = _run("meta-llama/Llama-2-7b-hf")
+    assert "X-Unsloth-HF-Token" in refusal.message
+
+
+def test_gated_repo_is_403(hub):
+    hub["raise"] = _hub_error(_gated_error(), 403, "gated")
+    refusal = _run("meta-llama/Llama-2-7b-hf")
+    assert refusal.status == 403 and refusal.code == "model_access_denied"
+    assert hub["started"] == []
+
+
+def test_a_gated_repo_that_still_returns_metadata_is_403(hub):
+    # Metadata for a gated repo is not file access, so report the licence gate, not custom code.
+    hub["info"] = _Info(_gguf_repo_info().siblings, gated = "manual")
+    hub["auth_denied"] = True
+    refusal = _run("meta-llama/Llama-2-7b-hf")
+    assert refusal.status == 403 and refusal.code == "model_access_denied"
+    assert "licence" in refusal.message
+    assert hub["started"] == []
+
+
+def test_a_gated_repo_this_token_may_read_still_downloads(hub):
+    hub["info"] = _Info(_gguf_repo_info().siblings, gated = "manual")
+    refusal = _run("meta-llama/Llama-2-7b-hf")
+    assert refusal.code == "model_downloading"
+    assert len(hub["started"]) == 1
+
+
+def test_hub_unreachable_is_retryable(hub):
+    hub["raise"] = OSError("network down")
+    refusal = _run("unsloth/x-GGUF")
+    assert refusal.status == 503 and refusal.code == "model_lookup_failed"
+    assert refusal.retry_after
+    assert hub["started"] == []
+
+
+def test_non_gguf_repo_is_refused(hub):
+    hub["info"] = _Info([_Sibling("model.safetensors", 100), _Sibling("config.json", 10)])
+    refusal = _run("unsloth/plain-transformers:Q4_K_M")
+    assert refusal.status == 400 and refusal.code == "model_not_supported"
+    assert hub["started"] == []
+
+
+def test_a_bare_non_gguf_id_falls_through(hub):
+    # Without a quant this is indistinguishable from a foreign provider label.
+    hub["info"] = _Info([_Sibling("model.safetensors", 100)])
+    assert _run("unsloth/plain-transformers") is None
+    assert hub["started"] == []
+
+
+def test_remote_code_repo_is_refused(hub):
+    hub["auto_map"] = True
+    refusal = _run("someone/custom-arch-GGUF")
+    assert refusal.status == 403 and refusal.code == "remote_code_consent_required"
+    assert "Unsloth Studio" in refusal.message
+    assert hub["started"] == []
+
+
+def test_unreadable_config_fails_closed(hub):
+    # _config_has_auto_map returns None when it cannot tell; never assume safe.
+    hub["auto_map"] = None
+    refusal = _run("someone/unknown-GGUF")
+    assert refusal.status == 403 and refusal.code == "remote_code_consent_required"
+    assert hub["started"] == []
+
+
+def test_insufficient_disk_never_downgrades_the_quant(hub, monkeypatch):
+    monkeypatch.setattr(auto_dl, "_enough_disk", lambda need: (False, 1024**3))
+    refusal = _run("unsloth/x-GGUF:UD-Q5_K_XL")
+    assert refusal.status == 507 and refusal.code == "insufficient_disk_space"
+    assert hub["started"] == []
+
+
+def test_second_model_waits_for_the_first(hub):
+    assert _run("unsloth/first-GGUF").code == "model_downloading"
+    refusal = _run("unsloth/second-GGUF")
+    assert refusal.status == 503 and refusal.code == "model_download_busy"
+    assert "unsloth/first-GGUF" in refusal.message
+    # Only the first was dispatched.
+    assert len(hub["started"]) == 1
+
+
+def test_repeat_request_reports_progress_without_reprobing(hub, monkeypatch):
+    assert _run("unsloth/x-GGUF:UD-Q5_K_XL").code == "model_downloading"
+
+    async def _running(repo, variant):
+        return "running", None
+
+    async def _pct(repo, variant, expected, token):
+        return 42.0
+
+    monkeypatch.setattr(auto_dl, "_job_state", _running)
+    monkeypatch.setattr(auto_dl, "_progress_percent", _pct)
+    refusal = _run("unsloth/x-GGUF:UD-Q5_K_XL")
+    assert refusal.code == "model_downloading" and "42%" in refusal.message
+    assert len(hub["started"]) == 1
+
+
+def test_progress_is_scaled_to_a_percentage(monkeypatch):
+    # The hub service reports a 0-1 fraction; a raw 0.492 would render as "0%".
+    from hub.services.models import downloads
+
+    async def _fraction(
+        repo_id,
+        variant = "",
+        expected_bytes = 0,
+        hf_token = None,
+    ):
+        return {"progress": 0.492}
+
+    monkeypatch.setattr(downloads, "get_gguf_download_progress_response", _fraction)
+    percent = asyncio.run(auto_dl._progress_percent("org/repo", "Q4_K_M", 0, None))
+    assert percent == pytest.approx(49.2)
+
+
+def test_failed_job_surfaces_once_then_frees_the_slot(hub, monkeypatch):
+    assert _run("unsloth/x-GGUF").code == "model_downloading"
+
+    async def _errored(repo, variant):
+        return "error", "disk exploded"
+
+    monkeypatch.setattr(auto_dl, "_job_state", _errored)
+    refusal = _run("unsloth/x-GGUF")
+    assert refusal.status == 502 and "disk exploded" in refusal.message
+    # Slot released, so a different model can now start.
+    assert _run("unsloth/other-GGUF").code == "model_downloading"
+
+
+def test_hf_token_is_passed_to_the_worker(hub):
+    _run("unsloth/x-GGUF", hf_token = "hf_secret")
+    assert hub["started"][0][2] == "hf_secret"
+
+
+# --- the single-flight slot ---------------------------------------------------
+
+
+def test_a_refused_dispatch_is_not_reported_as_downloading(hub):
+    # The hub service can decline without raising (accepted=False), so the caller hears "busy".
+    hub["dispatch_result"] = {
+        "job_key": "unsloth/x-gguf::ud-q5_k_xl",
+        "state": "running",  # the blocking job's state, not ours
+        "accepted": False,
+        "generation": 3,
+    }
+    refusal = _run("unsloth/x-GGUF:UD-Q5_K_XL")
+    assert refusal.status == 503 and refusal.code == "model_download_busy"
+    # No watcher installed for a job that is not running.
+    assert hub["watched"] == []
+    # The slot is free, so an unrelated repo is still admitted.
+    assert auto_dl._active is None
+    hub["dispatch_result"] = {"job_key": "k", "state": "running", "accepted": True}
+    assert _run("unsloth/other-GGUF").code == "model_downloading"
+
+
+def test_an_adoptable_dispatch_still_tracks_the_existing_job(hub):
+    # accepted=True with claimed=False means it is already downloading (Hub UI); attach to it.
+    hub["dispatch_result"] = {"job_key": "k", "state": "running", "accepted": True}
+    assert _run("unsloth/x-GGUF:UD-Q5_K_XL").code == "model_downloading"
+    assert len(hub["watched"]) == 1
+
+
+def test_a_failed_status_probe_does_not_end_the_watch(hub, monkeypatch):
+    # A probe that raised says nothing: reading it as "idle" freed the slot mid-download.
+    from hub.services.models import downloads
+
+    async def _boom(repo_id, gguf_variant = ""):
+        raise RuntimeError("registry unavailable")
+
+    monkeypatch.setattr(downloads, "get_download_status_response", _boom)
+    state, error = asyncio.run(auto_dl._job_state("unsloth/x-GGUF", "UD-Q4_K_XL"))
+    assert (state, error) == ("unknown", None)
+
+
+def test_an_unknown_state_still_reports_the_download_to_a_retry(hub, monkeypatch):
+    assert _run("unsloth/x-GGUF:UD-Q4_K_XL").code == "model_downloading"
+
+    async def _unknown(repo, variant):
+        return "unknown", None
+
+    monkeypatch.setattr(auto_dl, "_job_state", _unknown)
+    # Still downloading as far as anyone knows, so the slot stays taken.
+    assert _run("unsloth/x-GGUF:UD-Q4_K_XL").code == "model_downloading"
+    assert _run("unsloth/other-GGUF").code == "model_download_busy"
+
+
+def test_a_hanging_code_probe_does_not_pin_the_slot(hub, monkeypatch):
+    # hf_hub_download and auth_check take no timeout and run while the provisional slot
+    # is held, so an unresponsive Hub stalled the request and reported every other model
+    # busy. Unchecked is not cleared, so the bounded probe refuses instead of admitting.
+    import threading
+
+    entered, release = threading.Event(), threading.Event()
+
+    def _hang(repo, token = None):
+        entered.set()
+        release.wait(30)
+        return False
+
+    monkeypatch.setattr("utils.security.consent._config_has_auto_map", _hang)
+    monkeypatch.setattr(auto_dl, "_CODE_PROBE_TIMEOUT_S", 0.2)
+
+    async def _timed():
+        # Time the await, not asyncio.run: the probe thread cannot be cancelled, so
+        # loop shutdown waits for it here in a way a long-lived server loop never does.
+        started = time.monotonic()
+        refusal = await auto_dl.maybe_auto_download("unsloth/x-GGUF:UD-Q4_K_XL")
+        waited = time.monotonic() - started
+        release.set()
+        return refusal, waited
+
+    refusal, waited = asyncio.run(_timed())
+    assert entered.is_set()
+    assert refusal.status == 403 and refusal.code == "remote_code_consent_required"
+    assert waited < 5
+    # The slot was handed back, so the next request is admitted rather than told busy.
+    assert auto_dl._active is None
+
+
+def test_a_hanging_auth_check_falls_through_to_the_download(hub, monkeypatch):
+    # Inconclusive, not denied: the download's own auth is the real gate, so a slow
+    # gated-repo check must not turn into a refusal.
+    import threading
+
+    hub["info"].gated = True
+    release = threading.Event()
+
+    def _hang(repo, token = None):
+        release.wait(30)
+        return True
+
+    monkeypatch.setattr(auto_dl, "_auth_denied", _hang)
+    monkeypatch.setattr(auto_dl, "_MODEL_INFO_TIMEOUT_S", 0.2)
+
+    async def _timed():
+        refusal = await auto_dl.maybe_auto_download("unsloth/x-GGUF:UD-Q4_K_XL")
+        release.set()
+        return refusal
+
+    assert asyncio.run(_timed()).code == "model_downloading"
+
+
+def test_a_companion_only_repo_is_not_held_at_busy(hub):
+    # mmproj and MTP files are companions, not quants, so such a repo is non-servable
+    # and falls through to the resident model. The busy probe accepted any .gguf, which
+    # stranded that ordinary traffic behind an unrelated multi-hour download.
+    assert _run("unsloth/x-GGUF:UD-Q4_K_XL").code == "model_downloading"
+    gb = 1024**3
+    hub["info"] = _Info([_Sibling("mmproj-F16.gguf", gb), _Sibling("mtp-model.gguf", gb)])
+    assert _run("unsloth/companions-GGUF") is None
+    # A repo that does hold a real quant is still a second download.
+    hub["info"] = _gguf_repo_info()
+    assert _run("unsloth/other-GGUF").code == "model_download_busy"
+
+
+def test_a_stale_watcher_cannot_release_a_newer_download(hub, monkeypatch):
+    # Variant A is downloading; its watcher holds the slot.
+    assert _run("unsloth/x-GGUF:UD-Q4_K_XL").code == "model_downloading"
+    watcher_a = hub["watched"][-1]
+
+    # A fails, so an adopting request surfaces the error and frees the slot.
+    real_job_state = auto_dl._job_state
+    errored = {"on": True}
+
+    async def _maybe_errored(repo, variant):
+        if errored["on"]:
+            return "error", "boom"
+        return await real_job_state(repo, variant)
+
+    monkeypatch.setattr(auto_dl, "_job_state", _maybe_errored)
+    assert _run("unsloth/x-GGUF:UD-Q4_K_XL").code == "model_download_failed"
+    errored["on"] = False
+
+    # The retry starts variant B of the same repo, which now owns the slot.
+    assert _run("unsloth/x-GGUF:UD-Q5_K_XL").code == "model_downloading"
+    watcher_b = hub["watched"][-1]
+    assert auto_dl._active is watcher_b
+
+    # Only now does A's watcher clean up. Keyed on repo_id alone, that cleared B.
+    errored["on"] = True
+    monkeypatch.setattr(auto_dl, "_WATCH_POLL_S", 0.0)
+    asyncio.run(hub["real_watch"](watcher_a, None))
+    assert auto_dl._active is watcher_b
+    assert _run("unsloth/other-GGUF").code == "model_download_busy"
+
+
+def test_a_cancelled_admission_does_not_wedge_the_slot(hub):
+    # CancelledError is a BaseException, so an `except Exception` cleanup would wedge the slot.
+    def _cancel():
+        raise asyncio.CancelledError()
+
+    hub["on_probe"] = _cancel
+
+    async def _cancelled_request():
+        with pytest.raises(asyncio.CancelledError):
+            await auto_dl.maybe_auto_download("unsloth/x-GGUF")
+
+    asyncio.run(_cancelled_request())
+    assert auto_dl._active is None
+    hub["on_probe"] = None
+    assert _run("unsloth/other-GGUF").code == "model_downloading"
+
+
+# --- route wiring ------------------------------------------------------------
+
+
+class _Url:
+    def __init__(self, path):
+        self.path = path
+
+
+class _Req:
+    def __init__(
+        self,
+        path = "/v1/chat/completions",
+        headers = None,
+    ):
+        self.url = _Url(path)
+        self.headers = headers or {}
+
+
+def _hook(model, request, enabled):
+    import utils.openai_auto_switch_settings as s
+
+    original = s.get_openai_auto_download_enabled
+    s.get_openai_auto_download_enabled = lambda: enabled
+    try:
+        return asyncio.run(inference_route._maybe_auto_download_model(model, request))
+    finally:
+        s.get_openai_auto_download_enabled = original
+
+
+def test_setting_off_does_nothing_at_all(hub):
+    # The compatibility invariant: no probe, no dispatch, no raise.
+    assert _hook("unsloth/x-GGUF:UD-Q5_K_XL", _Req(), enabled = False) is None
+    assert hub["started"] == []
+
+
+def test_hook_raises_the_openai_envelope_with_retry_after(hub):
+    from fastapi import HTTPException
+
+    with pytest.raises(HTTPException) as excinfo:
+        _hook("unsloth/x-GGUF:UD-Q5_K_XL", _Req(), enabled = True)
+    exc = excinfo.value
+    assert exc.status_code == 503
+    assert exc.headers and exc.headers["Retry-After"]
+    assert exc.detail["error"]["code"] == "model_downloading"
+    assert exc.detail["error"]["param"] == "model"
+    assert exc.detail["error"]["type"] == "api_error"
+
+
+def test_hook_uses_the_anthropic_envelope_on_messages(hub):
+    from fastapi import HTTPException
+
+    with pytest.raises(HTTPException) as excinfo:
+        _hook("unsloth/x-GGUF", _Req(path = "/v1/messages"), enabled = True)
+    detail = excinfo.value.detail
+    assert detail["type"] == "error"
+    assert detail["error"]["type"] == "api_error"
+
+
+def test_hook_swallows_unexpected_failures(hub, monkeypatch):
+    # A broken download path must not turn a servable request into a 500.
+    async def _boom(model, hf_token = None):
+        raise RuntimeError("boom")
+
+    monkeypatch.setattr(auto_dl, "maybe_auto_download", _boom)
+    assert _hook("unsloth/x-GGUF", _Req(), enabled = True) is None
+
+
+def test_hook_prefers_the_hub_header_token(hub):
+    from fastapi import HTTPException
+    from hub.dependencies import HUB_HF_TOKEN_HEADER
+
+    with pytest.raises(HTTPException):
+        _hook(
+            "unsloth/x-GGUF",
+            _Req(headers = {HUB_HF_TOKEN_HEADER: "hf_from_header"}),
+            enabled = True,
+        )
+    assert hub["started"][0][2] == "hf_from_header"
+
+
+# --- never answer as a different model ----------------------------------------
+
+
+class _CatalogInfo:
+    """Minimal stand-in for a local model the /v1/models scan listed."""
+
+    def __init__(self, model_id, path):
+        self.model_id = model_id
+        self.id = model_id
+        self.path = path
+
+
+class _Loaded:
+    """Minimal stand-in for the GGUF backend with one model resident."""
+
+    def __init__(
+        self,
+        identifier,
+        variant = None,
+        advertised = None,
+    ):
+        self.is_loaded = True
+        self.model_identifier = identifier
+        self.hf_variant = variant
+        self._openai_advertised_id = advertised
+
+
+def _reject(
+    model,
+    loaded,
+    monkeypatch,
+    *,
+    downloaded = False,
+    auto_switch = False,
+):
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(
+        "core.inference.local_model_resolver.resolve_local_gguf",
+        lambda name, **_kw: ("/p", None, name) if downloaded else None,
+    )
+    monkeypatch.setattr(
+        "utils.openai_auto_switch_settings.get_openai_auto_switch_enabled",
+        lambda: auto_switch,
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    return asyncio.run(inference_route._reject_unservable_model(model, _Req()))
+
+
+async def _fake_unavailable_message(model):
+    return f"The model '{model}' is not downloaded on this server."
+
+
+def test_wrong_quant_is_not_answered_by_the_loaded_one(monkeypatch):
+    # The reported bug: asking for UD-Q6_K_XL while UD-Q4_K_XL is resident returned 200.
+    loaded = _Loaded("unsloth/gemma-4-E2B-it-GGUF", "UD-Q4_K_XL")
+    with pytest.raises(HTTPException) as excinfo:
+        _reject("unsloth/gemma-4-E2B-it-GGUF:UD-Q6_K_XL", loaded, monkeypatch)
+    assert excinfo.value.status_code == 404
+
+
+def test_bare_repo_id_is_satisfied_by_any_loaded_quant(monkeypatch):
+    # No quant named means "this model", so the resident quant answers it.
+    loaded = _Loaded("unsloth/gemma-4-E2B-it-GGUF", "UD-Q4_K_XL")
+    assert _reject("unsloth/gemma-4-E2B-it-GGUF", loaded, monkeypatch) is None
+
+
+def test_matching_quant_is_served(monkeypatch):
+    loaded = _Loaded("unsloth/gemma-4-E2B-it-GGUF", "UD-Q4_K_XL")
+    assert _reject("unsloth/gemma-4-E2B-it-GGUF:ud-q4_k_xl", loaded, monkeypatch) is None
+
+
+def test_advertised_alias_counts_as_serving(monkeypatch):
+    # Loaded by path, requested by the repo id auto-switch advertised for it.
+    loaded = _Loaded("/cache/snap/abc", "UD-Q4_K_XL", "unsloth/gemma-4-E2B-it-GGUF")
+    assert _reject("unsloth/gemma-4-E2B-it-GGUF", loaded, monkeypatch) is None
+
+
+@pytest.mark.parametrize("foreign", ["gpt-4", "gpt-4o-mini", "claude-3-5-sonnet", "default"])
+def test_foreign_ids_still_fall_through(monkeypatch, foreign):
+    # Drop-in compatibility: an id with no namespace is a label, not a reference.
+    loaded = _Loaded("unsloth/gemma-4-E2B-it-GGUF", "UD-Q4_K_XL")
+    assert _reject(foreign, loaded, monkeypatch) is None
+
+
+def test_downloaded_but_auto_switch_off_says_so(monkeypatch):
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    with pytest.raises(HTTPException) as excinfo:
+        _reject("unsloth/B-GGUF", loaded, monkeypatch, downloaded = True)
+    assert "Switch model by request" in str(excinfo.value.detail)
+
+
+def test_a_failed_switch_is_reported_not_answered_by_the_resident_model(monkeypatch):
+    # On disk and switching allowed means the swap failed; the resident model is wrong weights.
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    with pytest.raises(HTTPException) as excinfo:
+        _reject("unsloth/B-GGUF", loaded, monkeypatch, downloaded = True, auto_switch = True)
+    assert excinfo.value.status_code == 503
+    assert excinfo.value.detail["error"]["code"] == "model_switch_failed"
+    assert excinfo.value.headers["Retry-After"] == "5"
+
+
+@pytest.mark.parametrize(
+    "foreign",
+    [
+        "anthropic/claude-3.5-sonnet",
+        "openai/gpt-4o",
+        "meta-llama/llama-3-70b-instruct",
+        "mistralai/Mistral-7B-Instruct-v0.2",
+    ],
+)
+def test_a_provider_prefixed_label_still_reaches_the_resident_model(foreign, monkeypatch):
+    # A namespace is how LiteLLM addresses providers, so reading it as a reference 404s them.
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    assert _reject(foreign, loaded, monkeypatch) is None
+
+
+def test_an_explicit_quant_is_still_refused(monkeypatch):
+    # A quant is the signal: no LiteLLM or OpenRouter id carries one.
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    with pytest.raises(HTTPException) as excinfo:
+        _reject("unsloth/B-GGUF:UD-Q6_K_XL", loaded, monkeypatch)
+    assert excinfo.value.status_code == 404
+
+
+def test_a_repo_that_is_here_is_refused_without_a_quant(monkeypatch):
+    # The other half of the evidence test: a repo this server has is a reference to it.
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    with pytest.raises(HTTPException) as excinfo:
+        _reject("unsloth/B-GGUF", loaded, monkeypatch, downloaded = True)
+    assert excinfo.value.status_code == 404
+
+
+def test_a_diagnosis_failure_does_not_serve_the_wrong_model(monkeypatch):
+    # The mismatch is already established, so falling through would answer as another model.
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+
+    def _boom(name, **_kw):
+        raise OSError("cache scan unavailable")
+
+    monkeypatch.setattr("core.inference.local_model_resolver.resolve_local_gguf", _boom)
+    with pytest.raises(HTTPException) as excinfo:
+        asyncio.run(inference_route._reject_unservable_model("unsloth/B-GGUF:UD-Q6_K_XL", _Req()))
+    assert excinfo.value.status_code == 404
+
+
+def test_nothing_loaded_leaves_the_existing_error_alone(monkeypatch):
+    # The handler's own no-model-loaded error is already correct; don't preempt it.
+    idle = type("B", (), {"is_loaded": False, "model_identifier": None, "hf_variant": None})()
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: idle)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    assert asyncio.run(inference_route._reject_unservable_model("unsloth/B-GGUF", _Req())) is None
+
+
+def test_reload_only_sentinel_is_ignored(monkeypatch):
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    assert _reject(inference_route._RELOAD_ONLY_MODEL, loaded, monkeypatch) is None
+
+
+def test_diagnosis_failure_never_breaks_a_servable_request(monkeypatch):
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+
+    def _boom(_name, **_kw):
+        raise RuntimeError("scan exploded")
+
+    monkeypatch.setattr("core.inference.local_model_resolver.resolve_local_gguf", _boom)
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    assert asyncio.run(inference_route._reject_unservable_model("unsloth/B-GGUF", _Req())) is None
+
+
+def test_anthropic_surface_gets_its_own_envelope(monkeypatch):
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(
+        "core.inference.local_model_resolver.resolve_local_gguf", lambda name, **_kw: None
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    with pytest.raises(HTTPException) as excinfo:
+        asyncio.run(
+            inference_route._reject_unservable_model(
+                "unsloth/B-GGUF:UD-Q6_K_XL", _Req(path = "/v1/messages")
+            )
+        )
+    assert excinfo.value.detail["type"] == "error"
+
+
+# --- settings ----------------------------------------------------------------
+
+
+def test_auto_download_defaults_off_and_is_gated_on_auto_switch(monkeypatch):
+    store = {}
+    monkeypatch.setattr(settings, "_cached_setting", lambda k, d = None: store.get(k, d))
+    assert settings.get_stored_openai_auto_download_enabled() is False
+    assert settings.get_openai_auto_download_enabled() is False
+
+    store[settings.OPENAI_AUTO_DOWNLOAD_SETTING_KEY] = True
+    # Stored on, but auto-switch off: nothing would load the result, so it is off.
+    assert settings.get_stored_openai_auto_download_enabled() is True
+    assert settings.get_openai_auto_download_enabled() is False
+
+    store[settings.OPENAI_AUTO_SWITCH_SETTING_KEY] = True
+    assert settings.get_openai_auto_download_enabled() is True
+
+
+def test_setter_round_trips_auto_download_in_one_transaction(monkeypatch):
+    import storage.studio_db as db
+
+    calls = []
+    store = {}
+
+    def _upsert(mapping):
+        calls.append(dict(mapping))
+        store.update(mapping)
+
+    monkeypatch.setattr(db, "upsert_app_settings", _upsert)
+    monkeypatch.setattr(settings, "_cached_setting", lambda k, d = None: store.get(k, d))
+
+    result = settings.set_openai_auto_switch(True, 120, None, True)
+    assert result == (True, 120, True, True)
+    assert len(calls) == 1
+    assert calls[0][settings.OPENAI_AUTO_DOWNLOAD_SETTING_KEY] is True
+
+
+def test_setter_rejects_a_non_boolean_auto_download(monkeypatch):
+    monkeypatch.setattr(settings, "_cached_setting", lambda k, d = None: None)
+    with pytest.raises(ValueError, match = "true or false"):
+        settings.set_openai_auto_switch(True, None, None, "garbage")
+
+
+def test_settings_route_exposes_auto_download(monkeypatch):
+    import routes.settings as settings_route
+
+    monkeypatch.setattr(settings_route, "get_openai_auto_switch_enabled", lambda: True)
+    monkeypatch.setattr(settings_route, "get_stored_auto_unload_idle_seconds", lambda: 0)
+    monkeypatch.setattr(settings_route, "get_auto_unload_idle_seconds", lambda: 0)
+    monkeypatch.setattr(settings_route, "get_auto_unload_keep_kv", lambda: True)
+    monkeypatch.setattr(settings_route, "get_stored_openai_auto_download_enabled", lambda: True)
+    assert settings_route.get_openai_auto_switch("tester").auto_download_model is True
+
+
+# --- the placeholder API key -------------------------------------------------
+
+
+def test_placeholder_api_key_gets_a_specific_message():
+    from auth.authentication import API_KEY_PLACEHOLDER, _invalid_api_key_detail
+
+    detail = _invalid_api_key_detail(API_KEY_PLACEHOLDER)
+    assert "placeholder" in detail
+    assert "Settings > API" in detail
+
+
+def test_every_other_bad_key_stays_indistinguishable():
+    from auth.authentication import _invalid_api_key_detail
+
+    generic = "Invalid or expired API key"
+    assert _invalid_api_key_detail("sk-unsloth-revoked") == generic
+    assert _invalid_api_key_detail("sk-unsloth-YOUR_KEY ") == generic
+    assert _invalid_api_key_detail("sk-unsloth-your_key") == generic
+
+
+def test_the_servers_own_hf_token_is_never_borrowed(monkeypatch):
+    # The repo is named by an API key holder, so the owner's Hub identity must not be used.
+    import routes.settings as settings_route
+
+    monkeypatch.setattr(settings_route, "_ambient_hf_token", lambda: "hf_owner_secret")
+    assert inference_route._auto_download_hf_token(_Req()) is None
+    caller = _Req(headers = {"X-Unsloth-HF-Token": "hf_caller_own"})
+    assert inference_route._auto_download_hf_token(caller) == "hf_caller_own"
+
+
+def test_a_quant_cannot_be_satisfied_by_a_non_gguf_backend(monkeypatch):
+    # llama.cpp matches :QUANT against hf_variant; Transformers has no quant identity.
+    idle = type("B", (), {"is_loaded": False, "model_identifier": None, "hf_variant": None})()
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: idle)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": "org/model"})(),
+    )
+    assert inference_route._loaded_satisfies("org/model") is True
+    assert inference_route._loaded_satisfies("org/model:Q4_K_M") is False
+    # An Ollama-style tag is not a claim about the weights, so it still matches.
+    assert inference_route._loaded_satisfies("org/model:latest") is True
+
+
+def test_the_worker_is_never_given_the_servers_own_token(hub):
+    # A falsy token would make the worker fall back to the server owner's HF_TOKEN.
+    assert _run("unsloth/x-GGUF").code == "model_downloading"
+    assert hub["started"][0][2] is None
+    assert hub["allow_ambient"] is False
+
+
+def test_the_metadata_probe_is_explicitly_anonymous(hub):
+    # token=None means "use the cached login" to huggingface_hub; only False is anonymous.
+    _run("unsloth/x-GGUF")
+    assert hub["token"] is False
+    auto_dl.reset_for_tests()
+    _run("unsloth/y-GGUF", hf_token = "hf_caller_own")
+    assert hub["token"] == "hf_caller_own"
+
+
+def test_an_ollama_tag_still_matches_the_resident_gguf(monkeypatch):
+    # looks_like_quant() calls these foreign, so they must not be checked against hf_variant.
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    assert inference_route._loaded_satisfies("unsloth/A-GGUF:latest") is True
+    assert inference_route._loaded_satisfies("unsloth/A-GGUF:8b") is True
+    assert inference_route._loaded_satisfies("unsloth/A-GGUF:UD-Q4_K_XL") is True
+    assert inference_route._loaded_satisfies("unsloth/A-GGUF:Q8_0") is False
+
+
+def test_a_probing_adoption_never_releases_the_slot(hub, monkeypatch):
+    # The whole-repo job key can hold a stale error that would free the probe's slot.
+    hub["on_probe"] = lambda: _run_nested()
+    seen = {}
+
+    def _run_nested():
+        async def _stale(repo, variant):
+            seen["queried"] = True
+            return "error", "an older failure"
+
+        monkeypatch.setattr(auto_dl, "_job_state", _stale)
+        seen["refusal"] = _run("unsloth/x-GGUF")
+
+    assert _run("unsloth/x-GGUF").code == "model_downloading"
+    assert seen["refusal"].code == "model_downloading"
+    assert "queried" not in seen  # the stale job key was never consulted
+
+
+def test_a_bpw_qualified_quant_is_a_quant_request():
+    # _extract_quant_label emits these for repos shipping several files at one base quant.
+    assert auto_dl.looks_like_quant("IQ4_XS-3.53bpw")
+    assert auto_dl.looks_like_quant("UD-Q4_K_XL-4.19BPW")
+    assert not auto_dl.looks_like_quant("3.53bpw")
+
+
+def test_the_default_pick_survives_lowercase_quant_labels():
+    # Preference tokens match case-sensitively, so a lower-case repo would take F16.
+    lowered = {"f16": 20, "ud-q4_k_xl": 4, "q8_0": 9}
+    assert auto_dl._match_variant(None, lowered) == "ud-q4_k_xl"
+    assert auto_dl._match_variant(None, {"F16": 20, "UD-Q4_K_XL": 4}) == "UD-Q4_K_XL"
+
+
+def test_a_slashless_local_model_is_still_a_concrete_reference(monkeypatch):
+    # /v1/models advertises these without a namespace, so a namespace decides nothing.
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    monkeypatch.setattr(
+        "utils.openai_auto_switch_settings.get_openai_auto_switch_enabled", lambda: False
+    )
+
+    monkeypatch.setattr(
+        "core.inference.local_model_resolver.resolve_local_gguf",
+        lambda name, **_kw: ("/p", None, name) if name.startswith("standalone-Q4_K_M") else None,
+    )
+    with pytest.raises(HTTPException) as excinfo:
+        asyncio.run(inference_route._reject_unservable_model("standalone-Q4_K_M", _Req()))
+    assert excinfo.value.status_code == 404
+
+    # A slashless name that is not here stays a foreign label.
+    monkeypatch.setattr(
+        "core.inference.local_model_resolver.resolve_local_gguf", lambda name, **_kw: None
+    )
+    assert asyncio.run(inference_route._reject_unservable_model("gpt-4", _Req())) is None
+    assert asyncio.run(inference_route._reject_unservable_model("default", _Req())) is None
+
+
+def test_a_cancelled_download_is_not_reported_as_failed(hub, monkeypatch):
+    # fail_open rendered a deliberate cancel as "Model download failed".
+    from core.inference import api_monitor as monitor_module
+
+    assert _run("unsloth/x-GGUF:UD-Q4_K_XL").code == "model_downloading"
+    active = hub["watched"][-1]
+
+    async def _cancelled(repo, variant):
+        return "cancelled", None
+
+    monkeypatch.setattr(auto_dl, "_job_state", _cancelled)
+    monkeypatch.setattr(auto_dl, "_WATCH_POLL_S", 0)
+    asyncio.run(hub["real_watch"](active, None))
+    [row] = [e for e in monitor_module.api_monitor.snapshot() if e["id"] == active.monitor_id]
+    assert row["status"] == "cancelled"
+    assert row.get("error") is None
+
+
+def test_disk_admission_counts_only_what_is_left_to_fetch(hub, monkeypatch):
+    # Charging again for bytes already on disk 507s a download that fits.
+    seen = {}
+
+    def _enough(need):
+        seen["need"] = need
+        return True, 10 * 1024**4
+
+    gb = 1024**3
+    hub["info"] = _Info(
+        [
+            _Sibling("model-UD-Q4_K_XL.gguf", 4 * gb, blob_id = "sha-main"),
+            _Sibling("mmproj-F16.gguf", 1 * gb, blob_id = "sha-mmproj"),
+            _Sibling("mtp-model.gguf", 1 * gb, blob_id = "sha-mtp"),
+        ]
+    )
+    monkeypatch.setattr(auto_dl, "_enough_disk", _enough)
+    monkeypatch.setattr(
+        "hub.utils.download_registry.existing_blob_bytes",
+        lambda repo_type, repo_id, hashes: 3 * gb,
+    )
+    assert _run("unsloth/x-GGUF:UD-Q4_K_XL").code == "model_downloading"
+    # 4 GB quant + 2 GB companions, 3 GB of which is already cached.
+    assert seen["need"] == 3 * gb
+
+
+def test_a_resolver_alias_for_the_resident_model_is_not_refused(monkeypatch):
+    # A manual load stores the on-disk path /v1/models aliases as publisher/model.
+    loaded = _Loaded("/models/publisher/model/weights.gguf", None)
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(
+        "core.inference.local_model_resolver.resolve_local_gguf",
+        lambda name, **_kw: ("/models/publisher/model/weights.gguf", None, "publisher/model"),
+    )
+    monkeypatch.setattr(
+        "utils.openai_auto_switch_settings.get_openai_auto_switch_enabled", lambda: False
+    )
+    assert asyncio.run(inference_route._reject_unservable_model("publisher/model", _Req())) is None
+
+
+def test_the_request_path_never_triggers_a_model_index_rescan(monkeypatch):
+    # The scan takes seconds under a lock, so this hook must answer from the last built index.
+    from core.inference import local_model_resolver as resolver
+
+    scans = []
+    warmed = []
+    monkeypatch.setattr(resolver, "_build_index", lambda: scans.append(1) or {})
+    monkeypatch.setattr(resolver, "_scan", (1.0, {}))
+    # Stub the warm: it is allowed to scan, just not on the thread serving the request.
+    monkeypatch.setattr(resolver, "warm_index_soon", lambda: warmed.append(1))
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    monkeypatch.setattr(
+        "utils.openai_auto_switch_settings.get_openai_auto_switch_enabled", lambda: False
+    )
+    for model in ("gpt-4", "anthropic/claude-3.5-sonnet", "unsloth/B-GGUF:UD-Q6_K_XL"):
+        try:
+            asyncio.run(inference_route._reject_unservable_model(model, _Req()))
+        except HTTPException:
+            pass
+    assert scans == []
+    assert warmed == [1, 1, 1]
+
+
+def test_a_cold_index_is_scanned_rather_than_read_as_nothing_here(monkeypatch):
+    # With no cached evidence yet, reading that as "not downloaded" answers a named
+    # local model with the resident one. Pay the scan once, off the loop.
+    from core.inference import local_model_resolver as resolver
+
+    entry = resolver._LocalGgufEntry("org/other", "/srv/models/org--other", ("Q4_K_M",))
+    scans = []
+
+    def _build():
+        scans.append(1)
+        return {"org/other": entry}
+
+    monkeypatch.setattr(resolver, "_scan", (0.0, {}))
+    monkeypatch.setattr(resolver, "_build_index", _build)
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    monkeypatch.setattr(
+        "utils.openai_auto_switch_settings.get_openai_auto_switch_enabled", lambda: False
+    )
+
+    # The bug: a bare name that IS on disk used to fall through to the resident model.
+    with pytest.raises(HTTPException) as excinfo:
+        asyncio.run(inference_route._reject_unservable_model("org/other", _Req()))
+    assert excinfo.value.status_code == 404
+    assert scans == [1], "the cold index was not scanned"
+
+    # Built now, so the request path reads the cache and never scans again.
+    assert asyncio.run(inference_route._reject_unservable_model("gpt-4", _Req())) is None
+    assert scans == [1]
+
+
+def test_a_cold_scan_that_never_finishes_says_so_instead_of_guessing(monkeypatch):
+    # The scan is bounded, but an unfinished one knows nothing about the name, and
+    # falling through would put the resident model behind it: answer "not yet".
+    import threading
+
+    from core.inference import local_model_resolver as resolver
+
+    monkeypatch.setattr(resolver, "_scan", (0.0, {}))
+    monkeypatch.setattr(inference_route, "_COLD_INDEX_WAIT_S", 0.05)
+    released = threading.Event()
+    monkeypatch.setattr(resolver, "_build_index", lambda: (released.wait(5), {})[1])
+    warmed = []
+    monkeypatch.setattr(resolver, "warm_index_soon", lambda: warmed.append(1))
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    try:
+        with pytest.raises(HTTPException) as excinfo:
+            asyncio.run(inference_route._reject_unservable_model("gpt-4", _Req()))
+        assert excinfo.value.status_code == 503
+        assert excinfo.value.headers.get("Retry-After")
+        assert warmed == [1], "the scan was not left to finish in the background"
+    finally:
+        released.set()
+
+
+def test_a_refusal_is_never_swallowed_by_the_cannot_verify_handler(monkeypatch):
+    # The checks run inside a broad `except Exception` that turns a failure to decide
+    # into a fallthrough. An HTTPException there is a decision, but was logged as a
+    # failure and answered by the resident model.
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+
+    def _boom(*_a, **_k):
+        raise HTTPException(status_code = 418, detail = "decided")
+
+    monkeypatch.setattr(inference_route, "_resolves_to_resident", _boom)
+    monkeypatch.setattr(
+        "core.inference.local_model_resolver.resolve_local_gguf",
+        lambda *_a, **_k: ("/srv/models/x", "Q4_K_M", "x"),
+    )
+    with pytest.raises(HTTPException) as excinfo:
+        asyncio.run(inference_route._reject_unservable_model("org/x", _Req()))
+    assert excinfo.value.status_code == 418
+
+
+def test_warming_the_index_never_waits_on_the_scan_lock(monkeypatch):
+    # _lock is held for the whole scan, so contending for it would park every later request.
+    import threading
+    import time as _time
+
+    from core.inference import local_model_resolver as resolver
+
+    monkeypatch.setattr(resolver, "_scan", (0.0, {}))
+    released = threading.Event()
+    monkeypatch.setattr(resolver, "_build_index", lambda: (released.wait(5), {})[1])
+    _real_warm_index_soon()
+    try:
+        started = _time.perf_counter()
+        _real_warm_index_soon()
+        resolver.resolve_local_gguf("unsloth/A-GGUF", allow_scan = False)
+        elapsed = _time.perf_counter() - started
+    finally:
+        released.set()
+        # Join before the monkeypatches unwind, or the scan publishes its stub result over them.
+        for _ in range(500):
+            if not resolver._warming:
+                break
+            _time.sleep(0.01)
+    assert elapsed < 0.5, f"request path blocked on the warm scan for {elapsed:.2f}s"
+
+
+def test_a_stale_index_is_refreshed_so_a_hub_download_becomes_visible(monkeypatch):
+    # Only the auto-download watcher calls invalidate_index, so a Hub UI download is seen
+    # only if the warm can run again.
+    from core.inference import local_model_resolver as resolver
+
+    scans = []
+    monkeypatch.setattr(resolver, "_build_index", lambda: scans.append(1) or {})
+    monkeypatch.setattr(resolver, "_scan", (time.monotonic() - resolver._CACHE_TTL_S - 1, {}))
+    monkeypatch.setattr(resolver, "_last_scan_s", 0.0)
+    _real_warm_index_soon()
+    for _ in range(500):
+        if scans and not resolver._warming:
+            break
+        time.sleep(0.01)
+    assert scans == [1]
+
+
+def test_an_id_v1_models_advertised_is_refused_before_the_resolver_warms(monkeypatch):
+    # /v1/models can advertise an unloaded local GGUF while the resolver index is cold. A bare
+    # id has no quant to refuse on, so without that evidence the resident model would answer.
+    from core.inference import local_model_resolver as resolver
+
+    monkeypatch.setattr(resolver, "_scan", (0.0, {}))
+    # Stub the walk: a real multi-root scan inside the cold-wait budget makes this
+    # test time out into a 503 under load instead of asserting what it is here for.
+    monkeypatch.setattr(resolver, "_build_index", lambda: {})
+    monkeypatch.setattr(
+        inference_route,
+        "_CATALOG_CACHE",
+        {"at": 1.0, "models": [_CatalogInfo("org/Other", "/srv/models/org--Other")]},
+    )
+    monkeypatch.setattr(inference_route, "_ADVERTISED_CACHE", {"at": None, "paths": {}})
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    with pytest.raises(HTTPException) as excinfo:
+        asyncio.run(inference_route._reject_unservable_model("org/Other", _Req()))
+    assert excinfo.value.status_code == 404
+    # An id the catalog never listed still proves nothing, so it falls through.
+    assert asyncio.run(inference_route._reject_unservable_model("org/Unlisted", _Req())) is None
+
+
+def test_an_advertised_alias_for_the_resident_weights_is_still_served(monkeypatch):
+    # The flip side: the catalog can list the resident weights under an alias, which is not
+    # evidence of a different model.
+    from core.inference import local_model_resolver as resolver
+
+    monkeypatch.setattr(resolver, "_scan", (0.0, {}))
+    # Stub the walk: a real multi-root scan inside the cold-wait budget makes this
+    # test time out into a 503 under load instead of asserting what it is here for.
+    monkeypatch.setattr(resolver, "_build_index", lambda: {})
+    monkeypatch.setattr(
+        inference_route,
+        "_CATALOG_CACHE",
+        {"at": 2.0, "models": [_CatalogInfo("publisher/Qwen3", "/srv/models")]},
+    )
+    monkeypatch.setattr(inference_route, "_ADVERTISED_CACHE", {"at": None, "paths": {}})
+    loaded = _Loaded("/srv/models/Qwen3-Q4.gguf", "Q4_K_M")
+    loaded.gguf_path = "/srv/models/Qwen3-Q4.gguf"
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    assert asyncio.run(inference_route._reject_unservable_model("publisher/Qwen3", _Req())) is None
+
+
+def test_a_rejected_token_says_so_instead_of_asking_for_a_retry(hub):
+    # Hugging Face 401s an expired X-Unsloth-HF-Token. Only 403/404 were handled, so it
+    # fell through to a 503 telling the caller to retry something that cannot work.
+    from huggingface_hub.utils import HfHubHTTPError
+
+    hub["raise"] = _hub_error(HfHubHTTPError, 401, "unauthorized")
+    refusal = _run("unsloth/x-GGUF:UD-Q5_K_XL", hf_token = "hf_expired")
+    assert refusal.status == 401 and refusal.code == "model_access_denied"
+    assert "token" in refusal.message.lower()
+    assert hub["started"] == []
+
+
+def test_an_image_request_does_not_download_a_text_only_model(hub):
+    # The capability guard only ever sees an already-local target, so without this an
+    # image request spends gigabytes on weights that then 400 on every retry.
+    gb = 1024**3
+    hub["info"] = _Info([_Sibling("model-UD-Q5_K_XL.gguf", 5 * gb)])
+    refusal = asyncio.run(
+        auto_dl.maybe_auto_download("unsloth/text-GGUF:UD-Q5_K_XL", require_vision = True)
+    )
+    assert refusal.status == 400 and refusal.code == "invalid_value"
+    assert "mmproj" in refusal.message
+    assert hub["started"] == []
+    # The stock fixture repo ships mmproj-F16.gguf, so that one is allowed to start.
+    hub["info"] = _gguf_repo_info()
+    assert (
+        asyncio.run(
+            auto_dl.maybe_auto_download("unsloth/x-GGUF:UD-Q5_K_XL", require_vision = True)
+        ).code
+        == "model_downloading"
+    )
+    assert len(hub["started"]) == 1
+
+
+def test_two_models_differing_only_in_case_are_not_the_same_weights(monkeypatch):
+    # Lowercasing paths made /srv/models/Foo and /srv/models/foo compare equal, so
+    # on a case-sensitive filesystem a request for one was answered by the other.
+    import os
+
+    loaded = _Loaded("/srv/models/Foo/model.gguf")
+    loaded.gguf_path = "/srv/models/Foo/model.gguf"
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    assert inference_route._resolves_to_resident("/srv/models/Foo") is True
+    same = os.path.normcase("A") == os.path.normcase("a")
+    assert inference_route._resolves_to_resident("/srv/models/foo") is same
+
+
+def test_a_quant_request_is_not_satisfied_by_transformers_weights(monkeypatch):
+    # A Transformers model active from a directory that also holds GGUF exports resolves
+    # to that directory, so the path match let admission answer an explicit quant with
+    # the safetensors weights. Only llama.cpp has a quant identity.
+    from core.inference import local_model_resolver as resolver
+
+    entry = resolver._LocalGgufEntry("alias", "/srv/models/tuned", ("Q4_K_M",))
+    monkeypatch.setattr(resolver, "_scan", (time.monotonic(), {"alias": entry}))
+    monkeypatch.setattr(
+        inference_route, "get_llama_cpp_backend", lambda: type("L", (), {"is_loaded": False})()
+    )
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": "/srv/models/tuned"})(),
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    with pytest.raises(HTTPException) as excinfo:
+        asyncio.run(inference_route._reject_unservable_model("alias:Q4_K_M", _Req()))
+    assert excinfo.value.status_code == 404
+    # A bare name claims nothing about the weights, so the active model still answers.
+    assert asyncio.run(inference_route._reject_unservable_model("alias", _Req())) is None
+
+
+def test_a_timed_out_download_keeps_the_slot_while_it_is_still_running(monkeypatch):
+    # The watch window only bounds progress reporting. Releasing on the clock while
+    # the worker is alive would admit a second multi-GB download beside it.
+    monkeypatch.setattr(auto_dl, "_MAX_WATCH_S", 0.0)
+    monkeypatch.setattr(auto_dl, "_WATCH_POLL_S", 0.001)
+    monkeypatch.setattr(auto_dl, "_TIMED_OUT_POLL_S", 0.001)
+    active = auto_dl._Active(repo_id = "org/big-GGUF", variant = "Q4_K_M")
+
+    async def _drive():
+        finished = asyncio.Event()
+
+        async def _state(repo, variant):
+            return ("complete" if finished.is_set() else "running"), None
+
+        monkeypatch.setattr(auto_dl, "_job_state", _state)
+        auto_dl._active = active
+        watcher = asyncio.create_task(auto_dl._watch(active, None))
+        # Long past the deadline, and still running: the slot must not come back.
+        await asyncio.sleep(0.05)
+        held = auto_dl._active is active
+        finished.set()
+        await watcher
+        return held, auto_dl._active
+
+    held, after = asyncio.run(_drive())
+    assert held, "the slot was released while the worker was still running"
+    assert after is None, "the slot was not released once the job finished"
+
+
+def test_a_timed_out_download_stops_holding_the_slot_once_unprobeable(monkeypatch):
+    # The other direction: a probe that can no longer confirm the worker is alive
+    # must not wedge auto-download for the life of the process.
+    monkeypatch.setattr(auto_dl, "_MAX_WATCH_S", 0.0)
+    monkeypatch.setattr(auto_dl, "_WATCH_POLL_S", 0.001)
+    monkeypatch.setattr(auto_dl, "_TIMED_OUT_POLL_S", 0.001)
+    active = auto_dl._Active(repo_id = "org/big-GGUF", variant = "Q4_K_M")
+
+    async def _unknown(repo, variant):
+        return "unknown", None
+
+    monkeypatch.setattr(auto_dl, "_job_state", _unknown)
+
+    async def _drive():
+        auto_dl._active = active
+        await auto_dl._watch(active, None)
+        return auto_dl._active
+
+    assert asyncio.run(_drive()) is None
+
+
+def test_a_sibling_quant_in_the_same_directory_is_not_the_resident_one(monkeypatch):
+    # Quants of one repo share a directory, so the path match alone cannot tell them
+    # apart, and an explicit :Q8_0 was answered by a resident Q4_K_M.
+    from core.inference import local_model_resolver as resolver
+
+    entry = resolver._LocalGgufEntry("org/model", "/hf/org--model/snap", ("Q4_K_M", "Q8_0"))
+    monkeypatch.setattr(resolver, "_scan", (time.monotonic(), {"org/model": entry}))
+    loaded = _Loaded("org/model", "Q4_K_M")
+    loaded.gguf_path = "/hf/org--model/snap/model-Q4_K_M.gguf"
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    with pytest.raises(HTTPException):
+        asyncio.run(inference_route._reject_unservable_model("org/model:Q8_0", _Req()))
+    # The quant that is actually resident still answers.
+    assert asyncio.run(inference_route._reject_unservable_model("org/model:Q4_K_M", _Req())) is None
+
+
+def test_a_remote_tag_that_names_no_quant_picks_the_preferred_one(hub):
+    # ":latest" and ":8b" name no quant, so remote admission must default-select like a
+    # bare repo id (as the local resolver does) instead of 404ing on a non-quant.
+    assert _run("unsloth/x-GGUF").code == "model_downloading"
+    bare_repo, bare_variant, _ = hub["started"][0]
+    for tag in (":latest", ":8b"):
+        auto_dl.reset_for_tests()
+        hub["started"].clear()
+        assert _run(f"unsloth/x-GGUF{tag}").code == "model_downloading"
+        assert hub["started"][0][0] == bare_repo
+        assert hub["started"][0][1] == bare_variant, f"{tag} did not default-select"
+
+    # A real quant the repo does not have is still a 404, never a substitution.
+    auto_dl.reset_for_tests()
+    hub["started"].clear()
+    refusal = _run("unsloth/x-GGUF:Q2_K")
+    assert refusal.status == 404 and "no quant" in refusal.message
+    assert hub["started"] == []
+
+
+def test_a_generic_gguf_advertises_the_label_the_worker_resolves(hub):
+    # With no recognized quant token the extractors part ways: one takes the last
+    # hyphenated segment, the plan and worker key the whole stem. Dispatching ours
+    # made the worker exit with "No GGUF shards matching variant".
+    from hub.utils.gguf import extract_quant_label as canonical
+    from hub.utils.gguf_plan import build_gguf_variant_plans
+
+    sibling = _Sibling("llama-7b.gguf", 4 * 1024**3)
+    hub["info"] = _Info([sibling])
+    assert _run("unsloth/generic-GGUF").code == "model_downloading"
+    dispatched = hub["started"][0][1]
+    assert dispatched == canonical("llama-7b.gguf")
+    # The key the worker will look up has to contain it, which is the whole point.
+    assert dispatched.lower() in build_gguf_variant_plans([sibling])
+
+
+def test_windows_style_paths_still_match_their_own_directory(monkeypatch):
+    # normcase rewrites "/" to a backslash on Windows, so normalizing before it left the
+    # descendant checks comparing against a path with none, and a resident model read
+    # as a different one.
+    import ntpath
+
+    monkeypatch.setattr(inference_route.os.path, "normcase", ntpath.normcase)
+    # A manual load records the file, so only the descendant check can match the
+    # directory the resolver returns; an equality match would prove nothing here.
+    loaded = _Loaded("C:\\models\\repo\\model.gguf")
+    loaded.gguf_path = "C:\\models\\repo\\model.gguf"
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    assert inference_route._resolves_to_resident("C:\\models\\repo") is True
+    assert inference_route._resolves_to_resident("C:\\Models\\Repo") is True
+    assert inference_route._resolves_to_resident("C:\\models\\other") is False
+
+
+def test_a_bare_request_for_a_just_downloaded_model_is_refused(monkeypatch):
+    # End of the same chain: the note has to reach admission, or a bare request between
+    # the download landing and the scan is served by the resident model.
+    from core.inference import local_model_resolver as resolver
+
+    monkeypatch.setattr(resolver, "_scan", (time.monotonic(), {}))
+    monkeypatch.setattr(resolver, "_just_downloaded", {"org/fresh"})
+    loaded = _Loaded("unsloth/A-GGUF", "UD-Q4_K_XL")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    monkeypatch.setattr(inference_route, "_unavailable_model_message", _fake_unavailable_message)
+    with pytest.raises(HTTPException) as excinfo:
+        asyncio.run(inference_route._reject_unservable_model("org/fresh", _Req()))
+    assert excinfo.value.status_code == 404
+    assert asyncio.run(inference_route._reject_unservable_model("org/never", _Req())) is None
+
+
+def test_a_non_quant_tag_does_not_tear_down_a_serving_quant(monkeypatch):
+    # _already_serving split on ":" rather than on whether the suffix names a quant, so
+    # org/model:latest against a serving Q8_0 counted as a mismatch and swapped in the
+    # preferred Q4_K_M, for a request either one satisfies.
+    from core.inference import local_model_resolver as resolver
+
+    entry = resolver._LocalGgufEntry("org/model", "/hf/org--model/snap", ("Q4_K_M", "Q8_0"))
+    monkeypatch.setattr(resolver, "_scan", (time.monotonic(), {"org/model": entry}))
+    loaded = _Loaded("org/model", "Q8_0")
+    loaded.gguf_path = "/hf/org--model/snap/model-Q8_0.gguf"
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    loads: list = []
+
+    async def _record_load(request, *a, **k):
+        loads.append(getattr(request, "gguf_variant", None))
+
+    monkeypatch.setattr(inference_route, "_load_model_impl", _record_load)
+    monkeypatch.setattr(
+        "utils.openai_auto_switch_settings.get_openai_auto_switch_enabled", lambda: True
+    )
+    for tag in ("org/model:latest", "org/model:8b", "org/model"):
+        asyncio.run(inference_route._maybe_auto_switch_model(tag, _Req(), "tester"))
+    assert loads == [], "a tag naming no quant swapped the serving model out"
+
+
+def test_the_trust_probe_never_falls_back_to_the_server_identity(hub, monkeypatch):
+    # huggingface_hub treats None as "use the cached login", so only an explicit False
+    # is anonymous. This probe passed None, so a caller-named repo was read with the
+    # server's identity.
+    seen: list = []
+
+    def _probe(model_name, hf_token = None):
+        seen.append(hf_token)
+        return False
+
+    monkeypatch.setattr("utils.security.consent._config_has_auto_map", _probe)
+    _run("unsloth/x-GGUF:UD-Q5_K_XL")
+    assert seen == [False], f"trust probe ran with {seen!r}, not an explicit anonymous token"
+
+    seen.clear()
+    auto_dl.reset_for_tests()
+    _run("unsloth/x-GGUF:UD-Q5_K_XL", hf_token = "hf_caller")
+    assert seen == ["hf_caller"], "the caller's own token must still be used"
+
+
+def test_a_foreign_label_is_not_told_to_wait_for_someone_elses_download(hub):
+    # The busy refusal fired before the probe, so any namespaced label a drop-in client
+    # sends (LiteLLM/OpenRouter style) was told to wait out an unrelated download.
+    assert _run("unsloth/first-GGUF").code == "model_downloading"
+
+    hub["info"] = _Info([_Sibling("README.md", 1024)])  # real repo, no GGUF
+    assert _run("anthropic/claude-3.5-sonnet") is None, "a foreign label was refused as busy"
+
+    # A label that really is another downloadable model still gets the busy refusal.
+    hub["info"] = _gguf_repo_info()
+    refusal = _run("unsloth/second-GGUF")
+    assert refusal.status == 503 and refusal.code == "model_download_busy"
+
+
+def test_a_failed_download_keeps_the_slot_until_someone_is_told(monkeypatch):
+    # The watcher freed the slot on the error, but Retry-After is 30s and the poll 2s,
+    # so the client came back to an empty slot and restarted the same failing download.
+    monkeypatch.setattr(auto_dl, "_MAX_WATCH_S", 60.0)
+    monkeypatch.setattr(auto_dl, "_WATCH_POLL_S", 0.001)
+
+    async def _errored(repo, variant):
+        return "error", "disk exploded"
+
+    monkeypatch.setattr(auto_dl, "_job_state", _errored)
+    active = auto_dl._Active(repo_id = "org/x-GGUF", variant = "Q4_K_M")
+    auto_dl._active = active
+    asyncio.run(auto_dl._watch(active, None))
+    assert auto_dl._active is active, "the slot was freed before anyone was told"
+    assert active.error == "disk exploded"
+
+
+def test_the_retry_after_a_failure_is_told_instead_of_restarting_it(hub, monkeypatch):
+    # End of the same chain: the held failure has to reach the caller.
+    active = auto_dl._Active(
+        repo_id = "unsloth/x-GGUF",
+        variant = "UD-Q5_K_XL",
+        error = "disk exploded",
+        failed_at = 1.0,
+    )
+    auto_dl._active = active
+
+    async def _idle(repo, variant):
+        return "idle", None
+
+    monkeypatch.setattr(auto_dl, "_job_state", _idle)
+    refusal = _run("unsloth/x-GGUF:UD-Q5_K_XL")
+    assert refusal.status == 502 and "disk exploded" in refusal.message
+    assert hub["started"] == [], "the retry restarted the failing download"
+    # Told once, so the slot is free again for a fresh attempt.
+    assert auto_dl._active is None
+
+
+def test_a_completed_download_does_not_restage_the_scan_it_just_warmed(monkeypatch):
+    # finalize_worker_exit invalidates and warms. A second invalidation here marks
+    # that fresh scan stale and pushes a synchronous rescan onto the client's retry.
+    import inspect
+
+    src = inspect.getsource(auto_dl._watch)
+    complete_branch = src[src.index('if state == "complete"') :]
+    assert "invalidate_index" not in complete_branch
+
+
+def test_an_exact_generic_variant_beats_the_default_pick(hub):
+    # Canonicalizing generic labels made them real worker keys, but the matcher read
+    # anything non-quant-shaped as a tag, so repo:llama-13b default-selected llama-7b.
+    gb = 1024**3
+    hub["info"] = _Info([_Sibling("llama-7b.gguf", 4 * gb), _Sibling("llama-13b.gguf", 8 * gb)])
+    assert _run("unsloth/generic-GGUF:llama-13b").code == "model_downloading"
+    assert hub["started"][0][1] == "llama-13b"
+
+    # A quant-shaped suffix that matches nothing is still a miss, never a swap.
+    auto_dl.reset_for_tests()
+    hub["started"].clear()
+    hub["info"] = _gguf_repo_info()
+    assert _run("unsloth/x-GGUF:Q2_K").status == 404
+    assert hub["started"] == []
diff --git a/studio/backend/tests/test_openai_auto_switch.py b/studio/backend/tests/test_openai_auto_switch.py
index 190d51db8f..e29fc07a95 100644
--- a/studio/backend/tests/test_openai_auto_switch.py
+++ b/studio/backend/tests/test_openai_auto_switch.py
@@ -11,6 +11,7 @@ import asyncio
 import os
 
 import pytest
+from fastapi import HTTPException
 
 import routes.inference as inference_route
 from models.inference import LoadRequest
@@ -18,6 +19,18 @@ from core.inference import local_model_resolver as resolver
 from utils import openai_auto_switch_settings as settings
 
 
+@pytest.fixture(autouse = True)
+def _clean_resolver_index():
+    """Drop the scan cache around every test.
+
+    The /v1 admission hook warms the index in the background, so a test exercising it
+    can publish its fixture's scan and, inside the TTL, hand it to the next test.
+    """
+    resolver.invalidate_index()
+    yield
+    resolver.invalidate_index()
+
+
 class _FakeBackend:
     effective_parallel_slots = 1
     _slot_save_binary = None
@@ -94,7 +107,7 @@ class _LoadRecorder:
 
 def _wire(monkeypatch, *, enabled, resolves_to, backend, recorder):
     monkeypatch.setattr(settings, "get_openai_auto_switch_enabled", lambda: enabled)
-    monkeypatch.setattr(resolver, "resolve_local_gguf", lambda _m: resolves_to)
+    monkeypatch.setattr(resolver, "resolve_local_gguf", lambda _m, **_kw: resolves_to)
     monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: backend)
     # Auto-switch loads via _load_model_impl (the /load route holds the lifecycle
     # gate that auto-switch already owns, so it calls the impl directly).
@@ -116,7 +129,11 @@ def test_flag_off_never_loads(monkeypatch):
         backend = backend,
         recorder = rec,
     )
-    _run_hook("unsloth/B-GGUF")
+    # Off means no load, but A must not answer as B either: say why instead.
+    with pytest.raises(HTTPException) as excinfo:
+        _run_hook("unsloth/B-GGUF")
+    assert excinfo.value.status_code == 404
+    assert "Switch model by request" in str(excinfo.value.detail)
     assert rec.calls == []
 
 
@@ -387,6 +404,45 @@ def test_resolver_nonstring_model_is_failsafe():
     assert resolver.resolve_local_gguf(None) is None
 
 
+def test_describe_local_miss_separates_missing_repo_from_missing_quant(monkeypatch):
+    # Two different misses: the repo isn't downloaded, or only that quant is absent.
+    monkeypatch.setattr(
+        resolver,
+        "_build_index",
+        lambda: {"unsloth/b-gguf": _entry("unsloth/B-GGUF", "UD-Q5_K_XL", "Q4_K_M")},
+    )
+    resolver._scan = (0.0, {})
+    assert resolver.describe_local_miss("unsloth/B-GGUF:Q8_0") == (
+        resolver.MISS_VARIANT_NOT_FOUND,
+        ("UD-Q5_K_XL", "Q4_K_M"),
+    )
+    # Split the same way resolve_local_gguf does, so the two never disagree.
+    assert resolver.describe_local_miss("unsloth/b-gguf:q8_0")[0] == (
+        resolver.MISS_VARIANT_NOT_FOUND
+    )
+    # Unknown repo, and a bare id with no ":VARIANT" to blame.
+    assert resolver.describe_local_miss("totally/unknown:Q8_0") == (
+        resolver.MISS_MODEL_NOT_FOUND,
+        (),
+    )
+    assert resolver.describe_local_miss("unsloth/B-GGUF") == (resolver.MISS_MODEL_NOT_FOUND, ())
+
+
+def test_describe_local_miss_is_failsafe(monkeypatch):
+    # Runs inside an error path, so a broken scan must degrade, not turn a 4xx into a 500.
+    def boom():
+        raise RuntimeError("scan blew up")
+
+    monkeypatch.setattr(resolver, "_build_index", boom)
+    resolver._scan = (0.0, {})
+    assert resolver.describe_local_miss("unsloth/B-GGUF:Q8_0") == (
+        resolver.MISS_MODEL_NOT_FOUND,
+        (),
+    )
+    assert resolver.describe_local_miss(123) == (resolver.MISS_MODEL_NOT_FOUND, ())
+    assert resolver.describe_local_miss("") == (resolver.MISS_MODEL_NOT_FOUND, ())
+
+
 def test_resolver_exact_id_with_colon_wins(monkeypatch):
     # A local id that itself contains a colon (e.g. a Windows path) must match
     # exactly rather than being split at the drive-letter colon.
@@ -537,7 +593,9 @@ def test_disabling_idle_unload_purges_saved_kv(monkeypatch, tmp_path):
         "dir": str(tmp_path),
         "slots": [{"id": 0, "filename": saved.name}],
     }
-    monkeypatch.setattr(settings_route, "set_openai_auto_switch", lambda *a: (False, 300, True))
+    monkeypatch.setattr(
+        settings_route, "set_openai_auto_switch", lambda *a: (False, 300, True, False)
+    )
     monkeypatch.setattr(settings_route, "get_auto_unload_idle_seconds", lambda: 0)
 
     payload = settings_route.OpenAIAutoSwitchPayload(enabled = False)
@@ -1548,22 +1606,28 @@ def test_load_route_holds_lifecycle_gate(monkeypatch):
 
 
 def test_model_replacements_recheck_sidecar_swap_before_either_backend_is_unloaded():
-    # Both replacement directions drain active inference, then recheck whether a
-    # sidecar install reserved the lifecycle gate during that wait. Exact-model
-    # reuse exits earlier, so an already-loaded model never waits on unrelated inference.
+    # Both replacement directions drain, then recheck whether a sidecar install reserved the
+    # gate meanwhile. That recheck is the last thing that can reject the load, so the
+    # destructive cancel must follow it. Exact-model reuse exits earlier and never waits.
     import inspect
 
     src = inspect.getsource(inference_route._load_model_impl)
+    already_loaded = src.index('status = "already_loaded"')
+    standard_branch = src.index("# ── Standard path")
+
     gguf_wait = src.index("await _wait_for_model_switch_idle", src.index("if config.is_gguf:"))
     gguf_sidecar_check = src.index("_raise_if_sidecar_swap_in_progress()", gguf_wait)
+    gguf_cancel = src.index("on_reload_confirmed(cancel = True)", gguf_wait)
     unload_unsloth = src.index("unsloth_backend.unload_model", gguf_wait)
-    standard_wait = src.index("await _wait_for_model_switch_idle", gguf_wait + 1)
-    standard_sidecar_check = src.index("_raise_if_sidecar_swap_in_progress()", standard_wait)
-    unload_gguf = src.index("llama_backend.unload_model()", standard_wait)
-    already_loaded = src.index('status = "already_loaded"')
 
-    assert already_loaded < gguf_wait < gguf_sidecar_check < unload_unsloth
-    assert standard_wait < standard_sidecar_check < unload_gguf
+    standard_wait = src.index("await _wait_for_model_switch_idle", standard_branch)
+    standard_sidecar_check = src.index("_raise_if_sidecar_swap_in_progress()", standard_wait)
+    standard_cancel = src.index("on_reload_confirmed(cancel = True)", standard_wait)
+    unload_gguf = src.index("llama_backend.unload_model()", standard_wait)
+
+    assert already_loaded < gguf_wait < gguf_sidecar_check < gguf_cancel < unload_unsloth
+    assert standard_branch < standard_wait < standard_sidecar_check
+    assert standard_sidecar_check < standard_cancel < unload_gguf
 
 
 def test_switch_waiter_deregisters_before_swap_gate_release():
@@ -1877,7 +1941,10 @@ def test_env_idle_standalone_reloads_freed_model_with_auto_switch_off(monkeypatc
     monkeypatch.setattr(settings, "get_auto_unload_idle_seconds", lambda: 600)  # standalone env TTL
     monkeypatch.setattr(kw, "_inflight", 0)
     monkeypatch.setattr(kw, "_last_unloaded_model", ("/cache/snap/A", "Q4_K_M", "org/A-GGUF"))
-    _run_hook("org/B-GGUF")
+    # A is restored, but the request named B, so it is told so rather than served A.
+    with pytest.raises(HTTPException) as excinfo:
+        _run_hook("org/B-GGUF")
+    assert excinfo.value.status_code == 404
     # Resolver skipped (auto-switch off), so only the stash reload runs: the freed A
     # is restored, not the resolves_to target B.
     assert len(rec.calls) == 1
@@ -2947,9 +3014,13 @@ def test_require_vision_ignores_reload_stash(monkeypatch):
     monkeypatch.setattr(
         inference_route, "_target_is_vision", lambda _p: False
     )  # would reject if used
-    asyncio.run(
-        inference_route._maybe_auto_switch_model("org/B-GGUF", object(), "t", require_vision = True)
-    )
+    # 404 because the restored A is not the requested B, whose quant makes it a real reference.
+    with pytest.raises(HTTPException):
+        asyncio.run(
+            inference_route._maybe_auto_switch_model(
+                "org/B-GGUF:UD-Q6_K_XL", object(), "t", require_vision = True
+            )
+        )
     assert len(rec.calls) == 1
     assert rec.calls[0].model_path == "/cache/snap/A"  # restored despite require_vision
 
@@ -3290,13 +3361,19 @@ def test_no_model_loaded_detail_appends_hint_only_when_off(monkeypatch):
     assert inference_route._no_model_loaded_detail(base) == base
 
 
-def _run_responses_stream_no_model(monkeypatch, *, enabled, active_model_name):
-    # Drive _responses_stream's GGUF-not-loaded guard: llama backend unloaded,
-    # inference backend maybe holding a non-GGUF model. Returns the 400 detail.
+def _run_responses_stream_no_model(
+    monkeypatch,
+    *,
+    enabled,
+    active_model_name,
+    resolves_to = None,
+):
+    # Drive _responses_stream's GGUF-not-loaded guard. Returns (status, detail).
     from fastapi import HTTPException
     from models.inference import ResponsesRequest, ChatMessage
 
     monkeypatch.setattr(settings, "get_openai_auto_switch_enabled", lambda: enabled)
+    monkeypatch.setattr(resolver, "resolve_local_gguf", lambda name: resolves_to)
     monkeypatch.setattr(
         inference_route, "get_llama_cpp_backend", lambda: _FakeBackend(loaded_id = None)
     )
@@ -3309,29 +3386,230 @@ def _run_responses_stream_no_model(monkeypatch, *, enabled, active_model_name):
     messages = [ChatMessage(role = "user", content = "hi")]
     with pytest.raises(HTTPException) as exc:
         asyncio.run(inference_route._responses_stream(payload, messages, None))
-    assert exc.value.status_code == 400
-    return exc.value.detail
+    return exc.value.status_code, exc.value.detail
 
 
 def test_responses_stream_hint_matches_toggle_regardless_of_active_model(monkeypatch):
-    # Streaming /v1/responses shares the GGUF-only 400 with the other "no model
-    # loaded" sites, so the auto-switch hint attaches whenever the toggle is
-    # off -- including while a non-GGUF model is active, since auto-switch
-    # evicts it to load a resolved GGUF (_maybe_auto_switch_model's resolver
-    # branch has no active-model guard, unlike its reload-stash branch). Only
-    # the toggle being on suppresses it.
-    hinted = _run_responses_stream_no_model(monkeypatch, enabled = False, active_model_name = None)
+    # The hint attaches whenever the toggle is off, whatever is active. With it on the name
+    # resolved to nothing local, so 404 rather than 400.
+    off_status, hinted = _run_responses_stream_no_model(
+        monkeypatch, enabled = False, active_model_name = None
+    )
+    assert off_status == 400
     assert "Model auto-switch" in hinted
 
-    on = _run_responses_stream_no_model(monkeypatch, enabled = True, active_model_name = None)
+    on_status, on = _run_responses_stream_no_model(
+        monkeypatch, enabled = True, active_model_name = None
+    )
+    assert on_status == 404
     assert "Model auto-switch" not in on
+    assert "unsloth/Qwen3.5-4B-GGUF" in on
 
-    non_gguf_loaded = _run_responses_stream_no_model(
+    non_gguf_status, non_gguf_loaded = _run_responses_stream_no_model(
         monkeypatch, enabled = False, active_model_name = "unsloth/Llama-3.2-1B-Instruct"
     )
+    assert non_gguf_status == 400
     assert "Model auto-switch" in non_gguf_loaded
 
 
+def _wire_unloaded_chat(
+    monkeypatch,
+    *,
+    enabled,
+    catalog = ("org/A-GGUF", "org/B-GGUF"),
+):
+    # Nothing loaded, so a chat request hits "no model loaded". Pin the catalog for determinism.
+    async def _catalog():
+        return [{"id": mid} for mid in catalog]
+
+    monkeypatch.setattr(settings, "get_openai_auto_switch_enabled", lambda: enabled)
+    monkeypatch.setattr(resolver, "resolve_local_gguf", lambda _m, **_kw: None)
+    monkeypatch.setattr(
+        resolver, "describe_local_miss", lambda _m: (resolver.MISS_MODEL_NOT_FOUND, ())
+    )
+    monkeypatch.setattr(inference_route, "_openai_catalog_objects", _catalog)
+    monkeypatch.setattr(
+        inference_route, "get_llama_cpp_backend", lambda: _FakeBackend(loaded_id = None)
+    )
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("_B", (), {"active_model_name": None, "models": {}})(),
+    )
+
+
+def _chat_error(payload):
+    from fastapi import HTTPException
+    with pytest.raises(HTTPException) as exc:
+        asyncio.run(inference_route.openai_chat_completions(payload, object(), "tester"))
+    return exc.value.status_code, exc.value.detail
+
+
+def test_chat_names_undownloaded_model_404s_with_available_ids(monkeypatch):
+    # The reported bug: the model is not here, so the switch did nothing and /inference/load
+    # cannot fix it. Name it and list what can serve.
+    _wire_unloaded_chat(monkeypatch, enabled = True)
+    status, detail = _chat_error(_chat_request(model = "unsloth/gemma-4-E4B-it-GGUF:UD-Q5_K_XL"))
+    assert status == 404
+    assert "unsloth/gemma-4-E4B-it-GGUF:UD-Q5_K_XL" in detail
+    assert "org/A-GGUF, org/B-GGUF" in detail
+    assert "GET /v1/models" in detail
+    assert "POST /inference/load" not in detail
+
+
+def test_chat_undownloaded_model_with_empty_catalog(monkeypatch):
+    # Nothing downloaded: an empty list would read as a bug, so say so plainly.
+    _wire_unloaded_chat(monkeypatch, enabled = True, catalog = ())
+    status, detail = _chat_error(_chat_request(model = "org/nope-GGUF"))
+    assert status == 404
+    assert "no models are downloaded yet" in detail
+
+
+def test_chat_wrong_quant_lists_the_local_quants(monkeypatch):
+    # Repo downloaded, only the quant missing: sibling quants, not the catalog.
+    _wire_unloaded_chat(monkeypatch, enabled = True)
+    monkeypatch.setattr(
+        resolver,
+        "describe_local_miss",
+        lambda _m: (resolver.MISS_VARIANT_NOT_FOUND, ("Q4_K_M", "Q8_0")),
+    )
+    status, detail = _chat_error(_chat_request(model = "org/A-GGUF:UD-Q5_K_XL"))
+    assert status == 404
+    assert "'org/A-GGUF' is downloaded, but the quant 'UD-Q5_K_XL' is not" in detail
+    assert "Q4_K_M, Q8_0" in detail
+
+
+def test_chat_error_unchanged_when_auto_switch_off(monkeypatch):
+    # Toggle off: nothing resolved, so keep the pre-existing status and text, hint included.
+    _wire_unloaded_chat(monkeypatch, enabled = False)
+    status, detail = _chat_error(_chat_request(model = "org/nope-GGUF"))
+    assert status == 400
+    assert detail.startswith("No model loaded. Call POST /inference/load first.")
+    assert "Model auto-switch" in detail
+
+
+def test_chat_error_unchanged_when_no_model_named(monkeypatch):
+    # An omitted model means "serve whatever is loaded", so there is no name to report.
+    _wire_unloaded_chat(monkeypatch, enabled = True)
+    status, detail = _chat_error(_chat_request())
+    assert status == 400
+    assert detail == "No model loaded. Call POST /inference/load first."
+
+
+def test_chat_not_downloaded_error_survives_a_broken_catalog_scan(monkeypatch):
+    # Layered onto an already-failing path, so a broken scan must not make it a 500.
+    async def _boom():
+        raise RuntimeError("catalog scan blew up")
+
+    _wire_unloaded_chat(monkeypatch, enabled = True)
+    monkeypatch.setattr(inference_route, "_openai_catalog_objects", _boom)
+    status, detail = _chat_error(_chat_request(model = "org/nope-GGUF"))
+    assert status == 400
+    assert detail.startswith("No model loaded. Call POST /inference/load first.")
+
+
+def test_chat_available_id_list_is_capped(monkeypatch):
+    # A machine with 40 GGUFs must not print all 40 into a terminal error.
+    _wire_unloaded_chat(
+        monkeypatch, enabled = True, catalog = tuple(f"org/m{i:02d}-GGUF" for i in range(20))
+    )
+    status, detail = _chat_error(_chat_request(model = "org/nope-GGUF"))
+    assert status == 404
+    assert "and 12 more" in detail
+    assert "org/m08-GGUF" not in detail
+
+
+def test_anthropic_undownloaded_model_uses_the_anthropic_envelope(monkeypatch):
+    # Shared with /v1/messages, so the 404 must not leak an OpenAI-shaped body.
+    from fastapi import HTTPException
+
+    async def _noop_switch(*a, **k):
+        return None
+
+    _wire_unloaded_chat(monkeypatch, enabled = True)
+    monkeypatch.setattr(inference_route, "_automatic_model_load_may_run", lambda: True)
+    monkeypatch.setattr(inference_route, "_maybe_auto_switch_model", _noop_switch)
+
+    request = type("_R", (), {"url": type("_U", (), {"path": "/v1/messages"})()})()
+    with pytest.raises(HTTPException) as exc:
+        asyncio.run(inference_route.anthropic_messages(_anthropic_payload(64), request, "tester"))
+    assert exc.value.status_code == 404
+    body = exc.value.detail
+    assert body["type"] == "error"
+    assert body["error"]["type"] == "not_found_error"
+    assert "claude-x" in body["error"]["message"]
+
+
+def test_chat_undownloaded_model_uses_the_openai_envelope(monkeypatch):
+    # The OpenAI surface carries param/code so SDK clients can branch on it.
+    from fastapi import HTTPException
+
+    _wire_unloaded_chat(monkeypatch, enabled = True)
+    request = type("_R", (), {"url": type("_U", (), {"path": "/v1/chat/completions"})()})()
+    with pytest.raises(HTTPException) as exc:
+        asyncio.run(
+            inference_route.openai_chat_completions(
+                _chat_request(model = "org/nope-GGUF"), request, "tester"
+            )
+        )
+    assert exc.value.status_code == 404
+    err = exc.value.detail["error"]
+    assert err["type"] == "not_found_error"
+    assert err["code"] == "model_not_found"
+    assert err["param"] == "model"
+
+
+def test_gguf_only_paths_keep_the_generic_error_for_the_resident_non_gguf_model(monkeypatch):
+    # resolve_local_gguf misses a resident Transformers model the catalog does list, so
+    # "not downloaded" would contradict itself.
+    resident = "unsloth/Qwen3.5-4B-GGUF"  # the id _run_responses_stream_no_model asks for
+
+    async def _catalog():
+        return [{"id": resident}]
+
+    monkeypatch.setattr(inference_route, "_openai_catalog_objects", _catalog)
+    status, detail = _run_responses_stream_no_model(
+        monkeypatch, enabled = True, active_model_name = resident
+    )
+    assert status == 400
+    assert "requires a GGUF model" in detail
+    assert "not downloaded" not in detail
+
+
+def test_completions_keeps_the_generic_error_for_the_resident_non_gguf_model(monkeypatch):
+    # Same contradiction on the raw-body surface, via _auto_switch_from_request_body.
+    from fastapi import HTTPException
+
+    resident = "unsloth/Llama-3.2-1B-Instruct"
+    _wire_unloaded_chat(monkeypatch, enabled = True, catalog = (resident,))
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("_B", (), {"active_model_name": resident, "models": {}})(),
+    )
+    with pytest.raises(HTTPException) as exc:
+        asyncio.run(
+            inference_route.openai_completions(
+                _json_body_request({"model": resident, "prompt": "hi"}), "tester"
+            )
+        )
+    assert exc.value.status_code == 503
+    assert exc.value.detail.startswith("No GGUF model loaded.")
+    assert "not downloaded" not in exc.value.detail
+
+
+def test_responses_stream_keeps_generic_error_when_target_is_local(monkeypatch):
+    # Resolves locally yet nothing is loaded: the switch failed, so keep the generic 400.
+    status, detail = _run_responses_stream_no_model(
+        monkeypatch,
+        enabled = True,
+        active_model_name = None,
+        resolves_to = ("/p/A", "Q4_K_M", "unsloth/Qwen3.5-4B-GGUF"),
+    )
+    assert status == 400
+    assert "not downloaded" not in detail
+
+
 # ── idle-unload KV persistence (slot save/restore) ──────────────────
 
 
@@ -3784,10 +4062,11 @@ def test_keep_kv_only_update_leaves_env_idle_ttl_active(monkeypatch):
     monkeypatch.setenv(settings.MODEL_IDLE_TTL_ENV_VAR, "600")
 
     assert settings_route.OpenAIAutoSwitchPayload(enabled = False).auto_unload_idle_seconds is None
-    enabled, idle, keep_kv = settings.set_openai_auto_switch(False, None, False)
+    enabled, idle, keep_kv, auto_dl = settings.set_openai_auto_switch(False, None, False)
     assert settings.AUTO_UNLOAD_IDLE_SETTING_KEY not in store  # idle untouched
+    assert settings.OPENAI_AUTO_DOWNLOAD_SETTING_KEY not in store  # nor auto-download
     assert settings.get_auto_unload_idle_seconds() == 600  # env TTL still active
-    assert (enabled, idle, keep_kv) == (False, 600, False)
+    assert (enabled, idle, keep_kv, auto_dl) == (False, 600, False, False)
 
 
 def test_load_impl_notes_loaded_with_backend_off_loop():
@@ -3869,3 +4148,233 @@ def test_env_idle_below_floor_is_clamped(monkeypatch):
     assert settings.get_auto_unload_idle_seconds() == 600
     monkeypatch.delenv(settings.MODEL_IDLE_TTL_ENV_VAR)
     assert settings.get_auto_unload_idle_seconds() == 0
+
+
+def test_a_tag_that_names_no_quant_resolves_to_the_repo(monkeypatch):
+    # A downloaded but unloaded GGUF asked for as org/model:latest missed the resolver,
+    # so the switch could not load it (404ing on a quant that was never a quant with
+    # auto-download on, refusing with it off). A real quant that is not on disk must
+    # still miss, or a swap would serve the wrong weights under the right name.
+    from core.inference.local_model_resolver import _LocalGgufEntry
+
+    import time
+
+    entry = _LocalGgufEntry("org/model", "/srv/models/org--model", ("Q4_K_M",))
+    # Fresh stamp so _index serves this instead of rescanning over it.
+    monkeypatch.setattr(resolver, "_scan", (time.monotonic(), {"org/model": entry}))
+    for tag in ("org/model:latest", "org/model:8b", "org/model"):
+        assert resolver.resolve_local_gguf(tag) == (
+            "/srv/models/org--model",
+            "Q4_K_M",
+            "org/model",
+        )
+    assert resolver.resolve_local_gguf("org/model:Q8_0") is None
+    assert resolver.resolve_local_gguf("org/model:Q4_K_M") == (
+        "/srv/models/org--model",
+        "Q4_K_M",
+        "org/model",
+    )
+
+
+def test_any_finished_download_drops_the_resolver_cache(monkeypatch):
+    # Only the API auto-download watcher invalidated, so a GGUF fetched in the Hub UI
+    # stayed absent to the cache-only request path and the resident model answered.
+    # Every worker exits through here.
+    import logging
+
+    from hub.services import download_lifecycle
+
+    class _Proc:
+        stderr = None
+
+        def wait(self):
+            return 0
+
+    class _Registry:
+        def cancel_requested(self, key):
+            return False
+
+        def drop_process(self, key, proc):
+            return True
+
+        def get_job_metadata(self, key):
+            return None
+
+        def set_job(self, key, state):
+            self.state = state
+
+    resolver._scan = (1234.0, {"already-here": "entry"})
+    assert (
+        download_lifecycle.finalize_worker_exit(
+            _Registry(),
+            "org/model:Q4_K_M",
+            _Proc(),
+            hf_token = None,
+            label = "org/model",
+            log_prefix = "[test]",
+            logger = logging.getLogger(__name__),
+            repo_type = "model",
+            repo_id = "org/model",
+        )
+        == "complete"
+    )
+    stamp, entries = resolver._scan
+    assert stamp == 0.0, "a finished download left the scan looking fresh"
+    # Evidence for models already indexed has to survive, or a bare request for one
+    # of them during the rebuild is answered by whatever is resident.
+    assert entries == {"already-here": "entry"}
+
+
+def test_invalidating_keeps_the_entries_it_already_had(monkeypatch):
+    # The request path reads this cache without scanning, so emptying it leaves no
+    # evidence until the rebuild lands. Only a completed download invalidates, and
+    # that only adds, so the entries stay true.
+    import time
+
+    entry = resolver._LocalGgufEntry("org/old", "/srv/models/org--old", ("Q4_K_M",))
+    monkeypatch.setattr(resolver, "_scan", (time.monotonic(), {"org/old": entry}))
+    resolver.invalidate_index()
+    assert resolver._scan[0] == 0.0
+    assert resolver.resolve_local_gguf("org/old", allow_scan = False) == (
+        "/srv/models/org--old",
+        "Q4_K_M",
+        "org/old",
+    )
+
+
+def test_a_bare_local_id_takes_the_quant_a_plain_load_would(monkeypatch, tmp_path):
+    # list_local_gguf_variants orders by descending size, so the head is the biggest
+    # quant. Resolving a bare id to that could evict a working model and then OOM on an
+    # F16 next to a fitting Q4, and /v1/models advertised the same head for pinning.
+    from core.inference.local_model_resolver import _local_gguf_entry
+
+    for name, size in (("model-F16.gguf", 900), ("model-Q4_K_M.gguf", 100)):
+        (tmp_path / name).write_bytes(b"\0" * size)
+    entry = _local_gguf_entry("org/model", type("I", (), {"path": str(tmp_path)})())
+    assert entry is not None
+    assert set(entry.variants) == {"F16", "Q4_K_M"}
+    assert entry.variants[0] == "Q4_K_M", "a bare id would have resolved to F16"
+
+
+def test_local_and_remote_agree_on_the_preferred_quant():
+    # A bare id must mean the same quant whichever side answered it.
+    from core.inference.openai_auto_download import _match_variant, preferred_quant
+
+    labels = ("F16", "Q8_0", "UD-Q4_K_XL", "Q4_K_M")
+    assert preferred_quant(labels) == _match_variant(None, dict.fromkeys(labels, 1))
+    assert preferred_quant(labels) not in ("F16",)
+
+
+def test_a_just_downloaded_model_is_evidence_before_the_scan_indexes_it(monkeypatch):
+    # The retained index covers what was known, but nothing covers the model that just
+    # landed until the next scan: a bare request for it was answered by the resident one.
+    import logging
+
+    from hub.services import download_lifecycle
+
+    class _Proc:
+        stderr = None
+
+        def wait(self):
+            return 0
+
+    class _Registry:
+        def cancel_requested(self, key):
+            return False
+
+        def drop_process(self, key, proc):
+            return True
+
+        def get_job_metadata(self, key):
+            return None
+
+        def set_job(self, key, state):
+            pass
+
+    assert not resolver.recently_downloaded("org/fresh")
+    download_lifecycle.finalize_worker_exit(
+        _Registry(),
+        "org/fresh:Q4_K_M",
+        _Proc(),
+        hf_token = None,
+        label = "org/fresh",
+        log_prefix = "[test]",
+        logger = logging.getLogger(__name__),
+        repo_type = "model",
+        repo_id = "org/fresh",
+    )
+    assert resolver.recently_downloaded("org/fresh"), "no evidence for the new model"
+    assert resolver.recently_downloaded("ORG/Fresh"), "evidence must be case-insensitive"
+    assert not resolver.recently_downloaded("org/other")
+
+    # The scan that indexes it supersedes the note.
+    monkeypatch.setattr(resolver, "_build_index", dict)
+    resolver._index()
+    assert not resolver.recently_downloaded("org/fresh")
+
+
+def test_a_finished_dataset_is_not_recorded_as_a_local_model(monkeypatch):
+    # finalize_worker_exit is shared with dataset downloads. Noting one as a local model
+    # would refuse a bare /v1 request naming that id instead of letting a foreign id
+    # fall through, and would kick off a multi-directory scan for nothing.
+    import logging
+    import time
+
+    from hub.services import download_lifecycle
+
+    class _Proc:
+        stderr = None
+
+        def wait(self):
+            return 0
+
+    class _Registry:
+        def cancel_requested(self, key):
+            return False
+
+        def drop_process(self, key, proc):
+            return True
+
+        def get_job_metadata(self, key):
+            return None
+
+        def set_job(self, key, state):
+            pass
+
+    stamp = time.monotonic()
+    monkeypatch.setattr(resolver, "_scan", (stamp, {"kept": "entry"}))
+    download_lifecycle.finalize_worker_exit(
+        _Registry(),
+        "org/corpus",
+        _Proc(),
+        hf_token = None,
+        label = "org/corpus",
+        log_prefix = "[test]",
+        logger = logging.getLogger(__name__),
+        repo_type = "dataset",
+        repo_id = "org/corpus",
+    )
+    assert not resolver.recently_downloaded("org/corpus")
+    assert resolver._scan == (stamp, {"kept": "entry"}), "a dataset invalidated the index"
+
+
+def test_two_local_paths_differing_only_in_case_are_not_the_same_model(monkeypatch):
+    # _loaded_satisfies lowercased the request and every backend identifier, so on a
+    # case-sensitive filesystem /srv/models/foo.gguf read as satisfied by a resident
+    # /srv/models/Foo.gguf. A repo alias must still stay case-insensitive.
+    import os
+
+    loaded = _FakeBackend(loaded_id = "/srv/models/Foo.gguf")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: loaded)
+    monkeypatch.setattr(
+        inference_route,
+        "get_inference_backend",
+        lambda: type("B", (), {"active_model_name": None})(),
+    )
+    assert inference_route._loaded_satisfies("/srv/models/Foo.gguf") is True
+    same = os.path.normcase("A") == os.path.normcase("a")
+    assert inference_route._loaded_satisfies("/srv/models/foo.gguf") is same
+
+    alias = _FakeBackend(loaded_id = "unsloth/Qwen3-4B-GGUF")
+    monkeypatch.setattr(inference_route, "get_llama_cpp_backend", lambda: alias)
+    assert inference_route._loaded_satisfies("unsloth/qwen3-4b-gguf") is True
diff --git a/studio/backend/tests/test_openai_catalog.py b/studio/backend/tests/test_openai_catalog.py
index 552f122ebb..801d8908cf 100644
--- a/studio/backend/tests/test_openai_catalog.py
+++ b/studio/backend/tests/test_openai_catalog.py
@@ -64,8 +64,10 @@ def test_catalog_lists_loaded_and_available(monkeypatch):
         ]
 
     monkeypatch.setattr(inf, "_cached_local_catalog", _fake_catalog)
-    # GGUF-ness is read from the on-disk files; drive it off each info's flag here.
-    monkeypatch.setattr(resolver, "info_has_local_gguf", lambda info: info.is_gguf)
+    # GGUF-ness and the quant labels come from one on-disk scan; drive both off the flag.
+    monkeypatch.setattr(
+        resolver, "local_gguf_quants", lambda info: ("Q8_0",) if info.is_gguf else None
+    )
 
     data = asyncio.run(inf._openai_catalog_objects())
     ids = {m["id"]: m for m in data}
@@ -73,8 +75,9 @@ def test_catalog_lists_loaded_and_available(monkeypatch):
     # Loaded model is present, marked loaded, and keeps context fields.
     assert ids["Qwen3-Q4"]["loaded"] is True
     assert ids["Qwen3-Q4"]["context_length"] == 4096
-    # Available-but-not-loaded GGUF models are listed too.
+    # Not-loaded GGUFs are listed too, with the quant a client appends to pin them.
     assert ids["Llama-8B-Q8"]["loaded"] is False
+    assert ids["Llama-8B-Q8"]["quant"] == "Q8_0"
     # The HF-cache GGUF is listed despite model_format being unset.
     assert ids["org/Foo"]["loaded"] is False
     # The non-GGUF model is filtered out (/v1 can never serve it).
@@ -205,3 +208,156 @@ def test_cached_local_catalog_offloads_and_caches(monkeypatch):
     assert second is first or [i.id for i in second] == [i.id for i in first]
     assert calls["scan"] == 1  # cached: scanned once for two calls
     assert calls["threaded"] == 1  # offloaded to a worker thread
+
+
+def test_monitor_active_model_is_a_public_id_not_a_host_path(monkeypatch):
+    # The settings UI renders this and --secure serves it publicly, so never a load path.
+    class _Llama:
+        is_loaded = True
+        model_identifier = "/home/me/.cache/huggingface/hub/models--org--A-GGUF/snapshots/abc"
+        hf_variant = "UD-Q4_K_XL"
+        _openai_advertised_id = "org/A-GGUF"
+
+    monkeypatch.setattr(inf, "get_llama_cpp_backend", lambda: _Llama())
+    assert inf._monitor_active_model() == "org/A-GGUF:UD-Q4_K_XL"
+
+
+def test_monitor_active_model_cleans_a_path_with_no_advertised_id(monkeypatch):
+    class _Llama:
+        is_loaded = True
+        model_identifier = "/data/models/Llama-8B-Q8.gguf"
+        hf_variant = None
+        _openai_advertised_id = None
+
+    monkeypatch.setattr(inf, "get_llama_cpp_backend", lambda: _Llama())
+    label = inf._monitor_active_model()
+    assert "/" not in label and ".gguf" not in label
+
+
+def test_lifecycle_label_recovers_the_repo_id_from_an_hf_cache_path():
+    # An auto-switch load gets the snapshot dir, whose basename is a commit sha.
+    snap = "/home/me/.cache/huggingface/hub/models--unsloth--gemma-4-E4B-it-GGUF/snapshots/bfc15c3"
+    assert (
+        inf._lifecycle_model_label(snap, "UD-Q4_K_XL") == "unsloth/gemma-4-E4B-it-GGUF:UD-Q4_K_XL"
+    )
+
+
+def test_lifecycle_model_label_is_path_free():
+    label = inf._lifecycle_model_label("/data/models/Llama-8B-Q8.gguf", "Q8_0")
+    assert "/" not in label and ".gguf" not in label
+    assert inf._lifecycle_model_label("org/A-GGUF", "Q4_K_M") == "org/A-GGUF:Q4_K_M"
+    # An id that already carries a quant is not double-suffixed.
+    assert inf._lifecycle_model_label("org/A-GGUF:Q4_K_M", "Q8_0") == "org/A-GGUF:Q4_K_M"
+
+
+def test_a_standalone_gguf_does_not_advertise_a_quant_that_stops_resolving(monkeypatch):
+    # llama.cpp reads hf_variant off the filename, but the resolver stores standalone files
+    # with no quants, so a pinned "<stem>:<quant>" would 404 once it is not resident.
+    from core.inference.local_model_resolver import _LocalGgufEntry
+
+    standalone = _LocalGgufEntry("Qwen3-Q4", "/srv/models/Qwen3-Q4.gguf", ())
+    repo = _LocalGgufEntry("org/Foo", "/hf/models--org--Foo/snapshots/a", ("Q4_K_M",))
+    monkeypatch.setattr(resolver, "_scan", (1.0, {"qwen3-q4": standalone, "org/foo": repo}))
+    monkeypatch.setattr(inf, "get_inference_backend", lambda: _FakeUnsloth())
+
+    llama = _FakeLlama()
+    llama.hf_variant = "Q4_K_M"
+    monkeypatch.setattr(inf, "get_llama_cpp_backend", lambda: llama)
+    assert "quant" not in inf._openai_model_objects()[0]
+
+    # The same quant on a repo the resolver does list stays advertised.
+    llama.model_identifier = "org/Foo"
+    assert inf._openai_model_objects()[0]["quant"] == "Q4_K_M"
+
+    # A cold index cannot prove the reference either, and publishing on no proof is
+    # exactly what hands out the pin that later fails to resolve.
+    monkeypatch.setattr(resolver, "_scan", (0.0, {}))
+    # Stub the walk: a real multi-root scan inside the cold-wait budget makes this
+    # test time out into a 503 under load instead of asserting what it is here for.
+    monkeypatch.setattr(resolver, "_build_index", lambda: {})
+    monkeypatch.setattr(resolver, "warm_index_soon", lambda: None)
+    assert "quant" not in inf._openai_model_objects()[0]
+
+
+def test_a_loaded_alias_advertises_the_quant_that_is_actually_loaded(monkeypatch):
+    # Marking the alias loaded while still publishing the preferred on-disk quant said
+    # alias:Q4 was loaded while Q8 was serving, and pinning that 404s with switching off.
+    monkeypatch.setattr(inf, "get_inference_backend", lambda: _FakeUnsloth())
+    llama = _FakeLlama()
+    llama.hf_variant = "Q8_0"
+    monkeypatch.setattr(inf, "get_llama_cpp_backend", lambda: llama)
+
+    alias = _Info("/srv/models", "Qwen3", model_id = "publisher/Qwen3")
+    alias.path = "/srv/models"  # holds the resident /srv/models/Qwen3-Q4.gguf
+
+    async def _fake_catalog():
+        return [alias]
+
+    monkeypatch.setattr(inf, "_cached_local_catalog", _fake_catalog)
+    monkeypatch.setattr(resolver, "local_gguf_quants", lambda info: ("Q4_K_M", "Q8_0"))
+    ids = {m["id"]: m for m in asyncio.run(inf._openai_catalog_objects())}
+    assert ids["publisher/Qwen3"]["loaded"] is True
+    assert ids["publisher/Qwen3"]["quant"] == "Q8_0"
+
+
+def test_a_nested_model_directory_is_not_the_resident_one(monkeypatch):
+    # Two indexed models can nest (/models/A holding A, /models/A/sub/B holding B). A
+    # plain prefix test made loading B mark A resident, so a request for A was answered
+    # with B's weights. The innermost indexed model owns the file.
+    outer = _Info("/models/A", "A", model_id = "publisher/A")
+    outer.path = "/models/A"
+    inner = _Info("/models/A/sub/B", "B", model_id = "publisher/B")
+    inner.path = "/models/A/sub/B"
+    monkeypatch.setitem(inf._CATALOG_CACHE, "models", [outer, inner])
+
+    llama = _FakeLlama()
+    llama.gguf_path = "/models/A/sub/B/model-Q4_K_M.gguf"
+    llama.model_identifier = llama.gguf_path
+    monkeypatch.setattr(inf, "get_llama_cpp_backend", lambda: llama)
+    monkeypatch.setattr(inf, "get_inference_backend", lambda: _FakeUnsloth())
+
+    assert inf._resolves_to_resident("/models/A/sub/B") is True
+    assert inf._resolves_to_resident("/models/A") is False
+    # With nothing indexed there is no nesting to tell apart, so the directory-to-file
+    # match this exists for must still hold.
+    monkeypatch.setitem(inf._CATALOG_CACHE, "models", [])
+    assert inf._resolves_to_resident("/models/A") is True
+
+
+def test_a_transformers_model_does_not_mark_a_gguf_alias_loaded(monkeypatch):
+    # Every entry in this loop is advertised as GGUF with a GGUF quant. A Transformers
+    # model live from a directory that also holds GGUF exports is not one, and marking
+    # the alias loaded had the examples pin a quant nothing can serve with switching off.
+    unsloth = _FakeUnsloth()
+    unsloth.active_model_name = "/srv/models"
+    monkeypatch.setattr(inf, "get_inference_backend", lambda: unsloth)
+    monkeypatch.setattr(inf, "get_llama_cpp_backend", lambda: _FakeLlama(loaded = False))
+
+    alias = _Info("/srv/models", "Qwen3", model_id = "publisher/Qwen3")
+    alias.path = "/srv/models"  # also holds /srv/models/Qwen3-Q4.gguf
+
+    async def _fake_catalog():
+        return [alias]
+
+    monkeypatch.setattr(inf, "_cached_local_catalog", _fake_catalog)
+    monkeypatch.setattr(resolver, "local_gguf_quants", lambda info: ("Q4_K_M",))
+    ids = {m["id"]: m for m in asyncio.run(inf._openai_catalog_objects())}
+    assert ids["publisher/Qwen3"]["loaded"] is False
+
+
+def test_an_alias_for_the_resident_weights_is_not_listed_as_unloaded(monkeypatch):
+    # A GGUF loaded by absolute path keys the resident entry by basename, so an id-only dedup
+    # would emit the alias again marked not loaded.
+    monkeypatch.setattr(inf, "get_llama_cpp_backend", lambda: _FakeLlama())
+    monkeypatch.setattr(inf, "get_inference_backend", lambda: _FakeUnsloth())
+
+    alias = _Info("/srv/models", "Qwen3", model_id = "publisher/Qwen3")
+    alias.path = "/srv/models"  # holds the resident /srv/models/Qwen3-Q4.gguf
+
+    async def _fake_catalog():
+        return [alias]
+
+    monkeypatch.setattr(inf, "_cached_local_catalog", _fake_catalog)
+    monkeypatch.setattr(resolver, "local_gguf_quants", lambda info: ("Q4_K_M",))
+    ids = {m["id"]: m for m in asyncio.run(inf._openai_catalog_objects())}
+    assert ids["publisher/Qwen3"]["loaded"] is True
diff --git a/studio/backend/tests/test_openai_tool_passthrough.py b/studio/backend/tests/test_openai_tool_passthrough.py
index 161c8743c4..eeb6cee871 100644
--- a/studio/backend/tests/test_openai_tool_passthrough.py
+++ b/studio/backend/tests/test_openai_tool_passthrough.py
@@ -1191,6 +1191,41 @@ class TestBuildPassthroughPayloadToolChoice:
         body = _build_passthrough_payload(**self._args(), tool_choice = tc)
         assert body["tool_choice"] == tc
 
+    def test_llama_incompatible_tool_constraints_are_omitted(self):
+        args = self._args()
+        schema = args["openai_tools"][0]["function"]["parameters"]
+        schema["properties"] = {
+            "declarationKey": {"type": "string", "pattern": r"\S"},
+            "exactKey": {"type": "string", "pattern": r"^[A-Z]+$"},
+            "nested": {
+                "type": "array",
+                "items": {
+                    "anyOf": [
+                        {"type": "string", "pattern": "token"},
+                        {"type": "string", "pattern": "^fixed$"},
+                    ],
+                    "default": {"pattern": "annotation data"},
+                },
+            },
+            "largeScript": {"type": "string", "minLength": 1, "maxLength": 65536},
+            "boundedScript": {"type": "string", "maxLength": 2000},
+        }
+
+        body = _build_passthrough_payload(**args)
+        forwarded = body["tools"][0]["function"]["parameters"]["properties"]
+
+        assert forwarded["declarationKey"] == {"type": "string"}
+        assert forwarded["exactKey"]["pattern"] == r"^[A-Z]+$"
+        nested = forwarded["nested"]["items"]
+        assert nested["anyOf"][0] == {"type": "string"}
+        assert nested["anyOf"][1]["pattern"] == "^fixed$"
+        assert nested["default"] == {"pattern": "annotation data"}
+        assert forwarded["largeScript"] == {"type": "string", "minLength": 1}
+        assert forwarded["boundedScript"]["maxLength"] == 2000
+        assert schema["properties"]["declarationKey"]["pattern"] == r"\S"
+        assert schema["properties"]["nested"]["items"]["anyOf"][0]["pattern"] == "token"
+        assert schema["properties"]["largeScript"]["maxLength"] == 65536
+
     def test_stream_omits_usage_options_when_client_did_not_request_them(self):
         args = self._args()
         args["stream"] = True
@@ -1611,7 +1646,7 @@ class TestOpenAICompatibilityHelpers:
     def test_openai_stream_error_sse_closes_with_done(self):
         error = {"error": {"message": "boom"}}
         assert _openai_stream_error_sse(error) == (
-            'data: {"error": {"message": "boom"}}\n\n' "data: [DONE]\n\n"
+            'data: {"error": {"message": "boom"}}\n\ndata: [DONE]\n\n'
         )
 
     @pytest.mark.parametrize(
@@ -4580,6 +4615,9 @@ class TestApiMonitorProviderAndCompletionStreams:
                 async def json(self):
                     return {"prompt": "hi", "stream": False}
 
+                async def is_disconnected(self):
+                    return False
+
             class FailingAsyncClient:
                 async def __aenter__(self):
                     return self
@@ -4587,14 +4625,18 @@ class TestApiMonitorProviderAndCompletionStreams:
                 async def __aexit__(self, *_args):
                     return False
 
+                async def aclose(self):
+                    return None
+
                 async def post(self, *_args, **_kwargs):
                     raise httpx.ConnectError("llama down")
 
             monitor = ApiMonitor(max_entries = 3)
             monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            # Per-request client so a forced swap can close it mid-call; the pooled one is shared.
             monkeypatch.setattr(
                 inf_mod,
-                "nonstreaming_client",
+                "_cancelable_nonstreaming_client",
                 lambda: FailingAsyncClient(),
             )
             monkeypatch.setattr(
@@ -4632,9 +4674,15 @@ class TestApiMonitorProviderAndCompletionStreams:
                 async def json(self):
                     return {"prompt": "hi", "stream": False}
 
+                async def is_disconnected(self):
+                    return False
+
             captured = []
 
             class CapturingClient:
+                async def aclose(self):
+                    return None
+
                 async def post(self, _url, *, json, **_kwargs):
                     captured.append(dict(json))
                     return httpx.Response(
@@ -4652,7 +4700,9 @@ class TestApiMonitorProviderAndCompletionStreams:
 
             monitor = ApiMonitor(max_entries = 3)
             monkeypatch.setattr(inf_mod, "api_monitor", monitor)
-            monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: CapturingClient())
+            monkeypatch.setattr(
+                inf_mod, "_cancelable_nonstreaming_client", lambda: CapturingClient()
+            )
             monkeypatch.setattr(
                 inf_mod,
                 "get_llama_cpp_backend",
@@ -4683,9 +4733,15 @@ class TestApiMonitorProviderAndCompletionStreams:
                 async def json(self):
                     return {"prompt": "hi", "stream": False, "max_tokens": 0}
 
+                async def is_disconnected(self):
+                    return False
+
             captured = []
 
             class CapturingClient:
+                async def aclose(self):
+                    return None
+
                 async def post(self, _url, *, json, **_kwargs):
                     captured.append(dict(json))
                     return httpx.Response(
@@ -4703,7 +4759,9 @@ class TestApiMonitorProviderAndCompletionStreams:
 
             monitor = ApiMonitor(max_entries = 3)
             monkeypatch.setattr(inf_mod, "api_monitor", monitor)
-            monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: CapturingClient())
+            monkeypatch.setattr(
+                inf_mod, "_cancelable_nonstreaming_client", lambda: CapturingClient()
+            )
             monkeypatch.setattr(
                 inf_mod,
                 "get_llama_cpp_backend",
@@ -4741,6 +4799,7 @@ class TestApiMonitorProviderAndCompletionStreams:
             monitor = ApiMonitor(max_entries = 3)
             monkeypatch.setattr(inf_mod, "api_monitor", monitor)
             monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: UnusedClient())
+            monkeypatch.setattr(inf_mod, "_cancelable_nonstreaming_client", lambda: UnusedClient())
             monkeypatch.setattr(
                 inf_mod,
                 "get_llama_cpp_backend",
@@ -4845,6 +4904,9 @@ class TestApiMonitorProviderAndCompletionStreams:
                 async def json(self):
                     return {"input": ["alpha", "beta"], "model": "embed"}
 
+                async def is_disconnected(self):
+                    return False
+
             class FakeAsyncClient:
                 async def __aenter__(self):
                     return self
@@ -4852,6 +4914,9 @@ class TestApiMonitorProviderAndCompletionStreams:
                 async def __aexit__(self, *_args):
                     return False
 
+                async def aclose(self):
+                    return None
+
                 async def post(self, *_args, **_kwargs):
                     assert monitor.active_count() == 1
                     return httpx.Response(
@@ -4864,9 +4929,10 @@ class TestApiMonitorProviderAndCompletionStreams:
 
             monitor = ApiMonitor(max_entries = 3)
             monkeypatch.setattr(inf_mod, "api_monitor", monitor)
+            # Per-request client so a forced swap can close it mid-call; the pooled one is shared.
             monkeypatch.setattr(
                 inf_mod,
-                "nonstreaming_client",
+                "_cancelable_nonstreaming_client",
                 lambda: FakeAsyncClient(),
             )
             monkeypatch.setattr(
@@ -6337,7 +6403,7 @@ class TestApiMonitorSafetensorsUsage:
                     }
                     yield "safe reply"
 
-                def reset_generation_state(self):
+                def reset_generation_state(self, caller_cancel_event = None):
                     pass
 
             monitor = ApiMonitor(max_entries = 3)
@@ -6408,7 +6474,7 @@ class TestApiMonitorSafetensorsUsage:
                     cancel_event.set()
                     yield {"type": "content", "text": "ignored"}
 
-                def reset_generation_state(self):
+                def reset_generation_state(self, caller_cancel_event = None):
                     pass
 
             monitor = ApiMonitor(max_entries = 3)
@@ -6469,11 +6535,18 @@ class TestApiMonitorSafetensorsUsage:
                 def generate_chat_completion_with_tools(self, **_kwargs):
                     yield {"type": "content", "text": "unused"}
 
-                def reset_generation_state(self):
+                def reset_generation_state(self, caller_cancel_event = None):
                     nonlocal reset_called
                     reset_called = True
 
-            async def fake_to_thread(*_args, **_kwargs):
+            async def fake_to_thread(
+                func = None,
+                *_args,
+                **_kwargs,
+            ):
+                # Only the generation hop should cancel; resolution runs before the row opens.
+                if getattr(func, "__name__", "") == "resolve_local_gguf":
+                    return None
                 raise asyncio.CancelledError()
 
             monitor = ApiMonitor(max_entries = 3)
diff --git a/studio/backend/tests/test_orchestrator_unload_cancel.py b/studio/backend/tests/test_orchestrator_unload_cancel.py
index 3a36500aee..7963b71e8e 100644
--- a/studio/backend/tests/test_orchestrator_unload_cancel.py
+++ b/studio/backend/tests/test_orchestrator_unload_cancel.py
@@ -19,6 +19,10 @@ def _bare_orchestrator():
     """An orchestrator without the real __init__ subprocess/network."""
     o = InferenceOrchestrator.__new__(InferenceOrchestrator)
     o._gen_lock = threading.Lock()
+    o._send_order_lock = threading.Lock()
+    o._active_cancel_lock = threading.Lock()
+    o._active_cancel_events = []
+    o._executing_cancel_events = []
     o._cancel_event = threading.Event()  # stands in for the mp.Event
     o._drain_event = threading.Event()  # stands in for the unload-drain mp.Event
     o._proc = object()  # truthy so _ensure_subprocess_alive reports alive
@@ -775,6 +779,7 @@ def test_dispatched_bails_when_unload_flips_before_mailbox_registration(monkeypa
     o = _bare_orchestrator()
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._unload_pending = False
     monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
     monkeypatch.setattr(o, "_start_dispatcher", lambda: None)
@@ -817,6 +822,7 @@ def test_dispatched_bails_when_model_swapped_before_mailbox_registration(monkeyp
     o = _bare_orchestrator()
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._unload_pending = False
     o._dispatcher_thread = _AliveDispatcher()
     monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
@@ -846,6 +852,7 @@ def test_dispatched_bails_when_dispatcher_stopped_before_mailbox_registration(mo
     o = _bare_orchestrator()
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._unload_pending = False
     o._dispatcher_thread = _AliveDispatcher()
     monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
@@ -872,6 +879,7 @@ def test_dispatched_happy_path_registers_and_sends(monkeypatch):
     o = _bare_orchestrator()
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._unload_pending = False
     o._dispatcher_thread = _AliveDispatcher()
     monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
@@ -1338,6 +1346,7 @@ def test_dispatched_bail_stops_orphan_dispatcher_it_started(monkeypatch):
     o = _bare_orchestrator()
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._unload_pending = False
     o._dispatcher_thread = None  # none running -> this call starts it
     monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
@@ -1382,6 +1391,7 @@ def test_dispatched_bail_keeps_dispatcher_with_other_active_mailbox(monkeypatch)
     o = _bare_orchestrator()
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._unload_pending = False
     o._dispatcher_thread = None
     monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
@@ -1419,6 +1429,7 @@ def test_dispatched_bail_keeps_preexisting_dispatcher(monkeypatch):
     o = _bare_orchestrator()
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._unload_pending = False
     o._dispatcher_thread = _AliveDispatcher()  # already running
     monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
@@ -1545,6 +1556,7 @@ def test_concurrent_start_dispatcher_spawns_exactly_one():
     o._resp_queue = _queue.Queue()  # real queue so the dispatcher loop blocks and stays alive
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._dispatcher_thread = None
     o._dispatcher_stop = threading.Event()
     o._dispatcher_lifecycle_lock = threading.Lock()
@@ -1660,6 +1672,7 @@ def test_queued_start_behind_unload_stop_spawns_no_dispatcher():
     o._resp_queue = _queue.Queue()  # a spawned dispatcher would block-read here and stay alive
     o._mailbox_lock = threading.Lock()
     o._mailboxes = {}
+    o._request_cancel_events = {}
     o._dispatcher_stop = threading.Event()
     o._dispatcher_lifecycle_lock = threading.Lock()
     o._unload_pending = False
@@ -1713,3 +1726,310 @@ def test_queued_start_behind_unload_stop_spawns_no_dispatcher():
     assert o._dispatcher_thread is None, "the stop cleared it and the queued start spawned nothing"
     live = [t for t in threading.enumerate() if t.name == "inference-dispatcher" and t.is_alive()]
     assert live == [], "no fresh dispatcher may be left to consume the unloaded reply"
+
+
+def _dispatch(o, resps):
+    """Run the dispatcher over a fixed response list and stop it."""
+    import queue as _queue
+
+    o._resp_queue = _queue.Queue()
+    for r in resps:
+        o._resp_queue.put(r)
+    o._dispatcher_stop = threading.Event()
+    t = threading.Thread(target = o._dispatcher_loop, daemon = True)
+    t.start()
+    deadline = time.monotonic() + 5.0
+    while not o._resp_queue.empty() and time.monotonic() < deadline:
+        time.sleep(0.01)
+    o._dispatcher_stop.set()
+    t.join(timeout = 5.0)
+
+
+def test_worker_ownership_follows_the_worker_not_the_consumer():
+    # The subprocess runs one generation at a time and can start B while A's consumer has yet to
+    # drain its mailbox. A must stop owning the worker the moment its gen_done is routed, else
+    # a late Stop for A cancels B.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    a_cancel, b_cancel = threading.Event(), threading.Event()
+    o._mailboxes = {"a": _queue.Queue(), "b": _queue.Queue()}
+    o._request_cancel_events = {"a": a_cancel, "b": b_cancel}
+    o._claim_worker(a_cancel)
+    o._claim_worker(b_cancel)
+
+    _dispatch(o, [{"type": "token", "request_id": "a", "token": "hi"}])
+    assert o._owns_worker(a_cancel), "the request the worker is answering owns it"
+    assert not o._owns_worker(b_cancel), "a queued request does not"
+
+    # A finishes. B has been sent but has not answered yet (it is prefilling), so the gap
+    # between the two is the window a late Stop for A used to fire into.
+    _dispatch(o, [{"type": "gen_done", "request_id": "a"}])
+    assert not o._owns_worker(a_cancel), "a finished request stops owning the worker"
+    assert o._owns_worker(b_cancel), "the next queued request is the one prefilling"
+
+    # Worker moves on to B, still before A's consumer reads anything.
+    _dispatch(o, [{"type": "token", "request_id": "b", "token": "yo"}])
+    assert not o._owns_worker(a_cancel), "a finished request must not cancel its successor"
+    assert o._owns_worker(b_cancel), "the worker moved on to B, so B owns it"
+
+    # A's own stream unwinding afterwards must not disturb B.
+    o._release_worker(a_cancel)
+    assert o._owns_worker(b_cancel)
+
+
+def test_status_responses_do_not_transfer_worker_ownership():
+    # Status lines are not an answer to any request; the dispatcher drops them before routing.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    a_cancel, b_cancel = threading.Event(), threading.Event()
+    o._mailboxes = {"a": _queue.Queue(), "b": _queue.Queue()}
+    o._request_cancel_events = {"a": a_cancel, "b": b_cancel}
+    o._claim_worker(a_cancel)
+    o._claim_worker(b_cancel)
+
+    _dispatch(o, [{"type": "status", "request_id": "b", "message": "loading"}])
+    # Nothing has answered, so the oldest claim is still the one prefilling.
+    assert o._owns_worker(a_cancel)
+    assert not o._owns_worker(b_cancel)
+
+
+def test_only_the_latest_responder_executes():
+    # The subprocess runs one generation at a time, so answering B means it has left A.
+    # _generate_inner promotes from its own consumer and can share the worker with a
+    # dispatched request, so the two must not both count as executing.
+    o = _bare_orchestrator()
+    a_cancel, b_cancel = threading.Event(), threading.Event()
+    o._claim_worker(a_cancel)
+    o._claim_worker(b_cancel)
+
+    o._mark_worker_started(a_cancel)
+    assert o._owns_worker(a_cancel)
+    o._mark_worker_started(b_cancel)
+    assert o._owns_worker(b_cancel), "the latest responder is the one executing"
+    assert not o._owns_worker(a_cancel), "and it is the only one"
+    # Idempotent: more of B's own tokens must not disturb it.
+    o._mark_worker_started(b_cancel)
+    assert o._owns_worker(b_cancel)
+
+
+def test_a_stale_mailbox_read_does_not_cancel_the_running_generation():
+    # A dispatched consumer can still be draining tokens after the dispatcher retired its request
+    # and started the next one. Stopping it then must tear down only its own stream: signalling
+    # the shared worker event would end its successor.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    a_cancel, b_cancel = threading.Event(), threading.Event()
+    o._mailboxes = {"a": _queue.Queue(), "b": _queue.Queue()}
+    o._request_cancel_events = {"a": a_cancel, "b": b_cancel}
+    o._claim_worker(a_cancel)
+    o._claim_worker(b_cancel)
+    # Worker finished A and moved on to B.
+    _dispatch(
+        o,
+        [
+            {"type": "gen_done", "request_id": "a"},
+            {"type": "token", "request_id": "b", "token": "yo"},
+        ],
+    )
+    assert o._owns_worker(b_cancel) and not o._owns_worker(a_cancel)
+
+    # A's consumer now reads a token buffered before that, with A stopped.
+    a_cancel.set()
+    stale = [{"type": "token", "request_id": "a", "text": "late"}]
+    drained = []
+    list(
+        o._consume_token_stream(
+            lambda timeout: stale.pop(0) if stale else None,
+            lambda: drained.append(True),
+            crash_context = "generation",
+            cancel_event = a_cancel,
+            mark_started = False,
+        )
+    )
+    assert drained, "the stopped stream still tears itself down"
+    assert not o._cancel_event.is_set(), "a retired request must not signal the shared worker event"
+
+    # The generation that does own the worker still can.
+    b_cancel.set()
+    stale_b = [{"type": "token", "request_id": "b", "text": "live"}]
+    list(
+        o._consume_token_stream(
+            lambda timeout: stale_b.pop(0) if stale_b else None,
+            lambda: None,
+            crash_context = "generation",
+            cancel_event = b_cancel,
+            mark_started = False,
+        )
+    )
+    assert o._cancel_event.is_set(), "the running generation's own Stop must reach the worker"
+
+
+def test_a_dispatcher_started_mid_stream_still_reaches_the_direct_reader():
+    # A compare request can start the dispatcher while an ordinary chat is streaming. The
+    # dispatcher then owns resp_queue, and without a mailbox for the direct reader it dropped
+    # that chat's tokens and its gen_done as unaddressed, hanging it.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._direct_mailboxes = {}
+    o._request_cancel_events = {}
+
+    read_one, _drain, release = o._direct_reader("direct-1")
+    try:
+        _dispatch(
+            o,
+            [
+                {"type": "token", "request_id": "direct-1", "text": "hi"},
+                {"type": "gen_done", "request_id": "direct-1"},
+            ],
+        )
+        assert read_one(timeout = 0.1) == {
+            "type": "token",
+            "request_id": "direct-1",
+            "text": "hi",
+        }, "the dispatcher must route to the direct reader, not drop"
+        assert read_one(timeout = 0.1)["type"] == "gen_done"
+    finally:
+        release()
+    assert o._direct_mailboxes == {}, "the mailbox is dropped when the stream ends"
+
+
+def test_the_direct_reader_hands_back_a_compare_response_it_took():
+    # The mirror race: this reader is already blocked on resp_queue when a compare request's
+    # dispatcher starts, so it can take that request's response first. Consuming it would
+    # corrupt this chat and hang the compare pane.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    compare_box: _queue.Queue = _queue.Queue()
+    o._mailboxes = {"compare-1": compare_box}
+    o._direct_mailboxes = {}
+    o._request_cancel_events = {}
+    o._resp_queue = _queue.Queue()
+    o._dispatcher_thread = None  # no dispatcher yet: this reader owns the queue
+
+    read_one, _drain, release = o._direct_reader("direct-1")
+    try:
+        o._resp_queue.put({"type": "token", "request_id": "compare-1", "text": "theirs"})
+        o._resp_queue.put({"type": "token", "request_id": "direct-1", "text": "mine"})
+        assert read_one(timeout = 0.1) is None, "a foreign response is not ours to yield"
+        assert compare_box.get_nowait()["text"] == "theirs", "it goes to its own mailbox"
+        assert read_one(timeout = 0.1)["text"] == "mine"
+    finally:
+        release()
+
+
+def test_a_direct_mailbox_is_not_mistaken_for_compare_activity():
+    # _mailboxes means "compare requests are in flight" to the unload and distributed paths,
+    # so an ordinary chat's mailbox must live somewhere else.
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._direct_mailboxes = {}
+    _read_one, _drain, release = o._direct_reader("direct-1")
+    try:
+        assert o._mailboxes == {}
+        assert "direct-1" in o._direct_mailboxes
+    finally:
+        release()
+
+
+def test_replacing_the_subprocess_clears_worker_scoped_state():
+    # Ownership is keyed only by cancel-event identity, so a consumer still blocked on its
+    # mailbox when the worker was replaced stayed recorded as the executor. A generation on
+    # the fresh worker then failed _owns_worker and could not be stopped.
+    import queue as _queue
+
+    o = _bare_orchestrator()
+    o._mailbox_lock = threading.Lock()
+    dead = threading.Event()
+    o._mailboxes = {"compare-1": _queue.Queue()}
+    o._direct_mailboxes = {"direct-1": _queue.Queue()}
+    o._request_cancel_events = {"compare-1": dead}
+    o._claim_worker(dead)
+    o._mark_worker_started(dead)
+    assert o._owns_worker(dead)
+
+    o._reset_worker_scoped_state()
+
+    assert o._mailboxes == {} and o._direct_mailboxes == {}
+    assert o._request_cancel_events == {}
+    assert o._active_cancel_events == [] and o._executing_cancel_events == []
+    # A generation on the fresh worker owns it rather than being refused by a ghost.
+    fresh = threading.Event()
+    o._claim_worker(fresh)
+    assert o._owns_worker(fresh), "the dead worker's request must not outrank a live one"
+
+
+def test_audio_input_claims_the_worker_before_sending():
+    # Unclaimed, a compare request queued behind an audio-input generation looked like the
+    # oldest owner, so stopping that queued request signalled the worker and killed this.
+    import ast
+    import pathlib
+
+    src = pathlib.Path(orch_mod.__file__).read_text(encoding = "utf-8")
+    tree = ast.parse(src)
+    fn = next(
+        n
+        for n in ast.walk(tree)
+        if isinstance(n, ast.FunctionDef) and n.name == "_generate_audio_input_inner"
+    )
+    body = ast.get_source_segment(src, fn) or ""
+    claim = body.find("self._claim_worker(cancel_event)")
+    send = body.find("self._send_cmd(cmd)")
+    assert claim != -1, "_generate_audio_input_inner must claim the worker"
+    assert send != -1
+    assert claim < send, "the claim has to happen before the command is enqueued"
+    assert "with self._send_order_lock:" in body, "claim and send must be one critical section"
+    assert "self._release_worker(cancel_event)" in body
+
+
+def test_generation_stopped_while_queued_is_never_sent(monkeypatch):
+    # Two chats on the serialized backend: the second blocks on _gen_lock, and Stop sets its
+    # event while it waits. Sending anyway occupied the worker with a run the user ended --
+    # the cancel is only checked on a token, so a long prefill (or a generation that reaches
+    # gen_done without one) still held up its siblings.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(o, "_wait_dispatcher_idle", lambda *a, **k: None)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send a generation already stopped")
+    )
+    stopped = threading.Event()
+    stopped.set()
+
+    out = list(
+        o._generate_inner(messages = [{"role": "user", "content": "hi"}], cancel_event = stopped)
+    )
+
+    assert out == [], "a stopped request yields nothing rather than an error banner"
+    assert o._active_cancel_events == [], "it must not claim the worker either"
+    assert o._gen_lock.acquire(blocking = False)
+    o._gen_lock.release()
+
+
+def test_audio_input_stopped_while_queued_is_never_sent(monkeypatch):
+    # Same lock, same hole.
+    o = _bare_orchestrator()
+    monkeypatch.setattr(o, "_ensure_subprocess_alive", lambda: True)
+    monkeypatch.setattr(
+        o, "_send_cmd", lambda cmd: pytest.fail("must not send a generation already stopped")
+    )
+    stopped = threading.Event()
+    stopped.set()
+
+    out = list(o._generate_audio_input_inner(audio_array = [0.0, 0.1], cancel_event = stopped))
+
+    assert out == []
+    assert o._active_cancel_events == []
+    assert o._gen_lock.acquire(blocking = False)
+    o._gen_lock.release()
diff --git a/studio/backend/tests/test_parallel_slots_per_load.py b/studio/backend/tests/test_parallel_slots_per_load.py
index 59f1109b7d..2d881fd6cc 100644
--- a/studio/backend/tests/test_parallel_slots_per_load.py
+++ b/studio/backend/tests/test_parallel_slots_per_load.py
@@ -312,7 +312,7 @@ def _load_impl_source() -> str:
 def test_route_resolves_slots_once_before_dedupe_guard_and_load():
     load_impl = _load_impl_source()
     resolve = load_impl.index("request.n_parallel")
-    fallback = load_impl.index('getattr(fastapi_request.app.state, "llama_parallel_slots", 1)')
+    fallback = load_impl.index('getattr(_app_state, "llama_parallel_slots", 1)')
     dedupe = load_impl.index("requested_parallel_slots = _n_parallel")
     guard = load_impl.index("_guard_chat_load_against_training")
     # The GGUF launch kwargs, not the guard's own kwarg (which shares the spelling).
@@ -324,7 +324,10 @@ def test_route_resolves_slots_once_before_dedupe_guard_and_load():
     # nothing re-reads app.state after the single resolution point.
     assert load_impl.count("n_parallel = _n_parallel") == 2
     assert "n_parallel = _n_parallel" in load_impl[load_kwargs : load_kwargs + 800]
-    assert load_impl.count('getattr(fastapi_request.app.state, "llama_parallel_slots", 1)') == 1
+    assert load_impl.count('getattr(_app_state, "llama_parallel_slots", 1)') == 1
+    # Reached by getattr, so a direct caller passing a request without an app
+    # cannot raise; a bare attribute read would also be a second resolution.
+    assert "fastapi_request.app.state" not in load_impl
 
 
 def test_route_dedupe_compares_requested_slots_and_skips_diffusion():
@@ -361,7 +364,7 @@ def test_parallel_slot_echo_reports_none_for_diffusion():
 def test_validate_route_prefers_request_n_parallel():
     validate_impl = _route_source()[_route_source().index("async def validate_model") :]
     resolve = validate_impl.index("request.n_parallel")
-    fallback = validate_impl.index('getattr(fastapi_request.app.state, "llama_parallel_slots", 1)')
+    fallback = validate_impl.index('"llama_parallel_slots",')
     guard = validate_impl.index("_guard_chat_load_against_training")
     assert guard < resolve and guard < fallback, "the guard call resolves the slots inline"
 
diff --git a/studio/backend/tests/test_passthrough_healing.py b/studio/backend/tests/test_passthrough_healing.py
index da261e8d0d..5a01839914 100644
--- a/studio/backend/tests/test_passthrough_healing.py
+++ b/studio/backend/tests/test_passthrough_healing.py
@@ -504,11 +504,12 @@ def _upstream_message(
 
 
 class ScriptedClient:
-    """Fake nonstreaming_client() returning scripted JSON bodies, counting POSTs."""
+    """Fake upstream client returning scripted JSON bodies, counting POSTs."""
 
     def __init__(self, bodies):
         self.bodies = list(bodies)
         self.posts = []
+        self.closed = False
 
     async def post(
         self,
@@ -520,6 +521,10 @@ class ScriptedClient:
         self.posts.append(json)
         return httpx.Response(200, json = self.bodies[min(len(self.posts) - 1, len(self.bodies) - 1)])
 
+    async def aclose(self):
+        # The Anthropic pass-through owns its client and closes it in a finally.
+        self.closed = True
+
 
 async def _drive_non_streaming(monkeypatch, payload, bodies):
     import routes.inference as inf_mod
@@ -867,7 +872,7 @@ class TestNudgeRetryAnthropic:
         from routes.inference import _anthropic_passthrough_non_streaming
 
         client = ScriptedClient(bodies)
-        monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: client)
+        monkeypatch.setattr(inf_mod, "_cancelable_nonstreaming_client", lambda: client)
         response = await _anthropic_passthrough_non_streaming(
             _llama_backend(),
             [{"role": "user", "content": "hi"}],
@@ -925,7 +930,7 @@ class TestAnthropicPassthroughHealingText:
         from routes.inference import _anthropic_passthrough_non_streaming
 
         client = ScriptedClient([upstream])
-        monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: client)
+        monkeypatch.setattr(inf_mod, "_cancelable_nonstreaming_client", lambda: client)
         response = await _anthropic_passthrough_non_streaming(
             _llama_backend(),
             [{"role": "user", "content": "hi"}],
@@ -1171,7 +1176,7 @@ class TestAnthropicNonStreamingRoute:
         from routes.inference import _anthropic_passthrough_non_streaming
 
         client = ScriptedClient(bodies)
-        monkeypatch.setattr(inf_mod, "nonstreaming_client", lambda: client)
+        monkeypatch.setattr(inf_mod, "_cancelable_nonstreaming_client", lambda: client)
         response = await _anthropic_passthrough_non_streaming(
             _llama_backend(),
             [{"role": "user", "content": "hi"}],
diff --git a/studio/backend/tests/test_safetensors_tool_loop.py b/studio/backend/tests/test_safetensors_tool_loop.py
index bb18acf6e5..1043005f64 100644
--- a/studio/backend/tests/test_safetensors_tool_loop.py
+++ b/studio/backend/tests/test_safetensors_tool_loop.py
@@ -5051,3 +5051,27 @@ class TestFalseAlarmMarkerProse:
         assert [c[0] for c in exec_fn.calls] == ["web_search", "python"]
         assistant = next(m for m in convs[1] if m["role"] == "assistant")
         assert '"python"' not in (assistant.get("content") or "")
+
+
+def test_both_tool_loops_say_they_are_waiting_for_approval():
+    """A gated call must not report "Running" in either loop.
+
+    The GGUF loop was fixed first and the safetensors one was missed, so the
+    badge counted up "Running ..." against a prompt nobody had answered yet.
+    Asserted on the source so the two paths cannot drift apart again.
+    """
+    import ast
+    import os
+
+    backend = os.path.join(os.path.dirname(__file__), "..")
+    for name in ("core/inference/safetensors_agentic.py", "core/inference/llama_cpp.py"):
+        with open(os.path.join(backend, name), encoding = "utf-8") as f:
+            tree = ast.parse(f.read())
+        calls = [
+            node
+            for node in ast.walk(tree)
+            if isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Name)
+            and node.func.id == "awaiting_approval_status"
+        ]
+        assert calls, f"{name} still announces a gated tool call as running"
diff --git a/studio/backend/tests/test_sf_client_tools_passthrough.py b/studio/backend/tests/test_sf_client_tools_passthrough.py
index f91eec9817..3cc7d0604f 100644
--- a/studio/backend/tests/test_sf_client_tools_passthrough.py
+++ b/studio/backend/tests/test_sf_client_tools_passthrough.py
@@ -95,7 +95,7 @@ class _ScriptedBackend:
         for snap in snapshots:
             yield snap
 
-    def reset_generation_state(self):
+    def reset_generation_state(self, caller_cancel_event = None):
         self.reset_count += 1
 
 
diff --git a/studio/backend/tests/test_shutdown_preserves_live_worker.py b/studio/backend/tests/test_shutdown_preserves_live_worker.py
index faf273411c..15ef93c002 100644
--- a/studio/backend/tests/test_shutdown_preserves_live_worker.py
+++ b/studio/backend/tests/test_shutdown_preserves_live_worker.py
@@ -9,6 +9,8 @@ holds sidecar transformers modules (breaking the rename on Windows). The methods
 the handle and return False so callers can refuse the swap.
 """
 
+import threading
+
 import pytest
 
 from core.export.orchestrator import ExportOrchestrator
@@ -52,6 +54,14 @@ def _bare_inference():
     o._resp_queue = _Q()
     o._cancel_event = None
     o._drain_event = None
+    # Worker-scoped bookkeeping the teardown clears (see _reset_worker_scoped_state).
+    o._active_cancel_lock = threading.Lock()
+    o._active_cancel_events = []
+    o._executing_cancel_events = []
+    o._mailbox_lock = threading.Lock()
+    o._mailboxes = {}
+    o._direct_mailboxes = {}
+    o._request_cancel_events = {}
     return o
 
 
diff --git a/studio/backend/tests/test_system_vulkan_gpu_info.py b/studio/backend/tests/test_system_vulkan_gpu_info.py
index 4742b6b4bb..37fb9e6da1 100644
--- a/studio/backend/tests/test_system_vulkan_gpu_info.py
+++ b/studio/backend/tests/test_system_vulkan_gpu_info.py
@@ -56,7 +56,9 @@ def test_system_gpu_info_preserves_vulkan_visibility_metrics(monkeypatch):
     assert gpu["available"] is False
     assert gpu["backend"] == "cpu"
     assert gpu["index_kind"] == "relative"
-    assert gpu["gguf_gpu_ids_supported"] is False
+    # A Vulkan llama.cpp build accepts gpu_ids even when torch training is
+    # CPU-only: the pick is a ggml ordinal, not a torch device index.
+    assert gpu["gguf_gpu_ids_supported"] is True
     assert gpu["devices"] == []
     assert inference_gpu["backend"] == "vulkan"
     assert inference_gpu["devices"] == [vulkan_device]
@@ -124,7 +126,8 @@ def test_system_gpu_info_keeps_forced_vulkan_separate_from_training_metrics(monk
     assert gpu["devices"][0]["vram_used_gb"] == 6.0
     assert inference_gpu["backend"] == "vulkan"
     assert inference_gpu["devices"][0]["vram_used_gb"] == 1.0
-    assert inference_gpu["gguf_gpu_ids_supported"] is False
+    # Probed devices exist, so the ordinals are known and picks are offered.
+    assert inference_gpu["gguf_gpu_ids_supported"] is True
 
 
 def test_system_gpu_info_does_not_merge_metrics_across_backend_index_spaces(monkeypatch):
@@ -169,3 +172,85 @@ def test_system_gpu_info_does_not_merge_metrics_across_backend_index_spaces(monk
 
     assert gpu["devices"] == [vulkan_device]
     assert inference_gpu == gpu
+
+
+def test_vulkan_inference_gpu_uses_real_device_names_and_igpu_flag(monkeypatch):
+    """The picker and the GPU labels need ggml's real device description, not a
+    Vulkan<i> placeholder, and an explicit iGPU flag rather than inferring one
+    from a zero total. Memory still comes from _get_gpu_memory so the iGPU host
+    reserve is applied; budgeting off the raw shared total would hand out the
+    whole machine's RAM with no OS headroom.
+    """
+    from core.inference.llama_cpp import LlamaCppBackend
+    from utils.hardware.hardware import get_vulkan_inference_gpu_info
+
+    monkeypatch.setattr(
+        LlamaCppBackend, "_is_vulkan_backend", staticmethod(lambda binary = None: True)
+    )
+    # Fit view: discrete card keeps its total, iGPU reports 0 with capped free.
+    monkeypatch.setattr(
+        LlamaCppBackend,
+        "_get_gpu_memory",
+        staticmethod(lambda binary = None: [(0, 15 * 1024, 16 * 1024), (1, 12 * 1024, 0)]),
+    )
+    monkeypatch.setattr(
+        LlamaCppBackend,
+        "vulkan_device_inventory",
+        staticmethod(
+            lambda binary = None: [
+                {
+                    "index": 0,
+                    "name": "AMD Radeon RX 9070 XT",
+                    "free_mib": 15 * 1024,
+                    "total_mib": 16 * 1024,
+                    "is_igpu": False,
+                },
+                {
+                    "index": 1,
+                    "name": "AMD Radeon(TM) 8060S Graphics",
+                    "free_mib": 89 * 1024,
+                    "total_mib": 91 * 1024,
+                    "is_igpu": True,
+                },
+            ]
+        ),
+    )
+
+    info = get_vulkan_inference_gpu_info()
+    assert info is not None and info["index_kind"] == "vulkan"
+    dgpu, igpu = info["devices"]
+
+    assert dgpu["name"] == "AMD Radeon RX 9070 XT"
+    assert dgpu["index_kind"] == "vulkan"
+    assert dgpu["shared_memory"] is False
+    assert dgpu["memory_total_gb"] == 16.0
+
+    assert igpu["name"] == "AMD Radeon(TM) 8060S Graphics"
+    assert igpu["shared_memory"] is True
+    # The capped free budget from _get_gpu_memory, NOT the 91 GiB raw total.
+    assert igpu["memory_total_gb"] == 12.0
+
+
+def test_vulkan_inference_gpu_falls_back_to_ordinal_names(monkeypatch):
+    """A probe that cannot resolve descriptions must not lose the device list:
+    names degrade to Vulkan<i> and the memory readings still get through."""
+    from core.inference.llama_cpp import LlamaCppBackend
+    from utils.hardware.hardware import get_vulkan_inference_gpu_info
+
+    monkeypatch.setattr(
+        LlamaCppBackend, "_is_vulkan_backend", staticmethod(lambda binary = None: True)
+    )
+    monkeypatch.setattr(
+        LlamaCppBackend,
+        "_get_gpu_memory",
+        staticmethod(lambda binary = None: [(0, 15 * 1024, 16 * 1024)]),
+    )
+    monkeypatch.setattr(
+        LlamaCppBackend,
+        "vulkan_device_inventory",
+        staticmethod(lambda binary = None: (_ for _ in ()).throw(RuntimeError("probe failed"))),
+    )
+
+    info = get_vulkan_inference_gpu_info()
+    assert info["devices"][0]["name"] == "Vulkan0"
+    assert info["devices"][0]["memory_total_gb"] == 16.0
diff --git a/studio/backend/tests/test_tool_sandbox_per_thread.py b/studio/backend/tests/test_tool_sandbox_per_thread.py
new file mode 100644
index 0000000000..13bd95c9ed
--- /dev/null
+++ b/studio/backend/tests/test_tool_sandbox_per_thread.py
@@ -0,0 +1,80 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Every conversation runs its tools in its own sandbox directory.
+
+Parallel chats lean on this: two conversations can be mid tool call at the same
+time, so a shared working directory would let one overwrite the other's files.
+The session id is the chat's thread id (or project-<id> for project chats), and
+the dir is derived from it here.
+
+HOME is redirected at import time, so nothing touches the real ~/studio_sandbox.
+"""
+
+import os
+import sys
+
+import pytest
+
+_backend = os.path.join(os.path.dirname(__file__), "..")
+sys.path.insert(0, _backend)
+
+
+@pytest.fixture
+def workdir(tmp_path, monkeypatch):
+    """_get_workdir with HOME pointed at tmp_path and its cache cleared."""
+    from core.inference import tools
+
+    monkeypatch.setattr(os.path, "expanduser", lambda path: str(tmp_path))
+    monkeypatch.setattr(tools, "_workdirs", {})
+    return tools._get_workdir
+
+
+def test_two_conversations_get_two_directories(workdir, tmp_path):
+    a = workdir("thread-alpha")
+    b = workdir("thread-beta")
+    assert a != b
+    assert os.path.basename(a) == "thread-alpha"
+    assert os.path.basename(b) == "thread-beta"
+    assert os.path.isdir(a) and os.path.isdir(b)
+    assert os.path.dirname(a) == os.path.dirname(b) == str(tmp_path / "studio_sandbox")
+
+
+def test_the_same_conversation_keeps_its_directory(workdir):
+    # A later turn, or a tool continuation, must land back in the same place.
+    assert workdir("thread-alpha") == workdir("thread-alpha")
+
+
+def test_a_directory_is_private_to_its_conversation(workdir):
+    a = workdir("thread-alpha")
+    b = workdir("thread-beta")
+    with open(os.path.join(a, "secret.txt"), "w", encoding = "utf-8") as f:
+        f.write("alpha")
+    assert os.listdir(b) == []
+
+
+def test_project_chats_deliberately_share_one_workspace(workdir, monkeypatch):
+    # Chats in a project are meant to see each other's files.
+    from core.inference import tools
+    monkeypatch.setattr(tools, "_get_project_workdir", lambda sid: "/tmp/project-ws")
+    assert tools._get_workdir("project-abc") == "/tmp/project-ws"
+
+
+@pytest.mark.parametrize(
+    "session_id",
+    ["../escape", "a/b", "", "  ", "x" * 65],
+)
+def test_a_session_id_cannot_escape_the_sandbox_root(workdir, tmp_path, session_id):
+    resolved = workdir(session_id) if session_id else workdir(None)
+    root = os.path.realpath(str(tmp_path / "studio_sandbox"))
+    assert os.path.realpath(resolved).startswith(root + os.sep)
+    assert os.path.basename(resolved) in {"_invalid", "_default"}
+
+
+def test_no_session_id_falls_back_to_default(workdir):
+    assert os.path.basename(workdir(None)) == "_default"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason = "POSIX permission bits")
+def test_directories_are_private_to_the_user(workdir):
+    assert os.stat(workdir("thread-alpha")).st_mode & 0o777 == 0o700
diff --git a/studio/backend/tests/test_tool_xml_strip.py b/studio/backend/tests/test_tool_xml_strip.py
index 941d9d044a..d02638f589 100644
--- a/studio/backend/tests/test_tool_xml_strip.py
+++ b/studio/backend/tests/test_tool_xml_strip.py
@@ -668,7 +668,8 @@ def test_route_history_and_passthrough_forward_the_display_gate():
     blocks = {
         "safetensors history": r"Strip stale tool-call XML from prior assistant turns.*?\.strip\(\)",
         "anthropic history": r"Strip stale tool-call XML via the protected display helper.*?\.strip\(\)",
-        "anthropic passthrough": r"gated on the declared tools so an\n.*?\.strip\(\)",
+        # Anchored on the code, not the comment above it, so rewrapping prose cannot break this.
+        "anthropic passthrough": r"if not healing_active:.*?\.strip\(\)",
     }
     for label, pat in blocks.items():
         m = _re.search(pat, _src, _re.DOTALL)
diff --git a/studio/backend/tests/test_training_worker_flash_attn.py b/studio/backend/tests/test_training_worker_flash_attn.py
index 7e7fc1af48..86511987b1 100644
--- a/studio/backend/tests/test_training_worker_flash_attn.py
+++ b/studio/backend/tests/test_training_worker_flash_attn.py
@@ -209,7 +209,24 @@ def _force_missing_fla_imports(monkeypatch):
     monkeypatch.setattr(builtins, "__import__", fake_import)
 
 
+def _pin_fla_model_types(monkeypatch):
+    """Pin the auto-discovered FLA allowlist to the Qwen GDN families.
+
+    `_discover_fla_model_types` scans the *installed* transformers, and
+    `models/qwen3_5/` only exists from 5.x. The backend supports
+    `transformers>=4.51`, so on a 4.x install the gate returns False and every
+    Qwen3.5 assertion below silently no-ops. Pinning keeps these tests hermetic
+    across the supported range.
+    """
+    monkeypatch.setattr(
+        worker,
+        "_discover_fla_model_types",
+        lambda: frozenset({"qwen3_5", "qwen3_5_moe", "qwen3_6", "qwen3_next"}),
+    )
+
+
 def test_flash_linear_attention_installs_pinned_pair_for_qwen3_5(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.setattr(worker.shutil, "which", lambda name: "/usr/bin/uv")
     run_mock = mock.Mock(return_value = mock.Mock(returncode = 0, stdout = ""))
     monkeypatch.setattr(worker._sp, "run", run_mock)
@@ -315,6 +332,7 @@ def test_flash_linear_attention_skipped_via_env(monkeypatch):
 
 
 def test_flash_linear_attention_skipped_below_torch_2_7(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._FLA_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker, "_installed_torch_version_tuple", lambda: (2, 5))
     run_mock = mock.Mock(return_value = mock.Mock(returncode = 0, stdout = ""))
@@ -332,6 +350,7 @@ def test_flash_linear_attention_skipped_below_torch_2_7(monkeypatch):
 
 
 def test_flash_linear_attention_install_includes_einops(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._FLA_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker.shutil, "which", lambda name: "/usr/bin/uv")
     monkeypatch.setattr(worker, "_installed_torch_version_tuple", lambda: (2, 9))
@@ -358,6 +377,7 @@ def test_flash_linear_attention_install_includes_einops(monkeypatch):
 
 def test_flash_linear_attention_logs_post_install_import_failure(monkeypatch):
     """pip exits 0 but `import fla.modules` still fails (missing transitive)."""
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._FLA_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker.shutil, "which", lambda name: "/usr/bin/uv")
     monkeypatch.setattr(worker, "_installed_torch_version_tuple", lambda: (2, 9))
@@ -402,6 +422,7 @@ def test_tilelang_backend_skipped_on_unsupported_linux_arch(monkeypatch):
 
 
 def test_tilelang_backend_pins_only_binary(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._TILELANG_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker.shutil, "which", lambda name: "/usr/bin/uv")
     monkeypatch.setattr(worker, "_installed_tvm_ffi_version", lambda: None)
@@ -442,6 +463,7 @@ def _force_missing_tilelang_imports(monkeypatch):
 
 
 def test_tilelang_backend_installs_pinned_pair_for_qwen3_5(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._TILELANG_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker.shutil, "which", lambda name: "/usr/bin/uv")
     monkeypatch.setattr(worker, "_installed_tvm_ffi_version", lambda: None)
@@ -472,6 +494,7 @@ def test_tilelang_backend_reinstalls_when_tvm_ffi_is_broken(monkeypatch):
     2 (install): plain apache-tvm-ffi + tilelang -- resolves missing transitive
       deps without --force-reinstall, so it never replaces correct packages.
     """
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._TILELANG_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker.shutil, "which", lambda name: "/usr/bin/uv")
     monkeypatch.setattr(worker, "_installed_tvm_ffi_version", lambda: "0.1.11")
@@ -533,6 +556,7 @@ def test_tilelang_backend_skipped_on_windows(monkeypatch):
 
 
 def test_tilelang_backend_swallows_install_timeout(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._TILELANG_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker.shutil, "which", lambda name: "/usr/bin/uv")
     monkeypatch.setattr(worker, "_installed_tvm_ffi_version", lambda: None)
@@ -586,6 +610,7 @@ def test_tilelang_backend_skipped_via_env(monkeypatch):
 
 
 def test_tilelang_backend_swallows_install_failure(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._TILELANG_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker.shutil, "which", lambda name: None)
     monkeypatch.setattr(worker, "_installed_tvm_ffi_version", lambda: None)
@@ -649,6 +674,7 @@ def _patch_iu_gates(monkeypatch, fla_gate, conv_gate):
 
 
 def test_hook_installs_when_gate_returns_false(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     fla_gate = _make_fake_gate(initial_return = False)
     conv_gate = _make_fake_gate(initial_return = False)
     _patch_iu_gates(monkeypatch, fla_gate, conv_gate)
@@ -716,6 +742,7 @@ def test_hook_skips_install_when_gate_already_true(monkeypatch):
 
 
 def test_hook_idempotent_on_repeat_call(monkeypatch):
+    _pin_fla_model_types(monkeypatch)
     fla_gate = _make_fake_gate(initial_return = False)
     conv_gate = _make_fake_gate(initial_return = False)
     _patch_iu_gates(monkeypatch, fla_gate, conv_gate)
@@ -924,6 +951,7 @@ def test_hook_does_not_install_tilelang_for_model_outside_allowlist(monkeypatch)
 
 def test_hook_does_install_tilelang_for_qwen35(monkeypatch):
     """Positive control for finding #1: Qwen3.5 still gets tilelang."""
+    _pin_fla_model_types(monkeypatch)
     fla_gate = _make_fake_gate(initial_return = False)
     conv_gate = _make_fake_gate(initial_return = True)
     _patch_iu_gates(monkeypatch, fla_gate, conv_gate)
@@ -953,6 +981,7 @@ def test_tilelang_repair_does_not_touch_torch_cuda_stack(monkeypatch):
     forced step so --force-reinstall doesn't cascade through
     apache-tvm-ffi's dep graph and pull a different torch wheel.
     """
+    _pin_fla_model_types(monkeypatch)
     monkeypatch.delenv(worker._TILELANG_SKIP_ENV, raising = False)
     monkeypatch.setattr(worker.shutil, "which", lambda name: "/usr/bin/uv")
     monkeypatch.setattr(worker, "_installed_tvm_ffi_version", lambda: "0.1.10")
@@ -1065,6 +1094,7 @@ def test_hook_runs_tilelang_repair_when_fla_already_true(monkeypatch):
     probe) but tilelang is missing or apache-tvm-ffi is on the broken
     list, the post-available action must still run tilelang.
     """
+    _pin_fla_model_types(monkeypatch)
     fla_gate = _make_fake_gate(initial_return = True)
     conv_gate = _make_fake_gate(initial_return = True)
     _patch_iu_gates(monkeypatch, fla_gate, conv_gate)
diff --git a/studio/backend/utils/hardware/hardware.py b/studio/backend/utils/hardware/hardware.py
index b270a8e671..48ba375ec5 100644
--- a/studio/backend/utils/hardware/hardware.py
+++ b/studio/backend/utils/hardware/hardware.py
@@ -1706,7 +1706,7 @@ def get_visible_gpu_utilization() -> Dict[str, Any]:
         "backend": _backend_label(device),
         "parent_visible_gpu_ids": [],
         "devices": [],
-        "index_kind": "relative",
+        "index_kind": "vulkan",
     }
 
 
@@ -2600,22 +2600,35 @@ def get_vulkan_inference_gpu_info() -> Optional[Dict[str, Any]]:
         "backend_cuda_visible_devices": None,
         "parent_visible_gpu_ids": [],
         "devices": [],
-        "index_kind": "relative",
+        "index_kind": "vulkan",
     }
+    # Identity (real device description, explicit iGPU flag) comes from the
+    # inventory; the memory numbers stay on _get_gpu_memory, which applies the
+    # iGPU host reserve and zeroes a shared total. Budgeting an APU off the raw
+    # shared total instead would hand out the whole machine's RAM with no OS
+    # headroom. Join by ordinal; a probe failure just leaves names unresolved.
+    identity: Dict[int, Dict[str, Any]] = {}
+    try:
+        identity = {row["index"]: row for row in LlamaCppBackend.vulkan_device_inventory()}
+    except Exception as e:
+        logger.debug("Vulkan device inventory failed, falling back to ordinals: %s", e)
+
     try:
         for ordinal, free_mib, total_mib in LlamaCppBackend._get_gpu_memory():
-            # Integrated Vulkan GPUs report total=0 because their memory is
-            # shared. Publish the capped free value as their usable inference
-            # budget and mark it so clients do not add system RAM again.
-            shared_memory = total_mib == 0
+            info = identity.get(ordinal, {})
+            # _get_gpu_memory reports total 0 for a shared pool; prefer the
+            # explicit flag when the inventory resolved this ordinal.
+            shared_memory = bool(info["is_igpu"]) if "is_igpu" in info else total_mib == 0
             budget_mib = total_mib or free_mib
             used_mib = max(0, total_mib - free_mib) if total_mib else None
             result["devices"].append(
                 {
                     "index": ordinal,
-                    "index_kind": "relative",
+                    # ggml Vulkan ordinals are the space `--device Vulkan<i>` pins,
+                    # so unlike a torch-xpu relative ordinal these are selectable.
+                    "index_kind": "vulkan",
                     "visible_ordinal": ordinal,
-                    "name": f"Vulkan{ordinal}",
+                    "name": info.get("name") or f"Vulkan{ordinal}",
                     "memory_total_gb": round(budget_mib / 1024, 2),
                     "vram_used_gb": round(used_mib / 1024, 2) if used_mib is not None else None,
                     "vram_free_gb": round(free_mib / 1024, 2),
@@ -2727,7 +2740,7 @@ def get_backend_visible_gpu_info() -> Dict[str, Any]:
         "backend_cuda_visible_devices": os.environ.get("CUDA_VISIBLE_DEVICES"),
         "parent_visible_gpu_ids": [],
         "devices": [],
-        "index_kind": "relative",
+        "index_kind": "vulkan",
     }
 
 
diff --git a/studio/backend/utils/llama_cpp_update.py b/studio/backend/utils/llama_cpp_update.py
index 83602842af..dffcddb452 100644
--- a/studio/backend/utils/llama_cpp_update.py
+++ b/studio/backend/utils/llama_cpp_update.py
@@ -403,6 +403,7 @@ def _run_llama_phase(
     pin_release_tag: Optional[str],
     set_progress,
     force_cpu: bool = False,
+    llama_backend: Optional[str] = None,
 ) -> dict:
     """The llama phase of a chained update: put the backend into a maintenance
     state, run the installer for the latest prebuilt, then refresh caches so the
@@ -454,14 +455,15 @@ def _run_llama_phase(
         # updates. A natural fallback (or a legacy marker without the flag) heals to GPU (#6097).
         if force_cpu:
             cmd.append("--force-cpu")
+        if llama_backend == "vulkan":
+            cmd.extend(["--llama-backend", "vulkan"])
         logger.info("llama update: installing", cmd = " ".join(cmd))
         env = dict(os.environ, UNSLOTH_PROGRESS_PERCENT_STEP = "5")
-        # Preserve a Vulkan install across updates: detect_host on a CUDA/ROCm
-        # box would otherwise re-route and silently replace the Vulkan build.
-        # Re-assert it via the same env flag setup uses (mirrors
-        # _rocm_install_args).
-        if asset and "vulkan" in asset.lower():
+        # Preserve a Vulkan install across updates: detect_host on a CUDA/ROCm box would
+        # otherwise re-route and silently replace it. Re-assert via setup's env/CLI flags.
+        if llama_backend == "vulkan" or (asset and "vulkan" in asset.lower()):
             env["UNSLOTH_FORCE_VULKAN"] = "1"
+            env["UNSLOTH_LLAMA_BACKEND"] = "vulkan"
         _flow.stream_installer(
             cmd,
             env,
@@ -578,6 +580,9 @@ def _plan_llama_phase() -> dict:
         from_tag = marker.get("tag") or marker.get("release_tag")
         asset = marker.get("asset")
         force_cpu = bool(marker.get("force_cpu"))
+        llama_backend = marker.get("llama_backend")
+        if llama_backend == "vulkan" or (asset and "vulkan" in str(asset).lower()):
+            llama_backend = "vulkan"
         # Install exactly the release the banner offered: the installer's own
         # "latest" is commit-date ordered and can lag the published_at pick
         # above, reinstalling the current build in a loop (the #6219 class).
@@ -621,6 +626,7 @@ def _plan_llama_phase() -> dict:
         asset = (res or {}).get("asset")
         # Source builds carry no forced-CPU marker, so nothing to preserve here.
         force_cpu = False
+        llama_backend = None
         # No pin: source-build detection resolves via --resolve-prebuilt latest,
         # the same resolver the unpinned apply uses, so the two already agree.
         pin_release_tag = None
@@ -643,6 +649,7 @@ def _plan_llama_phase() -> dict:
             "pin_release_tag": pin_release_tag,
             "from_tag": from_tag,
             "force_cpu": force_cpu,
+            "llama_backend": llama_backend,
         }
     }
 
@@ -695,6 +702,7 @@ def start_update() -> dict:
                         llama_spec["pin_release_tag"],
                         set_progress,
                         force_cpu = llama_spec.get("force_cpu", False),
+                        llama_backend = llama_spec.get("llama_backend"),
                     )
                 )
                 if llama_spec
diff --git a/studio/backend/utils/openai_auto_switch_settings.py b/studio/backend/utils/openai_auto_switch_settings.py
index 7007440f4c..9520846283 100644
--- a/studio/backend/utils/openai_auto_switch_settings.py
+++ b/studio/backend/utils/openai_auto_switch_settings.py
@@ -3,10 +3,13 @@
 
 """Persisted opt-in controls for OpenAI-compatible model auto-switching.
 
-Two settings, both off by default so existing API behavior is unchanged:
+All off by default so existing API behavior is unchanged:
 - ``openai_api_auto_switch_model``: when on, a ``/v1`` request whose ``model``
   names a downloaded local GGUF different from the loaded one transparently
   loads it before serving (llama-swap-style). Unknown names pass through.
+- ``openai_api_auto_download_model``: when on, a ``/v1`` request naming an
+  undownloaded GGUF repo starts a background download instead of failing.
+  Gated on auto-switch, which is what serves the model once it lands.
 - ``openai_api_auto_unload_idle_seconds``: when > 0, the loaded GGUF is
   unloaded after this many idle seconds to free VRAM. Enabled values have a
   60s floor (0 stays "off"): a tiny TTL tears the model down between turns of
@@ -29,12 +32,14 @@ import time
 from typing import Any, Optional
 
 OPENAI_AUTO_SWITCH_SETTING_KEY = "openai_api_auto_switch_model"
+OPENAI_AUTO_DOWNLOAD_SETTING_KEY = "openai_api_auto_download_model"
 AUTO_UNLOAD_IDLE_SETTING_KEY = "openai_api_auto_unload_idle_seconds"
 AUTO_UNLOAD_KEEP_KV_SETTING_KEY = "openai_api_auto_unload_keep_kv"
 MODEL_OVERRIDES_SETTING_KEY = "openai_api_auto_switch_overrides"
 MODEL_IDLE_TTL_ENV_VAR = "UNSLOTH_MODEL_IDLE_TTL"
 
 DEFAULT_OPENAI_AUTO_SWITCH_ENABLED = False
+DEFAULT_OPENAI_AUTO_DOWNLOAD_ENABLED = False
 DEFAULT_AUTO_UNLOAD_IDLE_SECONDS = 0
 DEFAULT_AUTO_UNLOAD_KEEP_KV = True
 MIN_AUTO_UNLOAD_IDLE_SECONDS = 60
@@ -95,6 +100,22 @@ def get_openai_auto_switch_enabled() -> bool:
     return parsed if parsed is not None else DEFAULT_OPENAI_AUTO_SWITCH_ENABLED
 
 
+def get_stored_openai_auto_download_enabled() -> bool:
+    """The persisted auto-download flag, independent of auto-switch, so the UI
+    round-trips the saved value across an auto-switch toggle instead of erasing it."""
+    parsed = _coerce_bool(_cached_setting(OPENAI_AUTO_DOWNLOAD_SETTING_KEY, None))
+    return parsed if parsed is not None else DEFAULT_OPENAI_AUTO_DOWNLOAD_ENABLED
+
+
+def get_openai_auto_download_enabled() -> bool:
+    """Whether a /v1 request may download a GGUF repo it names but doesn't have.
+
+    Gated on auto-switch: that is what loads the model once it lands, so without
+    it we would fetch gigabytes nothing can serve.
+    """
+    return get_stored_openai_auto_download_enabled() and get_openai_auto_switch_enabled()
+
+
 def _stored_idle_seconds() -> Optional[int]:
     """The persisted idle TTL as an int, or None when never set."""
     return _coerce_int(_cached_setting(AUTO_UNLOAD_IDLE_SETTING_KEY, None))
@@ -170,7 +191,8 @@ def set_openai_auto_switch(
     enabled: Any,
     idle_seconds: Any,
     keep_kv: Any = None,
-) -> tuple[bool, int, bool]:
+    auto_download: Any = None,
+) -> tuple[bool, int, bool, bool]:
     """One-transaction write; ``None`` leaves a stored value untouched."""
     parsed_enabled = _coerce_bool(enabled)
     if parsed_enabled is None:
@@ -190,6 +212,11 @@ def set_openai_auto_switch(
         parsed_keep_kv = _coerce_bool(keep_kv)
         if parsed_keep_kv is None:
             raise ValueError("Keep KV on idle unload must be true or false.")
+    parsed_auto_download = None
+    if auto_download is not None:
+        parsed_auto_download = _coerce_bool(auto_download)
+        if parsed_auto_download is None:
+            raise ValueError("Auto-download missing models must be true or false.")
     from storage.studio_db import upsert_app_settings
 
     updates: dict[str, Any] = {OPENAI_AUTO_SWITCH_SETTING_KEY: parsed_enabled}
@@ -197,16 +224,25 @@ def set_openai_auto_switch(
         updates[AUTO_UNLOAD_IDLE_SETTING_KEY] = parsed_idle
     if parsed_keep_kv is not None:
         updates[AUTO_UNLOAD_KEEP_KV_SETTING_KEY] = parsed_keep_kv
+    if parsed_auto_download is not None:
+        updates[OPENAI_AUTO_DOWNLOAD_SETTING_KEY] = parsed_auto_download
     upsert_app_settings(updates)
     _invalidate(OPENAI_AUTO_SWITCH_SETTING_KEY)
     if parsed_idle is not None:
         _invalidate(AUTO_UNLOAD_IDLE_SETTING_KEY)
     if parsed_keep_kv is not None:
         _invalidate(AUTO_UNLOAD_KEEP_KV_SETTING_KEY)
+    if parsed_auto_download is not None:
+        _invalidate(OPENAI_AUTO_DOWNLOAD_SETTING_KEY)
     return (
         parsed_enabled,
         parsed_idle if parsed_idle is not None else get_stored_auto_unload_idle_seconds(),
         parsed_keep_kv if parsed_keep_kv is not None else get_auto_unload_keep_kv(),
+        (
+            parsed_auto_download
+            if parsed_auto_download is not None
+            else get_stored_openai_auto_download_enabled()
+        ),
     )
 
 
diff --git a/studio/frontend/src/app/provider.tsx b/studio/frontend/src/app/provider.tsx
index 9232defd70..8abb1df63e 100644
--- a/studio/frontend/src/app/provider.tsx
+++ b/studio/frontend/src/app/provider.tsx
@@ -395,9 +395,7 @@ function TauriWrapper({ children }: { children: ReactNode }) {
     );
   }
 
-  const showApp = status === "running";
-  const desktopBooting = status === "running" && !desktopAuthReady;
-  const showInteractiveApp = showApp && desktopAuthReady;
+  const showApp = status === "running" && desktopAuthReady;
   const startupStatus = status === "running" ? "starting" : status;
   const startupProgressDetail = progressDetail;
   const usesCustomTitlebar = shouldUseCustomWindowTitlebar();
@@ -409,28 +407,12 @@ function TauriWrapper({ children }: { children: ReactNode }) {
       <TauriUpdateLayer isExternalServer={isExternalServer}>
         <LlamaUpdateBanner
           positioned={false}
-          enabled={showInteractiveApp && !hidesTitlebarSidebar}
+          enabled={!hidesTitlebarSidebar}
         />
-        {showInteractiveApp ? (
-          <DownloadManagerPanel positioned={false} />
-        ) : null}
+        <DownloadManagerPanel positioned={false} />
       </TauriUpdateLayer>
-      {showInteractiveApp ? <NativeIntentDrain /> : null}
-      {showInteractiveApp ? children : null}
-      {desktopBooting ? (
-        <div className="pointer-events-none fixed inset-x-0 bottom-5 z-[9999] flex justify-center px-4">
-          <div className="absolute inset-x-4 bottom-16 mx-auto flex max-w-[520px] flex-col items-center gap-2 rounded-2xl border border-border/70 bg-background/95 px-6 py-5 text-center shadow-xl">
-            <div className="font-medium text-sm">Preparing Unsloth</div>
-            <div className="text-muted-foreground text-xs">
-              The local backend is ready. Signing in to your desktop session
-              before loading chats.
-            </div>
-          </div>
-          <div className="rounded-full border border-border/70 bg-background/95 px-4 py-2 text-xs text-muted-foreground shadow-lg">
-            Signing in to desktop session...
-          </div>
-        </div>
-      ) : null}
+      <NativeIntentDrain />
+      {children}
     </>
   ) : (
     <StartupScreen
diff --git a/studio/frontend/src/app/routes/__root.tsx b/studio/frontend/src/app/routes/__root.tsx
index 7137fd6f96..9e72135bdd 100644
--- a/studio/frontend/src/app/routes/__root.tsx
+++ b/studio/frontend/src/app/routes/__root.tsx
@@ -12,6 +12,7 @@ import {
 import {
   ChatPage,
   clearNewChatDraft,
+  StopRunningChatsDialog,
   useChatRuntimeStore,
   type ChatSearch,
 } from "@/features/chat";
@@ -227,6 +228,8 @@ function RootLayout() {
       <HfTokenWarningDialog />
       <RemoteCodeConsentDialog />
       <TransformersUpgradeDialog />
+      {/* At the root, not under /chat: a swap can start from the Hub too. */}
+      <StopRunningChatsDialog />
       {hideNavbar ? (
         <main className="flex-1 pt-[var(--studio-hidden-route-top-inset,0px)] [--studio-titlebar-height:var(--studio-hidden-route-top-inset,0px)]">
           <Suspense fallback={<RouteFallback />}>
diff --git a/studio/frontend/src/components/app-sidebar.tsx b/studio/frontend/src/components/app-sidebar.tsx
index a31d9b6ced..8aa4db99f4 100644
--- a/studio/frontend/src/components/app-sidebar.tsx
+++ b/studio/frontend/src/components/app-sidebar.tsx
@@ -520,15 +520,46 @@ export function AppSidebar() {
     });
   const storeThreadId = useChatRuntimeStore((s) => s.activeThreadId);
   const setActiveThreadId = useChatRuntimeStore((s) => s.setActiveThreadId);
-  const anyChatRunning = useChatRuntimeStore((s) =>
-    Object.values(s.runningByThreadId).some(Boolean),
-  );
-  // The thread currently generating (if any), so "Return to Chat" lands on the
-  // live chat rather than an empty new-chat draft left active after New Chat.
-  const runningThreadId = useChatRuntimeStore((s) => {
-    const entry = Object.entries(s.runningByThreadId).find(([, on]) => on);
-    return entry ? entry[0] : null;
-  });
+  // The whole map, so each row can show its own spinner.
+  const runningThreadIds = useChatRuntimeStore((s) => s.runningByThreadId);
+  // Rows, not raw thread ids: a compare conversation runs two pane threads but is one chat
+  // in the sidebar, so counting the map said "2 Chats" for a single compare row.
+  const runningChatCount = useMemo(() => {
+    const running = new Set(
+      Object.entries(runningThreadIds)
+        .filter(([, on]) => on)
+        .map(([id]) => id),
+    );
+    if (running.size === 0) return 0;
+    let rows = 0;
+    for (const item of allChatItems) {
+      const ids = item.type === "compare" ? (item.threadIds ?? []) : [item.id];
+      let claimed = false;
+      for (const id of ids) {
+        if (running.delete(id)) claimed = true;
+      }
+      if (claimed) rows += 1;
+    }
+    // Anything left belongs to no known row (a first turn mid-persist); count it as one.
+    return rows + running.size;
+  }, [runningThreadIds, allChatItems]);
+  const anyChatRunning = runningChatCount > 0;
+  // Where "Return to Chat" lands: the newest running chat, not the empty draft New Chat left
+  // active (map insertion order is start order). A compare row runs pane threads that /chat
+  // cannot address, so resolve those back to the pair id the route expects.
+  const runningTarget = useMemo(() => {
+    const ids = Object.entries(runningThreadIds)
+      .filter(([, on]) => on)
+      .map(([id]) => id);
+    const id = ids.length > 0 ? ids[ids.length - 1] : null;
+    if (!id) return null;
+    const pair = allChatItems.find(
+      (item) => item.type === "compare" && (item.threadIds ?? []).includes(id),
+    );
+    return pair
+      ? { id: pair.id, compare: true as const }
+      : { id, compare: false as const };
+  }, [runningThreadIds, allChatItems]);
   const activeThreadId = isChatRoute
     ? (search.thread as string | undefined) ??
       (search.compare as string | undefined) ??
@@ -892,6 +923,12 @@ export function AppSidebar() {
     variant: "project" | "recent",
   ) {
     const isPinned = pinnedIdSet.has(item.id);
+    // A compare row's id is the pair id while runningByThreadId is keyed per pane thread,
+    // so aggregate its member threads instead.
+    const isGenerating =
+      item.type === "compare"
+        ? (item.threadIds ?? []).some((id) => Boolean(runningThreadIds[id]))
+        : Boolean(runningThreadIds[item.id]);
     const itemClass =
       variant === "project"
         ? "group/project-chat-item relative"
@@ -951,6 +988,8 @@ export function AppSidebar() {
           data-testid="recent-thread"
           data-thread-type={item.type}
           data-thread-id={item.id}
+          data-generating={isGenerating ? "true" : undefined}
+          aria-busy={isGenerating || undefined}
           isActive={activeThreadId === item.id}
           className={buttonClass}
           onClick={() => {
@@ -976,6 +1015,14 @@ export function AppSidebar() {
           <span className="truncate">
             {pendingRename?.id === item.id ? pendingRename.title : item.title}
           </span>
+          {isGenerating && (
+            <Spinner
+              data-testid="chat-row-spinner"
+              // role="status" + label: announced, not motion-only.
+              label={translate("shell.navigation.chatGenerating")}
+              className="ml-auto size-3.5 shrink-0 text-muted-foreground"
+            />
+          )}
         </SidebarMenuButton>
         {variant === "project" && (
           <button
@@ -1288,9 +1335,16 @@ export function AppSidebar() {
               icon={PencilEdit02Icon}
               label={
                 showReturnToChat
-                  ? t("shell.navigation.returnToChat")
+                  ? runningChatCount > 1
+                    // Name the count rather than imply a single live chat.
+                    ? t("shell.navigation.returnToChats", {
+                        count: runningChatCount,
+                      })
+                    : t("shell.navigation.returnToChat")
                   : t("shell.navigation.newChat")
               }
+              // Off-route this row is the only sign chats are still running.
+              spinner={anyChatRunning && !isChatRoute}
               active={
                 isChatRoute &&
                 !search.thread &&
@@ -1301,8 +1355,13 @@ export function AppSidebar() {
                 if (showReturnToChat) {
                   // Prefer the running thread so we return to the live generation,
                   // not the empty new chat that became active after New Chat.
-                  if (runningThreadId && runningThreadId !== storeThreadId) {
-                    navigate({ to: "/chat", search: { thread: runningThreadId } });
+                  if (runningTarget && runningTarget.id !== storeThreadId) {
+                    navigate({
+                      to: "/chat",
+                      search: runningTarget.compare
+                        ? { compare: runningTarget.id }
+                        : { thread: runningTarget.id },
+                    });
                   } else {
                     navigate({ to: "/chat" });
                   }
diff --git a/studio/frontend/src/components/assistant-ui/markdown-text.tsx b/studio/frontend/src/components/assistant-ui/markdown-text.tsx
index 9722018ba4..81265bd05d 100644
--- a/studio/frontend/src/components/assistant-ui/markdown-text.tsx
+++ b/studio/frontend/src/components/assistant-ui/markdown-text.tsx
@@ -371,6 +371,9 @@ function useRafCoalescedText(text: string, isStreaming: boolean): string {
 
 const MarkdownTextImpl = () => {
   const { text, status } = useMessagePartText();
+  // Parts are keyed by index, so switching conversations hands this instance a different
+  // message, and Streamdown only extends its parsed blocks: key it per message instead.
+  const messageId = useAuiState(({ message }) => message.id);
   const displayText = useRafCoalescedText(text, status.type === "running");
   const processedText = useMemo(
     () => preprocessLaTeX(displayText),
@@ -385,6 +388,7 @@ const MarkdownTextImpl = () => {
   return (
     <div data-status={status.type} className="min-w-0 max-w-full">
       <Streamdown
+        key={messageId}
         mode="streaming"
         isAnimating={status.type === "running"}
         plugins={{ code, math, mermaid }}
diff --git a/studio/frontend/src/components/assistant-ui/thread.tsx b/studio/frontend/src/components/assistant-ui/thread.tsx
index 664f25164b..a1a270b834 100644
--- a/studio/frontend/src/components/assistant-ui/thread.tsx
+++ b/studio/frontend/src/components/assistant-ui/thread.tsx
@@ -724,10 +724,10 @@ function startPromptQueue(
   }
 }
 
-function stopPromptQueueRun() {
+function stopPromptQueueRun(cancelActiveRun = true) {
   const activeItem = promptQueueItems[Math.max(promptQueueIndex, 0)];
   const activeTarget = activeItem?.target;
-  const shouldCancelActiveRun = Boolean(activeItem?.dispatched);
+  const shouldCancelActiveRun = cancelActiveRun && Boolean(activeItem?.dispatched);
   resetPromptQueue();
   if (!shouldCancelActiveRun) {
     return;
@@ -740,7 +740,11 @@ function stopPromptQueueRun() {
 }
 
 if (typeof window !== "undefined") {
-  window.addEventListener(PROMPT_QUEUE_STOP_EVENT, () => stopPromptQueueRun());
+  window.addEventListener(PROMPT_QUEUE_STOP_EVENT, (event) => {
+    // Navigation leaves the dispatched prompt streaming; an explicit stop cancels it too.
+    const detail = (event as CustomEvent<{ cancelActiveRun?: boolean }>).detail;
+    stopPromptQueueRun(detail?.cancelActiveRun ?? true);
+  });
 }
 
 interface PromptQueueCallbacks {
@@ -2760,9 +2764,28 @@ const ArtifactsToggle: FC = () => {
 };
 
 const ToolStatusDisplay: FC = () => {
-  const toolStatus = useChatRuntimeStore((s) => s.toolStatus);
+  // This conversation's tool call only: a global status would put one chat's "Running
+  // Python..." above every composer. remoteId, not id: the adapter keys this map by
+  // unstable_threadId, so reading id lost the status of every restored chat.
+  const threadListItemId = useAuiState(
+    ({ threadListItem }) => threadListItem.remoteId,
+  );
   const isThreadRunning = useAuiState(({ thread }) => thread.isRunning);
-  const [elapsed, setElapsed] = useState(0);
+  const entry = useChatRuntimeStore((s) => {
+    // A first turn starts before its id is persisted, so the adapter files it under
+    // "__default"; only this thread's own run may claim it. Two first turns share that key
+    // with nothing to tell them apart, so claim it only when it holds one run.
+    const unresolved = s.toolStatusByThreadId.__default;
+    const own =
+      s.toolStatusByThreadId[threadListItemId ?? ""] ??
+      (isThreadRunning && unresolved?.length === 1 ? unresolved : undefined);
+    // Newest of the runs behind this key: separate entries, so one finishing cannot blank
+    // a sibling still running a tool.
+    return own?.[own.length - 1];
+  });
+  const toolStatus = entry?.status ?? null;
+  const startedAt = entry?.startedAt ?? null;
+  const [now, setNow] = useState(() => Date.now());
   const [visible, setVisible] = useState(false);
   const visibleRef = useRef(false);
 
@@ -2771,15 +2794,14 @@ const ToolStatusDisplay: FC = () => {
   }, [visible]);
 
   useEffect(() => {
-    if (!toolStatus) {
-      setElapsed(0);
+    if (!startedAt) {
       if (!isThreadRunning) {
         setVisible(false);
       }
       return;
     }
 
-    setElapsed(0);
+    setNow(Date.now());
 
     // Debounce visibility by 300ms when the badge isn't already on screen.
     // Once visible from a prior tool, later tools show immediately so it
@@ -2789,24 +2811,27 @@ const ToolStatusDisplay: FC = () => {
       showTimer = setTimeout(() => setVisible(true), 300);
     }
 
-    const interval = setInterval(() => {
-      setElapsed((prev) => prev + 1);
-    }, 1000);
+    const interval = setInterval(() => setNow(Date.now()), 1000);
     return () => {
       clearInterval(interval);
       if (showTimer) {
         clearTimeout(showTimer);
       }
     };
-  }, [toolStatus, isThreadRunning]);
+  }, [startedAt, isThreadRunning]);
 
-  if (!(toolStatus && visible)) {
+  if (!(toolStatus && startedAt && visible)) {
     return null;
   }
+  // From the store's start time, so returning to the conversation resumes rather than restarting.
+  const elapsed = Math.max(0, Math.floor((now - startedAt) / 1000));
   const isRunning = toolStatus.startsWith("Running");
   const StatusIcon = isRunning ? TerminalIcon : GlobeIcon;
   return (
-    <div className="mb-2 flex w-full flex-row items-center gap-2 px-1.5 pt-0.5 pb-1">
+    <div
+      data-testid="composer-tool-status"
+      className="mb-2 flex w-full flex-row items-center gap-2 px-1.5 pt-0.5 pb-1"
+    >
       <div className="flex animate-pulse items-center gap-2 rounded-full border border-primary/20 bg-primary/5 px-3 py-1.5 text-xs text-primary">
         <StatusIcon className="size-3.5" />
         <span>{toolStatus}</span>
@@ -3769,9 +3794,15 @@ const DiffusionCanvas: FC = () => {
   const isRunning = useAuiState(
     ({ message }) => message.status?.type === "running",
   );
-  // A non-null canvas is set only by diffusion_frame events (diffusion models only),
-  // so it is a sufficient gate; loadedIsDiffusion can lag the first frame on a fresh load.
-  const canvas = useChatRuntimeStore((s) => s.activeDiffusionCanvas);
+  // Only this conversation's own frames render here; a first turn has no id yet, so it reads
+  // "__default", which is where its run files them until the thread persists.
+  const threadKey =
+    useAuiState(({ threadListItem }) => threadListItem.remoteId) ?? "__default";
+  // A canvas is set only by diffusion_frame events, so its presence is a sufficient gate;
+  // loadedIsDiffusion can lag the first frame on a fresh load.
+  const canvas = useChatRuntimeStore(
+    (s) => s.activeDiffusionCanvasByThreadId[threadKey],
+  );
   if (!isRunning || !canvas) {
     return null;
   }
diff --git a/studio/frontend/src/components/assistant-ui/tool-code-cell.tsx b/studio/frontend/src/components/assistant-ui/tool-code-cell.tsx
new file mode 100644
index 0000000000..83df018af6
--- /dev/null
+++ b/studio/frontend/src/components/assistant-ui/tool-code-cell.tsx
@@ -0,0 +1,219 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"use client";
+
+import { copyToClipboard } from "@/lib/copy-to-clipboard";
+import { code as codePlugin } from "@streamdown/code";
+import { CopyIcon, DownloadIcon } from "lucide-react";
+import { Tick02Icon } from "@/lib/tick-icon";
+import { HugeiconsIcon } from "@hugeicons/react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { Streamdown } from "streamdown";
+
+const COPY_RESET_MS = 2000;
+const SHIKI_THEME = ["github-light", "github-dark"] as [
+  "github-light",
+  "github-dark",
+];
+/** Past this the block stays plain monospace: shiki is not worth the main-thread time. */
+const MAX_HIGHLIGHT_CHARS = 20_000;
+/** Within this many px of the bottom counts as following the stream. */
+const PIN_SLACK_PX = 40;
+
+export function CopyBtn({ text }: { text: string }) {
+  const [copied, setCopied] = useState(false);
+  const timer = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  useEffect(() => {
+    return () => {
+      if (timer.current) {
+        clearTimeout(timer.current);
+      }
+    };
+  }, []);
+
+  const copy = useCallback(async () => {
+    if (await copyToClipboard(text)) {
+      setCopied(true);
+      if (timer.current) {
+        clearTimeout(timer.current);
+      }
+      timer.current = setTimeout(() => setCopied(false), COPY_RESET_MS);
+    }
+  }, [text]);
+
+  return (
+    <button
+      type="button"
+      onClick={copy}
+      className="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-xs text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
+      aria-label="Copy to clipboard"
+    >
+      {copied ? (
+        <HugeiconsIcon icon={Tick02Icon} strokeWidth={2} className="size-3" />
+      ) : (
+        <CopyIcon className="size-3" />
+      )}
+      {copied ? "Copied" : "Copy"}
+    </button>
+  );
+}
+
+function DownloadBtn({ code, name }: { code: string; name: string }) {
+  const download = useCallback(() => {
+    if (typeof document === "undefined") {
+      return;
+    }
+    try {
+      const blob = new Blob([code], { type: "text/plain;charset=utf-8" });
+      const url = URL.createObjectURL(blob);
+      const anchor = document.createElement("a");
+      anchor.href = url;
+      anchor.download = name;
+      document.body.appendChild(anchor);
+      anchor.click();
+      anchor.remove();
+      // Revoke next tick, after the click consumes the URL.
+      setTimeout(() => URL.revokeObjectURL(url), 0);
+    } catch {
+      // Never break the transcript over a download.
+    }
+  }, [code, name]);
+
+  return (
+    <button
+      type="button"
+      onClick={download}
+      className="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-xs text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
+      aria-label="Download"
+    >
+      <DownloadIcon className="size-3" />
+      Download
+    </button>
+  );
+}
+
+/** A fence longer than any backtick run in the code, so a script containing ``` cannot end it early. */
+function fenceFor(source: string): string {
+  const longest = (source.match(/`+/g) ?? []).reduce(
+    (max, run) => Math.max(max, run.length),
+    0,
+  );
+  return "`".repeat(Math.max(3, longest + 1));
+}
+
+/** Syntax-highlighted code via Streamdown + shiki. Always in the DOM as plain monospace, but
+ * shiki only tokenizes once the block nears the viewport, so a long transcript does not
+ * highlight every script up front. Immediate where IntersectionObserver is missing. */
+function HighlightedCode({
+  code: source,
+  language,
+  plain = false,
+}: {
+  code: string;
+  language: string;
+  plain?: boolean;
+}) {
+  const markdown = useMemo(() => {
+    const fence = fenceFor(source);
+    return `${fence}${language}\n${source}\n${fence}`;
+  }, [source, language]);
+  const containerRef = useRef<HTMLDivElement>(null);
+  const [nearViewport, setNearViewport] = useState(
+    () => typeof IntersectionObserver === "undefined",
+  );
+  // Pinned to the bottom until the reader scrolls up, so a streaming payload visibly grows.
+  const pinnedToBottom = useRef(true);
+  useEffect(() => {
+    if (nearViewport) return;
+    const el = containerRef.current;
+    if (!el) return;
+    const io = new IntersectionObserver(
+      (entries) => {
+        if (entries.some((entry) => entry.isIntersecting)) {
+          setNearViewport(true);
+          io.disconnect();
+        }
+      },
+      // Highlight just before the block enters view, so it is ready on arrival.
+      { rootMargin: "200px" },
+    );
+    io.observe(el);
+    return () => io.disconnect();
+  }, [nearViewport]);
+
+  useEffect(() => {
+    const el = containerRef.current;
+    if (plain && el && pinnedToBottom.current) {
+      el.scrollTop = el.scrollHeight;
+    }
+  }, [plain, source]);
+
+  const handleScroll = () => {
+    const el = containerRef.current;
+    if (el) {
+      pinnedToBottom.current =
+        el.scrollHeight - el.scrollTop - el.clientHeight < PIN_SLACK_PX;
+    }
+  };
+
+  // Skip shiki while the model is writing (it re-tokenizes every fragment) and on payloads too big.
+  const highlight =
+    nearViewport && !plain && source.length <= MAX_HIGHLIGHT_CHARS;
+
+  return (
+    <div
+      ref={containerRef}
+      onScroll={handleScroll}
+      className="max-h-48 overflow-auto text-xs [&_pre]:!m-0 [&_pre]:!bg-transparent [&_pre]:!p-0 [&_pre]:!text-xs [&_[data-streamdown=code-block]]:!my-0 [&_[data-streamdown=code-block]]:!p-3 [&_[data-streamdown=code-block]]:!border-0"
+    >
+      {highlight ? (
+        <Streamdown
+          mode="static"
+          plugins={{ code: codePlugin }}
+          controls={{ code: false }}
+          shikiTheme={SHIKI_THEME}
+        >
+          {markdown}
+        </Streamdown>
+      ) : (
+        // A div, not a <pre>: the container's [&_pre]:!p-0 would strip the padding and shift
+        // the content when shiki swaps in. whitespace-pre so long lines scroll.
+        <div className="whitespace-pre p-3 font-mono text-xs text-muted-foreground">
+          {source}
+        </div>
+      )}
+    </div>
+  );
+}
+
+/** The code a tool is about to run, in the card's collapsible content so the chevron hides code and output together. */
+export function ToolCodeCell({
+  label,
+  code,
+  language,
+  downloadName,
+  streaming = false,
+}: {
+  label: string;
+  code: string;
+  language: string;
+  downloadName: string;
+  streaming?: boolean;
+}) {
+  return (
+    <div className="border-l-2 border-muted-foreground/20 pl-2">
+      <div className="flex items-center justify-between">
+        <span className="text-xs font-medium text-muted-foreground">
+          {label}
+        </span>
+        <div className="flex items-center gap-1">
+          <CopyBtn text={code} />
+          <DownloadBtn code={code} name={downloadName} />
+        </div>
+      </div>
+      <HighlightedCode code={code} language={language} plain={streaming} />
+    </div>
+  );
+}
diff --git a/studio/frontend/src/components/assistant-ui/tool-group.tsx b/studio/frontend/src/components/assistant-ui/tool-group.tsx
index 469c449a70..af370d892e 100644
--- a/studio/frontend/src/components/assistant-ui/tool-group.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-group.tsx
@@ -10,7 +10,11 @@ import {
 } from "react";
 import { useAuiState } from "@assistant-ui/react";
 import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
-import { toolOutputKey, useToolPaneScope } from "@/features/chat";
+import {
+  toolOutputKey,
+  useToolPaneScope,
+  useUnresolvedToolPaneScope,
+} from "@/features/chat";
 import { ChevronDownIcon } from "lucide-react";
 import { Wrench01Icon } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
@@ -239,16 +243,23 @@ const ToolGroupImpl: FC<
   // Force the group open when any call is receiving tool_output events.
   const toolLiveOutput = useChatRuntimeStore((s) => s.toolLiveOutput);
   const paneScope = useToolPaneScope();
+  const unresolvedScope = useUnresolvedToolPaneScope();
   const hasLiveOutput = useAuiState(({ message }) =>
     message.parts
       .slice(startIndex, endIndex + 1)
       .some(
         (part) =>
           part.type === "tool-call" &&
-          Object.prototype.hasOwnProperty.call(
+          // Either scope: a first turn writes under the unresolved one for its whole
+          // life, even after the autosave assigns the id (see useToolOutputFor).
+          (Object.prototype.hasOwnProperty.call(
             toolLiveOutput,
             toolOutputKey(paneScope, part.toolCallId),
-          ),
+          ) ||
+            Object.prototype.hasOwnProperty.call(
+              toolLiveOutput,
+              toolOutputKey(unresolvedScope, part.toolCallId),
+            )),
       ),
   );
   // Keep the group open once a confirmation or live output forced it (so an
diff --git a/studio/frontend/src/components/assistant-ui/tool-live-output.tsx b/studio/frontend/src/components/assistant-ui/tool-live-output.tsx
index 3434783f0a..df202b57f0 100644
--- a/studio/frontend/src/components/assistant-ui/tool-live-output.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-live-output.tsx
@@ -4,7 +4,7 @@
 "use client";
 
 import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
-import { toolOutputKey, useToolPaneScope } from "@/features/chat";
+import { useToolOutputFor, useToolPaneScope } from "@/features/chat";
 import { useEffect, useMemo, useRef } from "react";
 import { tailText } from "./tool-result-output";
 
@@ -16,8 +16,10 @@ import { tailText } from "./tool-result-output";
  */
 export function ToolLiveOutput({ toolCallId }: { toolCallId: string }) {
   const paneScope = useToolPaneScope();
-  const output = useChatRuntimeStore(
-    (s) => s.toolLiveOutput[toolOutputKey(paneScope, toolCallId)] ?? "",
+  const output = useToolOutputFor(
+    useChatRuntimeStore((s) => s.toolLiveOutput),
+    paneScope,
+    toolCallId,
   );
   const scrollRef = useRef<HTMLPreElement>(null);
   // Pinned to the bottom until the user scrolls up (handler below), so
diff --git a/studio/frontend/src/components/assistant-ui/tool-ui-python.tsx b/studio/frontend/src/components/assistant-ui/tool-ui-python.tsx
index 34e51b9d5a..e058a04ed1 100644
--- a/studio/frontend/src/components/assistant-ui/tool-ui-python.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-ui-python.tsx
@@ -3,28 +3,25 @@
 
 "use client";
 
-import { copyToClipboard } from "@/lib/copy-to-clipboard";
 import { getAuthToken } from "@/features/auth/session";
 import type { ToolCallMessagePartComponent } from "@assistant-ui/react";
 import { useToolArgsStatus } from "@assistant-ui/react";
-import { code as codePlugin } from "@streamdown/code";
-import { CodeIcon, CopyIcon, DownloadIcon } from "lucide-react";
-import { Tick02Icon } from "@/lib/tick-icon";
-import { HugeiconsIcon } from "@hugeicons/react";
+import { CodeIcon } from "lucide-react";
 import { Spinner } from "@/components/ui/spinner";
-import { memo, useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { Streamdown } from "streamdown";
+import { memo } from "react";
 import {
   ToolFallbackContent,
   ToolFallbackRoot,
   ToolFallbackTrigger,
 } from "./tool-fallback";
+import { CopyBtn, ToolCodeCell } from "./tool-code-cell";
 import { ToolLiveOutput } from "./tool-live-output";
 import { ToolResultOutput } from "./tool-result-output";
 import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
 import {
   preferFullToolOutput,
-  toolOutputKey,
+  useToolAwaitingApproval,
+  useToolOutputFor,
   useToolPaneScope,
 } from "@/features/chat";
 
@@ -34,151 +31,6 @@ interface StructuredResult {
   sessionId: string;
 }
 
-const MAX_DISPLAY = 10_000;
-const COPY_RESET_MS = 2000;
-const SHIKI_THEME = ["github-light", "github-dark"] as ["github-light", "github-dark"];
-
-function truncate(text: string): string {
-  return text.length <= MAX_DISPLAY
-    ? text
-    : `${text.slice(0, MAX_DISPLAY)}\n... (truncated)`;
-}
-
-function CopyBtn({ text }: { text: string }) {
-  const [copied, setCopied] = useState(false);
-  const timer = useRef<ReturnType<typeof setTimeout> | null>(null);
-
-  useEffect(() => {
-    return () => {
-      if (timer.current) {
-        clearTimeout(timer.current);
-      }
-    };
-  }, []);
-
-  const copy = useCallback(async () => {
-    if (await copyToClipboard(text)) {
-      setCopied(true);
-      if (timer.current) {
-        clearTimeout(timer.current);
-      }
-      timer.current = setTimeout(() => setCopied(false), COPY_RESET_MS);
-    }
-  }, [text]);
-
-  return (
-    <button
-      type="button"
-      onClick={copy}
-      className="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-xs text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
-      aria-label="Copy to clipboard"
-    >
-      {copied ? (
-        <HugeiconsIcon icon={Tick02Icon} strokeWidth={2} className="size-3" />
-      ) : (
-        <CopyIcon className="size-3" />
-      )}
-      {copied ? "Copied" : "Copy"}
-    </button>
-  );
-}
-
-/** Save the script as a .py file via a client-side Blob. */
-function DownloadBtn({ code, name = "script.py" }: { code: string; name?: string }) {
-  const download = useCallback(() => {
-    if (typeof document === "undefined") {
-      return;
-    }
-    try {
-      const blob = new Blob([code], { type: "text/x-python" });
-      const url = URL.createObjectURL(blob);
-      const anchor = document.createElement("a");
-      anchor.href = url;
-      anchor.download = name;
-      document.body.appendChild(anchor);
-      anchor.click();
-      anchor.remove();
-      // Revoke next tick, after the click consumes the URL.
-      setTimeout(() => URL.revokeObjectURL(url), 0);
-    } catch {
-      // Best-effort: never break the transcript over a download.
-    }
-  }, [code, name]);
-
-  return (
-    <button
-      type="button"
-      onClick={download}
-      className="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-xs text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
-      aria-label="Download script"
-    >
-      <DownloadIcon className="size-3" />
-      Download
-    </button>
-  );
-}
-
-/** Syntax-highlighted code via Streamdown + shiki; inherits parent container.
- * The script is always in the DOM (a plain monospace placeholder), but shiki
- * only tokenizes once the block scrolls near the viewport, so a long transcript
- * with many scripts doesn't highlight every one up front. Falls back to
- * immediate highlight when IntersectionObserver is unavailable (SSR / tests). */
-function HighlightedCode({ code: source, language }: { code: string; language: string }) {
-  const display = useMemo(() => truncate(source), [source]);
-  const markdown = useMemo(
-    () => `\`\`\`${language}\n${display}\n\`\`\``,
-    [display, language],
-  );
-  const containerRef = useRef<HTMLDivElement>(null);
-  const [highlight, setHighlight] = useState(
-    () => typeof IntersectionObserver === "undefined",
-  );
-  useEffect(() => {
-    if (highlight) return;
-    const el = containerRef.current;
-    if (!el) return;
-    const io = new IntersectionObserver(
-      (entries) => {
-        if (entries.some((entry) => entry.isIntersecting)) {
-          setHighlight(true);
-          io.disconnect();
-        }
-      },
-      // Highlight just before the block enters view so it's colorized by the
-      // time the user reaches it, without tokenizing off-screen scripts.
-      { rootMargin: "200px" },
-    );
-    io.observe(el);
-    return () => io.disconnect();
-  }, [highlight]);
-  return (
-    <div
-      ref={containerRef}
-      className="max-h-48 overflow-auto text-xs [&_pre]:!m-0 [&_pre]:!bg-transparent [&_pre]:!p-0 [&_pre]:!text-xs [&_[data-streamdown=code-block]]:!my-0 [&_[data-streamdown=code-block]]:!p-3 [&_[data-streamdown=code-block]]:!border-0"
-    >
-      {highlight ? (
-        <Streamdown
-          mode="static"
-          plugins={{ code: codePlugin }}
-          controls={{ code: false }}
-          shikiTheme={SHIKI_THEME}
-        >
-          {markdown}
-        </Streamdown>
-      ) : (
-        // A div, not a <pre>: the container's [&_pre]:!p-0 would override a
-        // <pre>'s padding and shift the content by p-3 when shiki swaps in. Keep
-        // the same p-3, and whitespace-pre (not pre-wrap) so long lines scroll in
-        // the container's overflow-auto exactly like the highlighted <pre>, rather
-        // than wrapping taller and then collapsing when shiki swaps in.
-        <div className="whitespace-pre p-3 font-mono text-xs text-muted-foreground">
-          {display}
-        </div>
-      )}
-    </div>
-  );
-}
-
 function isStructuredResult(val: unknown): val is StructuredResult {
   return (
     typeof val === "object" &&
@@ -221,46 +73,50 @@ const PythonToolUIImpl: ToolCallMessagePartComponent = ({
   // Show the fuller live stream over a truncated result, keeping its exit
   // status. Session-transient: after a reload only the result remains.
   const paneScope = useToolPaneScope();
-  const fullOutput = useChatRuntimeStore(
-    (s) => s.toolFullOutput[toolOutputKey(paneScope, toolCallId)] ?? "",
+  const fullOutput = useToolOutputFor(
+    useChatRuntimeStore((s) => s.toolFullOutput),
+    paneScope,
+    toolCallId,
   );
   const displayOutput = preferFullToolOutput(fullOutput, output);
 
   const authToken = getAuthToken();
+  // The gate only opens once the call parsed, so a pending approval means the script is
+  // written even while the args status still reads as streaming.
+  const awaitingApproval = useToolAwaitingApproval(toolCallId);
+  const isWriting = isWritingCode && !awaitingApproval;
 
   return (
-    // Status/output collapse from history; the script source renders outside
-    // ToolFallbackContent so it stays visible on reopen (#7165).
+    // Script, status and output all collapse behind the one chevron.
     <ToolFallbackRoot defaultOpen={isRunning}>
       <ToolFallbackTrigger
         toolName={firstLine ? `Python: ${firstLine}` : "Python"}
         status={status}
         icon={CodeIcon}
       />
-      {code && (
-        <div className="mt-1 pl-5">
-          <div className="border-l-2 border-muted-foreground/20 pl-2">
-            <div className="flex items-center justify-between">
-              <span className="text-xs font-medium text-muted-foreground">
-                script
-              </span>
-              <div className="flex items-center gap-1">
-                <CopyBtn text={code} />
-                <DownloadBtn code={code} />
-              </div>
-            </div>
-            <HighlightedCode code={code} language="python" />
-          </div>
-        </div>
-      )}
       <ToolFallbackContent>
+        {code && (
+          <ToolCodeCell
+            label="script"
+            code={code}
+            language="python"
+            downloadName="script.py"
+            streaming={isWriting}
+          />
+        )}
         <div className="border-l-2 border-muted-foreground/20 pl-2">
           {/* Output */}
           {isRunning ? (
             <>
               <div className="mt-2 flex items-center gap-2 text-sm text-muted-foreground">
                 <Spinner className="size-3.5" />
-                <span>{isWritingCode ? "Writing code…" : "Running…"}</span>
+                <span>
+                  {awaitingApproval
+                    ? "Waiting for approval…"
+                    : isWriting
+                      ? "Writing code…"
+                      : "Running…"}
+                </span>
               </div>
               {/* Live stdout streamed via tool_output SSE events. */}
               <ToolLiveOutput toolCallId={toolCallId} />
diff --git a/studio/frontend/src/components/assistant-ui/tool-ui-terminal.tsx b/studio/frontend/src/components/assistant-ui/tool-ui-terminal.tsx
index 17ae26d388..b6ea2aaa6f 100644
--- a/studio/frontend/src/components/assistant-ui/tool-ui-terminal.tsx
+++ b/studio/frontend/src/components/assistant-ui/tool-ui-terminal.tsx
@@ -3,69 +3,27 @@
 
 "use client";
 
-import { copyToClipboard } from "@/lib/copy-to-clipboard";
 import type { ToolCallMessagePartComponent } from "@assistant-ui/react";
 import { useToolArgsStatus } from "@assistant-ui/react";
-import { CopyIcon, TerminalIcon } from "lucide-react";
-import { Tick02Icon } from "@/lib/tick-icon";
-import { HugeiconsIcon } from "@hugeicons/react";
+import { TerminalIcon } from "lucide-react";
 import { Spinner } from "@/components/ui/spinner";
-import { memo, useCallback, useEffect, useRef, useState } from "react";
+import { memo } from "react";
 import {
   ToolFallbackContent,
   ToolFallbackRoot,
   ToolFallbackTrigger,
 } from "./tool-fallback";
+import { CopyBtn, ToolCodeCell } from "./tool-code-cell";
 import { ToolLiveOutput } from "./tool-live-output";
 import { ToolResultOutput } from "./tool-result-output";
 import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
 import {
   preferFullToolOutput,
-  toolOutputKey,
+  useToolAwaitingApproval,
+  useToolOutputFor,
   useToolPaneScope,
 } from "@/features/chat";
 
-const COPY_RESET_MS = 2000;
-
-function CopyBtn({ text }: { text: string }) {
-  const [copied, setCopied] = useState(false);
-  const timer = useRef<ReturnType<typeof setTimeout> | null>(null);
-
-  useEffect(() => {
-    return () => {
-      if (timer.current) {
-        clearTimeout(timer.current);
-      }
-    };
-  }, []);
-
-  const copy = useCallback(async () => {
-    if (await copyToClipboard(text)) {
-      setCopied(true);
-      if (timer.current) {
-        clearTimeout(timer.current);
-      }
-      timer.current = setTimeout(() => setCopied(false), COPY_RESET_MS);
-    }
-  }, [text]);
-
-  return (
-    <button
-      type="button"
-      onClick={copy}
-      className="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-xs text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
-      aria-label="Copy to clipboard"
-    >
-      {copied ? (
-        <HugeiconsIcon icon={Tick02Icon} strokeWidth={2} className="size-3" />
-      ) : (
-        <CopyIcon className="size-3" />
-      )}
-      {copied ? "Copied" : "Copy"}
-    </button>
-  );
-}
-
 const TerminalToolUIImpl: ToolCallMessagePartComponent = ({
   toolCallId,
   args,
@@ -87,13 +45,19 @@ const TerminalToolUIImpl: ToolCallMessagePartComponent = ({
   // Show the fuller live stream over a truncated result, keeping its exit
   // status. Session-transient: after a reload only the result remains.
   const paneScope = useToolPaneScope();
-  const fullOutput = useChatRuntimeStore(
-    (s) => s.toolFullOutput[toolOutputKey(paneScope, toolCallId)] ?? "",
+  const fullOutput = useToolOutputFor(
+    useChatRuntimeStore((s) => s.toolFullOutput),
+    paneScope,
+    toolCallId,
   );
   const displayOutput = preferFullToolOutput(fullOutput, output);
+  // The gate only opens once the call parsed, so a pending approval means the command is
+  // written even while the args status still reads as streaming.
+  const awaitingApproval = useToolAwaitingApproval(toolCallId);
+  const isWriting = isWritingCommand && !awaitingApproval;
 
   return (
-    // Open when mounted mid-run so live output shows; collapsed from history.
+    // Open mid-run so command and live output show, collapsed from history.
     <ToolFallbackRoot defaultOpen={isRunning}>
       <ToolFallbackTrigger
         toolName={command ? `$ ${command.slice(0, 60)}` : "Terminal"}
@@ -101,12 +65,27 @@ const TerminalToolUIImpl: ToolCallMessagePartComponent = ({
         icon={TerminalIcon}
       />
       <ToolFallbackContent>
+        {command && (
+          <ToolCodeCell
+            label="command"
+            code={command}
+            language="bash"
+            downloadName="command.sh"
+            streaming={isWriting}
+          />
+        )}
         <div className="border-l-2 border-muted-foreground/20 pl-2">
           {isRunning ? (
             <>
               <div className="flex items-center gap-2 text-sm text-muted-foreground">
                 <Spinner className="size-3.5" />
-                <span>{isWritingCommand ? "Writing command…" : "Running…"}</span>
+                <span>
+                  {awaitingApproval
+                    ? "Waiting for approval…"
+                    : isWriting
+                      ? "Writing command…"
+                      : "Running…"}
+                </span>
               </div>
               {/* Live stdout streamed via tool_output SSE events. */}
               <ToolLiveOutput toolCallId={toolCallId} />
diff --git a/studio/frontend/src/components/ui/sonner.tsx b/studio/frontend/src/components/ui/sonner.tsx
index aec1235b81..4c65edc4b7 100644
--- a/studio/frontend/src/components/ui/sonner.tsx
+++ b/studio/frontend/src/components/ui/sonner.tsx
@@ -8,8 +8,8 @@ import {
   MultiplicationSignCircleIcon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
-import { Spinner } from "@/components/ui/spinner";
 import { useTheme } from "@/features/settings/stores/theme-store";
+import { createLoadingToastIcon } from "@/lib/toast";
 import { Toaster as Sonner, type ToasterProps } from "sonner";
 
 // Make toast text selectable. Sonner's onPointerDown calls setPointerCapture(),
@@ -78,7 +78,7 @@ const Toaster = ({ ...props }: ToasterProps) => {
             />
           ),
           // App-wide arc spinner so loading toasts match the "Downloading model" toast.
-          loading: <Spinner className="size-4 text-muted-foreground" />,
+          loading: createLoadingToastIcon(),
         }}
         style={
           {
diff --git a/studio/frontend/src/components/ui/spinner.tsx b/studio/frontend/src/components/ui/spinner.tsx
index 283b4e21de..34543ed763 100644
--- a/studio/frontend/src/components/ui/spinner.tsx
+++ b/studio/frontend/src/components/ui/spinner.tsx
@@ -6,15 +6,22 @@
 import { Loader2Icon } from "lucide-react";
 import { cn } from "@/lib/utils";
 
-/**
- * App-wide spinner: a clean circular arc with a rounded cap (lucide
- * Loader2 / LoaderCircle), animated, inheriting the current text color.
- */
-function Spinner({ className }: { className?: string }) {
+/** App-wide spinner inheriting the current text color. `label` overrides the announcement
+ * where "loading" is not what it means (a sidebar chat is generating). */
+function Spinner({
+  className,
+  label = "Loading",
+  "data-testid": dataTestId,
+}: {
+  className?: string;
+  label?: string;
+  "data-testid"?: string;
+}) {
   return (
     <Loader2Icon
       role="status"
-      aria-label="Loading"
+      aria-label={label}
+      data-testid={dataTestId}
       className={cn("size-4 shrink-0 animate-spin", className)}
     />
   );
diff --git a/studio/frontend/src/features/chat/api/chat-adapter.ts b/studio/frontend/src/features/chat/api/chat-adapter.ts
index 52f0f32536..5e4eac2f2d 100644
--- a/studio/frontend/src/features/chat/api/chat-adapter.ts
+++ b/studio/frontend/src/features/chat/api/chat-adapter.ts
@@ -6,7 +6,7 @@ import { resolveInitialConfig } from "@/features/model-picker";
 import { projectHasSources } from "@/features/rag/api/rag-api";
 import { apiUrl } from "@/lib/api-base";
 import { parseParamCountB } from "@/lib/model-size";
-import { toast } from "@/lib/toast";
+import { createLoadingToastIcon, toast } from "@/lib/toast";
 import type { MessageTiming, ToolCallMessagePart } from "@assistant-ui/core";
 import type { ChatModelAdapter } from "@assistant-ui/react";
 import { parsePartialJsonObject } from "assistant-stream/utils";
@@ -59,6 +59,7 @@ import {
   shouldPreserveFullOutput,
   toolOutputKey,
   toolPaneScope,
+  toolThreadScope,
 } from "../tool-output-scope";
 import type { ModelType } from "../types";
 import { isMultimodalResponse } from "../types/api";
@@ -1512,13 +1513,38 @@ async function autoLoadSmallestModel(): Promise<{
   const trustRemoteCode = store.params.trustRemoteCode ?? false;
   const specSettings = resolveSpeculativeSettingsForLoad();
   const lastLoaded = readLastLocalModelLoad();
-  const toastId = toast("Loading a model…", {
+  let autoLoadToastDismissed = false;
+  const toastId = toast.message("Loading a model…", {
     description: lastLoaded
       ? "Loading last used model."
       : "Auto-selecting the smallest downloaded model.",
-    duration: 5000,
+    duration: Number.POSITIVE_INFINITY,
     closeButton: true,
+    icon: createLoadingToastIcon(),
+    onDismiss: () => {
+      autoLoadToastDismissed = true;
+    },
   });
+  const updateAutoLoadToast = (message: string, description: string): void => {
+    if (autoLoadToastDismissed) return;
+    toast.message(message, {
+      id: toastId,
+      description,
+      duration: Number.POSITIVE_INFINITY,
+    });
+  };
+  const showAutoLoadSuccess = (message: string): void => {
+    const options = {
+      description: undefined,
+      duration: 5000,
+      icon: undefined,
+    };
+    if (autoLoadToastDismissed) {
+      toast.success(message, options);
+      return;
+    }
+    toast.success(message, { ...options, id: toastId });
+  };
   let blockedByTrustRemoteCode = false;
   let hadNonTrustFailure = false;
   let loadAttempts = 0;
@@ -1781,7 +1807,7 @@ async function autoLoadSmallestModel(): Promise<{
         ggufVariant: candidate.ggufVariant,
       });
     }
-    toast.success(candidate.successLabel, { id: toastId });
+    showAutoLoadSuccess(candidate.successLabel);
     return true;
   }
   try {
@@ -1807,11 +1833,10 @@ async function autoLoadSmallestModel(): Promise<{
                 isAutoLoadableGgufVariant(entry),
             );
             if (variant) {
-              toast("Loading last used model…", {
-                id: toastId,
-                description: `${repo.repo_id} (${variant.quant})`,
-                duration: 5000,
-              });
+              updateAutoLoadToast(
+                "Loading last used model…",
+                `${repo.repo_id} (${variant.quant})`,
+              );
               if (
                 await loadAutoLoadCandidate({
                   id: repo.repo_id,
@@ -1836,11 +1861,7 @@ async function autoLoadSmallestModel(): Promise<{
         const repo = findCachedRepo(modelRepos, lastLoaded.id);
         if (repo) {
           try {
-            toast("Loading last used model…", {
-              id: toastId,
-              description: repo.repo_id,
-              duration: 5000,
-            });
+            updateAutoLoadToast("Loading last used model…", repo.repo_id);
             if (
               await loadAutoLoadCandidate({
                 id: repo.repo_id,
@@ -1861,11 +1882,10 @@ async function autoLoadSmallestModel(): Promise<{
           }
         }
       }
-      toast("Loading a model…", {
-        id: toastId,
-        description: "Auto-selecting the smallest downloaded model.",
-        duration: 5000,
-      });
+      updateAutoLoadToast(
+        "Loading a model…",
+        "Auto-selecting the smallest downloaded model.",
+      );
     }
 
     // GGUF first: smallest-total-size repo, then its smallest variant.
@@ -1956,12 +1976,10 @@ async function autoLoadSmallestModel(): Promise<{
     }
 
     // No cached models — try downloading a small default GGUF.
-    toast("Downloading a small model…", {
-      id: toastId,
-      description:
-        "No downloaded models found. Fetching Qwen3.5-4B-MTP (UD-Q4_K_XL).",
-      duration: 30000,
-    });
+    updateAutoLoadToast(
+      "Downloading a small model…",
+      "No downloaded models found. Fetching Qwen3.5-4B-MTP (UD-Q4_K_XL).",
+    );
     try {
       const rt = useChatRuntimeStore.getState();
       if (
@@ -2057,7 +2075,7 @@ async function autoLoadSmallestModel(): Promise<{
         kind: "gguf",
         ggufVariant: "UD-Q4_K_XL",
       });
-      toast.success("Loaded Qwen3.5-4B-MTP (UD-Q4_K_XL)", { id: toastId });
+      showAutoLoadSuccess("Loaded Qwen3.5-4B-MTP (UD-Q4_K_XL)");
       return { loaded: true, blockedByTrustRemoteCode: false };
     } catch {
       toast.dismiss(toastId);
@@ -2222,7 +2240,20 @@ export function createOpenAIStreamAdapter(
             : undefined;
 
         const threadKey = resolvedThreadId;
-        runtime.setThreadRunning(threadKey, true);
+        // The run is durable on the server, but Stop, archive and delete reach a background
+        // thread only through this map: without a handle the supervisor kept planning against
+        // a deleted conversation. Registered before the run exists, since the thread can be
+        // stopped while createResearchRun is still in flight.
+        let researchRunId: string | null = null;
+        let researchStopRequested = false;
+        const researchServerCancel = () => {
+          researchStopRequested = true;
+          if (researchRunId) {
+            void cancelResearchRun(researchRunId).catch(() => {});
+          }
+        };
+        runtime.registerThreadServerCancel(threadKey, researchServerCancel);
+        runtime.setThreadRunning(threadKey, true, { owner: researchServerCancel });
         let report = "";
         let releaseResearchFollow: (() => void) | null = null;
         const researchFollowController = new AbortController();
@@ -2262,6 +2293,13 @@ export function createOpenAIStreamAdapter(
               blockedDomains: [...runtime.researchWebsitePolicy.blockedDomains],
             },
           });
+          researchRunId = createdRun.id;
+          if (researchStopRequested) {
+            // Stopped while createResearchRun was still in flight, so the handle had no
+            // id to act on. Replay it rather than following a run the user already ended.
+            void cancelResearchRun(createdRun.id).catch(() => {});
+            return;
+          }
           releaseResearchFollow = beginExternalResearchFollow(
             createdRun,
             detachResearchFollow,
@@ -2320,7 +2358,8 @@ export function createOpenAIStreamAdapter(
         } finally {
           abortSignal.removeEventListener("abort", forwardAdapterAbort);
           releaseResearchFollow?.();
-          runtime.setThreadRunning(threadKey, false);
+          runtime.clearThreadServerCancel(threadKey, researchServerCancel);
+          runtime.setThreadRunning(threadKey, false, { owner: researchServerCancel });
         }
         return;
       }
@@ -2329,17 +2368,21 @@ export function createOpenAIStreamAdapter(
         ? `${sandboxSessionId || "_default"}:${resolvedThreadId}`
         : sandboxSessionId || "_default";
       const toolConfirmationIdsByBackendId = new Map<string, string>();
-      // Store keys are pane-scoped since local tool ids ("call_0") repeat across
-      // turns and concurrent panes (compare mode). Track this run's keys so
-      // cleanup can't wipe another pane's.
-      const toolOutputPaneScope = toolPaneScope(
-        options.modelType,
-        options.pairId,
+      // Local tool ids ("call_0") repeat across turns, panes and conversations, so scope by pane
+      // AND thread. unstable_threadId alone, no activeThreadId fallback: the reader has only
+      // threadListItem.remoteId, which is exactly this value.
+      const toolOutputPaneScope = toolThreadScope(
+        toolPaneScope(options.modelType, options.pairId),
+        unstable_threadId,
       );
       const scopedToolOutputKey = (id: string) =>
         toolOutputKey(toolOutputPaneScope, id);
       const runToolLiveOutputKeys = new Set<string>();
       const resolvedThreadKey = resolvedThreadId ?? null;
+      // Which conversation was on screen when this run started. A first turn has no id yet, so
+      // this is the only way to tell later whether the user has switched away from it.
+      const activeThreadIdAtRunStart =
+        useChatRuntimeStore.getState().activeThreadId ?? null;
       const pendingImageEditReferenceForRun = runtime.pendingImageEditReference;
       const selectedImageEditReference =
         (pendingImageEditReferenceForRun?.threadId ?? null) ===
@@ -2745,8 +2788,11 @@ export function createOpenAIStreamAdapter(
           // waitForRunEnd resolves instead of hanging: this gate fires
           // before the streaming path's setThreadRunning(true).
           const gatedThreadKey = resolvedThreadId || "__default";
-          runtime.setThreadRunning(gatedThreadKey, true);
-          runtime.setThreadRunning(gatedThreadKey, false);
+          // Own token: siblings share "__default", so an ownerless clear would drop their
+          // entries while they are still generating.
+          const gateOwner = () => {};
+          runtime.setThreadRunning(gatedThreadKey, true, { owner: gateOwner });
+          runtime.setThreadRunning(gatedThreadKey, false, { owner: gateOwner });
           clearSelectedImageEditReference();
           throw new Error(imageGateReason);
         }
@@ -2764,13 +2810,44 @@ export function createOpenAIStreamAdapter(
       }
       const useAdapter = await resolveUseAdapter(resolvedThreadId, options);
 
+      const threadKey = resolvedThreadId || "__default";
+      // A first turn files its handles under "__default"; autosave then assigns a real id and
+      // adoptDefaultThreadRun re-keys them mid-run. Resolve per use so later writes and the
+      // final clear follow the run instead of stranding entries behind.
+      const liveThreadKey = (owner: () => void) =>
+        threadKey === "__default"
+          ? useChatRuntimeStore.getState().runKeyForOwner(threadKey, owner)
+          : threadKey;
+
+      // Per-run token so a delayed stop POST can't match the next run.
+      const cancelId =
+        typeof crypto !== "undefined" && "randomUUID" in crypto
+          ? crypto.randomUUID()
+          : `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+
+      // Per-run abort, chained to assistant-ui's signal. cancelByThreadId only holds the visible
+      // thread's cancelRun(), so this controller is the only way to end a backgrounded chat's
+      // request; the cancel POST below reaches llama-server only.
+      const runAbort = new AbortController();
+      const runSignal = runAbort.signal;
+      const forwardAbort = () => runAbort.abort(abortSignal.reason);
+      // Declared here, not at its registration below: it doubles as this run's identity token
+      // on the per-thread maps (see registerThreadServerCancel).
+      const serverCancel = () => runAbort.abort();
+      if (abortSignal.aborted) {
+        forwardAbort();
+      } else {
+        abortSignal.addEventListener("abort", forwardAbort, { once: true });
+      }
+
       // ── Audio model path (non-streaming) ─────────────────────
       const activeModel = runtime.models.find(
         (m) => m.id === params.checkpoint,
       );
       if (activeModel?.isAudio && !activeModel?.hasAudioInput) {
-        const threadKey = resolvedThreadId || "__default";
-        runtime.setThreadRunning(threadKey, true);
+        const audioCancel = () => runAbort.abort();
+        runtime.registerThreadServerCancel(threadKey, audioCancel);
+        runtime.setThreadRunning(threadKey, true, { owner: audioCancel });
         try {
           yield {
             content: [{ type: "text" as const, text: "Generating audio..." }],
@@ -2780,6 +2857,10 @@ export function createOpenAIStreamAdapter(
             {
               model: params.checkpoint,
               messages: outboundMessages,
+              // Same run in both registries: without it the backend files this under no
+              // thread, and the stop-chats prompt counts the named local run and the
+              // unnamed backend one as two.
+              ...(resolvedThreadId ? { thread_id: resolvedThreadId } : {}),
               stream: false,
               temperature: params.temperature,
               top_p: params.topP,
@@ -2790,7 +2871,7 @@ export function createOpenAIStreamAdapter(
               presence_penalty: params.presencePenalty,
               ...(useAdapter === undefined ? {} : { use_adapter: useAdapter }),
             },
-            abortSignal,
+            runSignal,
           );
 
           const audioUrl = `data:audio/wav;base64,${result.audio.data}`;
@@ -2803,19 +2884,21 @@ export function createOpenAIStreamAdapter(
             ],
           };
         } catch (err) {
-          if (!abortSignal.aborted) {
+          if (!runSignal.aborted) {
             toast.error("Audio generation failed", {
               description: err instanceof Error ? err.message : "Unknown error",
             });
           }
           throw err;
         } finally {
-          runtime.setThreadRunning(threadKey, false);
+          abortSignal.removeEventListener("abort", forwardAbort);
+          const audioKey = liveThreadKey(audioCancel);
+          runtime.setThreadRunning(audioKey, false, { owner: audioCancel });
+          runtime.clearThreadServerCancel(audioKey, audioCancel);
         }
         return;
       }
 
-      const threadKey = resolvedThreadId || "__default";
       let waitingFirstChunk = true;
       let firstTokenSettled = false;
       const streamStartTime = Date.now();
@@ -2846,10 +2929,15 @@ export function createOpenAIStreamAdapter(
       const warmupDelayMs = 450;
       const warmupTimer = setTimeout(() => {
         if (!waitingFirstChunk) return;
-        if (abortSignal.aborted) return;
+        if (runSignal.aborted) return;
         runtime.setGeneratingStatus("waiting");
       }, warmupDelayMs);
-      runtime.setThreadRunning(threadKey, true);
+      // Flagged local/external so the model-swap gate only counts the chats a reload ends; the
+      // backend leaves external-provider runs out of active_generations for the same reason.
+      runtime.setThreadRunning(threadKey, true, {
+        local: !isExternalRequest,
+        owner: serverCancel,
+      });
       let cumulativeText = "";
       let reasoningStartAt: number | null = null;
       let reasoningDuration = 0;
@@ -3015,21 +3103,12 @@ export function createOpenAIStreamAdapter(
         timings?: ServerTimings;
       } | null = null;
 
-      // Per-run cancellation token so a delayed stop POST can't match
-      // the next run on the same thread.
-      const cancelId =
-        typeof crypto !== "undefined" && "randomUUID" in crypto
-          ? crypto.randomUUID()
-          : `${Date.now()}-${Math.random().toString(36).slice(2)}`;
-
       // Colab-style proxies can swallow fetch aborts, so also POST
       // /inference/cancel explicitly on abort.
       const onAbortCancel = () => {
-        // assistant-ui aborts with AbortError(detach=true) when a thread's runtime
-        // unmounts (navigation / background thread switch) and detach=false for an
-        // explicit Stop. Only a real Stop cancels the backend run; a detach must
-        // leave a backgrounded generation streaming.
-        if ((abortSignal.reason as { detach?: boolean } | undefined)?.detach) {
+        // assistant-ui aborts with detach=true when a runtime unmounts and detach=false for an
+        // explicit Stop. Only a real Stop cancels the backend run; runSignal forwards the reason.
+        if ((runSignal.reason as { detach?: boolean } | undefined)?.detach) {
           return;
         }
         const body: Record<string, string> = { cancel_id: cancelId };
@@ -3050,11 +3129,17 @@ export function createOpenAIStreamAdapter(
           keepalive: true,
         }).catch(() => {});
       };
+
+      // Stop handle for when this conversation is not the visible one, which cancelByThreadId
+      // cannot reach. Aborting this run's own controller closes just its request, and the
+      // listener above posts its cancel_id so llama-server stops decoding too. For an
+      // external provider the abort is the stop, since its cancel_id is never registered.
+      runtime.registerThreadServerCancel(threadKey, serverCancel);
       try {
-        if (abortSignal.aborted) {
+        if (runSignal.aborted) {
           onAbortCancel();
         } else {
-          abortSignal.addEventListener("abort", onAbortCancel, { once: true });
+          runSignal.addEventListener("abort", onAbortCancel, { once: true });
         }
 
         const {
@@ -3526,7 +3611,7 @@ export function createOpenAIStreamAdapter(
             }
             clearSelectedImageEditReference();
             await ThreadAutosaveHandle.awaitFirstSave(resolvedThreadId);
-            const stream = streamChatCompletions(requestPayload, abortSignal);
+            const stream = streamChatCompletions(requestPayload, runSignal);
 
             for await (const chunk of stream) {
               const chunkModel = (chunk as { model?: unknown }).model;
@@ -3539,7 +3624,11 @@ export function createOpenAIStreamAdapter(
                 chunk as unknown as { _toolStatus?: string }
               )._toolStatus;
               if (toolStatusText !== undefined) {
-                runtime.setToolStatus(toolStatusText || null);
+                runtime.setToolStatus(
+                  liveThreadKey(serverCancel),
+                  toolStatusText || null,
+                  serverCancel,
+                );
                 continue;
               }
 
@@ -3568,7 +3657,9 @@ export function createOpenAIStreamAdapter(
                 }
               )._diffusionFrame;
               if (diffusionFrame !== undefined) {
-                runtime.setActiveDiffusionCanvas({
+                // Keyed by thread so a background run's frames stay out of the visible chat
+                // instead of overwriting the frame it is painting.
+                runtime.setActiveDiffusionCanvas(liveThreadKey(serverCancel), {
                   block: diffusionFrame.block ?? 0,
                   step: diffusionFrame.step ?? 0,
                   total: diffusionFrame.total ?? 0,
@@ -3709,8 +3800,16 @@ export function createOpenAIStreamAdapter(
                   const approvalId = (toolEvent.approval_id as string) || "";
                   const awaitingConfirmation =
                     toolEvent.awaiting_confirmation === true;
+                  // Reuse a provisional card's part id, else the confirmation-scoped id
+                  // opens a second card and the first spins "Running" forever.
+                  const openPartId = backendToolCallId
+                    ? toolPartIdByBackendId.get(backendToolCallId)
+                    : undefined;
+                  const reuseOpenPart =
+                    !!openPartId &&
+                    toolCallParts.some((p) => p.toolCallId === openPartId);
                   const id =
-                    awaitingConfirmation && approvalId
+                    awaitingConfirmation && approvalId && !reuseOpenPart
                       ? `${toolConfirmationScopeId}:${approvalId}`
                       : backendToolCallId
                         ? resolveToolPartId(backendToolCallId)
@@ -4289,9 +4388,17 @@ export function createOpenAIStreamAdapter(
         // Anthropic-only (billed at the write premium).
         const cacheWriteTokens = meta?.usage?.cache_creation_input_tokens ?? 0;
 
-        // Gate on the captured checkpoint still being active so a late
-        // completion from provider A doesn't populate the bar after a
-        // mid-stream switch to provider B.
+        // Gate on the captured checkpoint so a late completion from provider A cannot populate
+        // the bar after a mid-stream switch to B, and on the captured thread so a background
+        // run finishing after New Chat cannot repaint another chat's usage. An unresolved run
+        // has no id to compare, so compare what was on screen when it started. A first turn is
+        // adopted onto an id mid-run and autosave moves activeThreadId with it, so read the
+        // adopted key, or the run stays "unresolved" for life and the bar stays blank.
+        const usageKey = liveThreadKey(serverCancel);
+        const usageThreadKey = usageKey === "__default" ? null : usageKey;
+        const usageThreadIsVisible =
+          useChatRuntimeStore.getState().activeThreadId ===
+          (usageThreadKey ?? activeThreadIdAtRunStart);
         if (
           meta?.usage &&
           typeof meta.usage.prompt_tokens === "number" &&
@@ -4299,13 +4406,23 @@ export function createOpenAIStreamAdapter(
           typeof meta.usage.total_tokens === "number" &&
           useChatRuntimeStore.getState().params.checkpoint === params.checkpoint
         ) {
-          useChatRuntimeStore.getState().setContextUsage({
+          const usage = {
             promptTokens: meta.usage.prompt_tokens,
             completionTokens: meta.usage.completion_tokens,
             totalTokens: meta.usage.total_tokens,
             cachedTokens,
             cacheWriteTokens,
-          });
+          };
+          // File it under this run's own thread even when the gate below blocks the visible
+          // write, so switching back re-applies it.
+          if (usageThreadKey !== null) {
+            useChatRuntimeStore
+              .getState()
+              .setThreadContextUsage(usageThreadKey, usage);
+          }
+          if (usageThreadIsVisible) {
+            useChatRuntimeStore.getState().setContextUsage(usage);
+          }
         }
 
         const finishedAt = Date.now();
@@ -4358,7 +4475,7 @@ export function createOpenAIStreamAdapter(
         settleFirstTokenErr(
           err instanceof Error ? err : new Error("Generation failed"),
         );
-        if (!abortSignal.aborted) {
+        if (!runSignal.aborted) {
           const msg = err instanceof Error ? err.message : String(err);
           if (err instanceof GenerationLengthError) {
             toast.error("Response ran out of tokens", {
@@ -4396,13 +4513,18 @@ export function createOpenAIStreamAdapter(
         }
         throw err;
       } finally {
-        abortSignal.removeEventListener("abort", onAbortCancel);
+        runSignal.removeEventListener("abort", onAbortCancel);
+        abortSignal.removeEventListener("abort", forwardAbort);
+        // Resolve once: the clears below drop the owner the lookup keys on.
+        const cleanupKey = liveThreadKey(serverCancel);
         const confirmStore = useChatRuntimeStore.getState();
         for (const part of toolCallParts) {
           confirmStore.clearToolConfirmation(part.toolCallId);
         }
         runtime.setGeneratingStatus(null);
-        runtime.setToolStatus(null);
+        // Scoped by thread AND by run: a global clear wiped every other running chat's badge,
+        // and an unowned one wiped a concurrent run's badge behind the same key.
+        runtime.setToolStatus(cleanupKey, null, serverCancel);
         // Clear only this run's live keys (a concurrent pane owns its own). A
         // key still here streamed stdout but never reached tool_end (SSE drop or
         // cancel), so promote it to full output first, else the partial
@@ -4416,20 +4538,23 @@ export function createOpenAIStreamAdapter(
           store.clearToolLiveOutput(liveKey);
         }
         runToolLiveOutputKeys.clear();
-        // Drop the transient denoising canvas so the finished bubble shows only
-        // the committed markdown answer (cancellation/error included).
-        runtime.setActiveDiffusionCanvas(null);
+        // Drop the transient denoising canvas so the finished bubble shows only the committed
+        // answer. Scoped: a global clear wiped another denoising chat's frame.
+        runtime.clearActiveDiffusionCanvasForThread(cleanupKey);
         clearTimeout(warmupTimer);
         if (waitingFirstChunk) {
           if (firstTokenSettled) {
             settleFirstTokenOk();
-          } else if (abortSignal.aborted) {
+          } else if (runSignal.aborted) {
             settleFirstTokenErr(new Error("Cancelled"));
           } else {
             settleFirstTokenErr(new Error("No tokens received"));
           }
         }
-        runtime.setThreadRunning(threadKey, false);
+        // serverCancel narrows both clears: runs with no resolved thread id share the "__default"
+        // key, so a blind clear could drop a sibling's entry.
+        runtime.setThreadRunning(cleanupKey, false, { owner: serverCancel });
+        runtime.clearThreadServerCancel(cleanupKey, serverCancel);
       }
     },
   };
diff --git a/studio/frontend/src/features/chat/api/chat-api.ts b/studio/frontend/src/features/chat/api/chat-api.ts
index 096df118b3..b41028e503 100644
--- a/studio/frontend/src/features/chat/api/chat-api.ts
+++ b/studio/frontend/src/features/chat/api/chat-api.ts
@@ -129,6 +129,27 @@ export async function getApiMonitorEntry(id: string): Promise<ApiMonitorEntry> {
   return parseJsonOrThrow<ApiMonitorEntry>(response);
 }
 
+export interface ActiveGenerationsResponse {
+  count: number;
+  /** Conversations with a generation in flight. Shorter than `count` when a
+   *  first turn started before its thread id was persisted. */
+  thread_ids: string[];
+  /** One entry per in-flight request. `kind` is "chat" unless it is an
+   *  embeddings / completions / audio call, which has no conversation. */
+  active?: { thread_id: string | null; kind?: string }[];
+  parallel_slots: number;
+}
+
+/**
+ * Chats generating on the backend right now. Authoritative where `runningByThreadId` is not:
+ * that map is per-tab, empty after a reload and blind to a second tab, and /load and /unload
+ * 409 on these.
+ */
+export async function getActiveGenerations(): Promise<ActiveGenerationsResponse> {
+  const response = await authFetch("/api/inference/active-generations");
+  return parseJsonOrThrow<ActiveGenerationsResponse>(response);
+}
+
 export async function loadModel(
   payload: LoadModelRequest,
 ): Promise<LoadModelResponse> {
diff --git a/studio/frontend/src/features/chat/chat-page.tsx b/studio/frontend/src/features/chat/chat-page.tsx
index 7cc03fab26..8ae6c6fb15 100644
--- a/studio/frontend/src/features/chat/chat-page.tsx
+++ b/studio/frontend/src/features/chat/chat-page.tsx
@@ -2682,9 +2682,10 @@ export function ChatPage({
           ggufNativeContextLength: null,
           activeNativePathToken: null,
           activeNativePathExpiresAtMs: null,
-          // Clear previous-model counters, else the relaxed external-provider
-          // render gate shows stale stats until the next completion.
+          // Clear previous-model counters, else the relaxed external-provider render gate shows
+          // stale stats. The per-thread copies go too, so a switch back cannot re-apply.
           contextUsage: null,
+          contextUsageByThreadId: {},
           supportsReasoning: reasoningCaps.supportsReasoning,
           reasoningAlwaysOn: reasoningCaps.reasoningAlwaysOn,
           reasoningStyle: reasoningCaps.reasoningStyle,
@@ -2906,7 +2907,13 @@ export function ChatPage({
           ) {
             return;
           }
-          store.setContextUsage(usage);
+          // Key by the thread this restore read, like the history loader: the await above can
+          // outlast a switch away, and an unkeyed write would file this thread's usage under
+          // the incoming one.
+          store.setThreadContextUsage(threadId, usage);
+          if (store.activeThreadId === threadId) {
+            store.setContextUsage(usage);
+          }
         })
         .catch((error) => {
           if (!isExpectedBackgroundChatStorageError(error)) {
diff --git a/studio/frontend/src/features/chat/components/stop-running-chats-dialog.tsx b/studio/frontend/src/features/chat/components/stop-running-chats-dialog.tsx
new file mode 100644
index 0000000000..dd9d6c13a1
--- /dev/null
+++ b/studio/frontend/src/features/chat/components/stop-running-chats-dialog.tsx
@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from "@/components/ui/alert-dialog";
+import { useStopRunningChatsDialogStore } from "../stores/stop-running-chats-dialog-store";
+
+/**
+ * Confirmation for applying a model or reload-required setting while chats are generating.
+ * They share one llama-server, so the swap ends all of them: name them and make the user
+ * opt in rather than truncating silently.
+ */
+export function StopRunningChatsDialog() {
+  const open = useStopRunningChatsDialogStore((s) => s.open);
+  const count = useStopRunningChatsDialogStore((s) => s.count);
+  const titles = useStopRunningChatsDialogStore((s) => s.titles);
+  const action = useStopRunningChatsDialogStore((s) => s.action);
+  const hasNonChat = useStopRunningChatsDialogStore((s) => s.hasNonChat);
+  const effect = useStopRunningChatsDialogStore((s) => s.effect);
+  const resolve = useStopRunningChatsDialogStore((s) => s.resolve);
+
+  // Embeddings, raw completions and audio share the model but are not conversations,
+  // so name them generically rather than offering to stop chats that do not exist.
+  const noun = hasNonChat
+    ? count === 1
+      ? "request"
+      : "requests"
+    : count === 1
+      ? "chat"
+      : "chats";
+  const sharer = hasNonChat ? "request" : "conversation";
+  // Ejecting leaves no model loaded. Saying it "reloads the model" and offering "Stop and
+  // reload" promised the opposite of what confirming does, for the destructive one.
+  const unloads = effect === "unload";
+  const lead = unloads
+    ? `${action || "Unloading the model"} leaves no model loaded, and every open ${sharer} shares it, `
+    : `${action ? `${action} reloads the model, ` : "Reloading the model "}which every open ${sharer} shares, `;
+  const shown = titles.slice(0, 5);
+  const remaining = Math.max(0, titles.length - shown.length);
+
+  return (
+    <AlertDialog
+      open={open}
+      onOpenChange={(next) => {
+        // Escape / overlay click must resolve, or the caller's await hangs.
+        if (!next) resolve(false);
+      }}
+    >
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>
+            Stop {count} running {noun}?
+          </AlertDialogTitle>
+          <AlertDialogDescription>
+            {lead}so {count === 1 ? "this" : "these"} {noun} will stop
+            {hasNonChat ? "" : " generating"}. Work produced so far is kept.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        {shown.length > 0 && (
+          <ul className="max-h-40 overflow-y-auto rounded-md border bg-muted/40 px-3 py-2 text-sm">
+            {shown.map((title) => (
+              <li key={title} className="truncate py-0.5">
+                {title}
+              </li>
+            ))}
+            {remaining > 0 && (
+              <li className="py-0.5 text-muted-foreground">
+                and {remaining} more
+              </li>
+            )}
+          </ul>
+        )}
+        <AlertDialogFooter>
+          <AlertDialogCancel onClick={() => resolve(false)}>
+            Keep generating
+          </AlertDialogCancel>
+          <AlertDialogAction onClick={() => resolve(true)}>
+            {unloads ? "Stop and unload" : "Stop and reload"}
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+}
diff --git a/studio/frontend/src/features/chat/hooks/use-chat-model-runtime.ts b/studio/frontend/src/features/chat/hooks/use-chat-model-runtime.ts
index 6b9e025802..5a796ed601 100644
--- a/studio/frontend/src/features/chat/hooks/use-chat-model-runtime.ts
+++ b/studio/frontend/src/features/chat/hooks/use-chat-model-runtime.ts
@@ -28,6 +28,7 @@ import {
   validateModel,
 } from "../api/chat-api";
 import { formatEta, formatRate } from "../utils/format-transfer";
+import { confirmStopRunningChatsIfNeeded } from "../utils/confirm-stop-running-chats";
 import {
   GPU_LAYERS_AUTO,
   isLocalModelPath,
@@ -463,7 +464,14 @@ export function useChatModelRuntime() {
     useChatRuntimeStore.getState().setModelLoading(true);
     void (async () => {
       try {
+        // Unforced on purpose: a chat may stream on the PREVIOUS model and must not be killed by
+        // cancelling this load. Nothing to report, since the route runs its stop-loading fast
+        // path ahead of the active-chat refusal.
         await unloadModel({ model_path: model.id }).catch(() => {});
+        // clearCheckpoint above assumed nothing was left loaded, but a forced switch keeps the
+        // previous model resident until /load's teardown, and the stop-loading fast path leaves
+        // it there. Take the answer from the backend, which reports none once it was evicted.
+        await syncInferenceStatusToStore().catch(() => {});
       } finally {
         cancelUnloadPendingRef.current = false;
         if (!loadingModelRef.current) {
@@ -505,10 +513,11 @@ export function useChatModelRuntime() {
       // as a duplicate), don't start a second concurrent load and don't swallow the
       // request: surface it so the user waits or cancels. Centralized here so every
       // entry point is covered, not just the staged Load button.
-      const inFlightLoad =
-        loadingModelRef.current ??
-        useChatRuntimeStore.getState().loadingModelPick;
-      if (inFlightLoad) {
+      const bailIfLoadInFlight = (): boolean => {
+        const inFlightLoad =
+          loadingModelRef.current ??
+          useChatRuntimeStore.getState().loadingModelPick;
+        if (!inFlightLoad) return false;
         if (typeof selection !== "string" && selection.previousConfig) {
           applyPerModelConfigToRuntime(selection.previousConfig);
         }
@@ -516,7 +525,7 @@ export function useChatModelRuntime() {
           inFlightLoad.id === modelId &&
           (inFlightLoad.ggufVariant ?? null) === (ggufVariant ?? null) &&
           (inFlightLoad.nativePathToken ?? null) === (nativePathToken ?? null);
-        if (loadingSamePick) return;
+        if (loadingSamePick) return true;
         const message =
           "Another model is already loading. Wait for it to finish or cancel it first.";
         setModelsError(message);
@@ -524,8 +533,61 @@ export function useChatModelRuntime() {
         toast.info("Another model is already loading", {
           description: "Wait for it to finish or cancel it first.",
         });
+        return true;
+      };
+      if (bailIfLoadInFlight()) return;
+
+      // Picking an external provider leaves the local model resident and stops the status poll
+      // mirroring it, so params.checkpoint cannot tell whether this pick is that same model.
+      // Ask the backend before prompting: /load answers already_loaded ahead of its cancel
+      // hook, so the dialog would promise to stop chats this pick never interrupts. A staged
+      // config always carries forceReload, so Apply still reloads and prompts.
+      const selectedCheckpoint =
+        useChatRuntimeStore.getState().params.checkpoint;
+      if (!forceReload && isExternalModelId(selectedCheckpoint)) {
+        const residentStatus = await getInferenceStatus().catch(() => null);
+        if (
+          residentStatus &&
+          resolveInferenceCheckpointId(residentStatus) === modelId &&
+          (residentStatus.gguf_variant ?? null) === (ggufVariant ?? null)
+        ) {
+          // Same window as the confirm below: a rival load may have started during that GET,
+          // and it owns the resident model now.
+          if (bailIfLoadInFlight()) return;
+          // Roll back the config pre-applied for the load that is not happening BEFORE hydrating,
+          // so the resident model's status wins over the staged snapshot.
+          if (typeof selection !== "string" && selection.previousConfig) {
+            applyPerModelConfigToRuntime(selection.previousConfig);
+          }
+          const previousGgufVariant =
+            useChatRuntimeStore.getState().activeGgufVariant;
+          useChatRuntimeStore
+            .getState()
+            .setCheckpoint(modelId, residentStatus.gguf_variant);
+          applyActiveModelStatusToStore(residentStatus, {
+            previousCheckpoint: selectedCheckpoint,
+            previousGgufVariant,
+          });
+          syncModelCapabilities(modelId, residentStatus);
+          return;
+        }
+      }
+
+      // Every chat decodes on the llama-server this load replaces, so ask first, then allow the
+      // cancel; the 409 gate stays armed for callers that never confirmed.
+      const stopDecision = await confirmStopRunningChatsIfNeeded(
+        forceReload ? "Applying these settings" : "Loading a different model",
+      );
+      if (!stopDecision.proceed) {
+        if (typeof selection !== "string" && selection.previousConfig) {
+          applyPerModelConfigToRuntime(selection.previousConfig);
+        }
         return;
       }
+      // Re-check: the confirm above awaits a GET, so a pick in that window would start a rival
+      // load over the same refs. Nothing awaits before the reservation below.
+      if (bailIfLoadInFlight()) return;
+      const forceCancelActive = stopDecision.forceCancelActive;
 
       const explicitIsLora =
         typeof selection === "string" ? undefined : selection.isLora;
@@ -777,6 +839,10 @@ export function useChatModelRuntime() {
                 upgrade: validation.transformers_upgrade,
                 // No installable release: custom-code models may fall back to the trust_remote_code gate below.
                 trustRemoteCodeFallback: validation.requires_trust_remote_code,
+                // The install refuses while chats generate and takes no force flag of its own, so
+                // without this the "Stop and reload" the user just confirmed dies here: Retry hits
+                // the same 409, and this path leaves chats running.
+                forceCancelActive,
               });
               // The install unloads the previous model before the swap (even when
               // the swap then fails), so any exit after this point must roll back.
@@ -820,7 +886,14 @@ export function useChatModelRuntime() {
               : undefined;
 
             if (currentCheckpoint) {
-              await unloadModel({ model_path: currentCheckpoint });
+              // With chats generating, skip this preliminary unload: it cancels them ahead of /load's
+              // preflight, so a rejected target truncates replies for a model that never loads
+              // (/load evicts past those checks itself). Idle, unload first and free VRAM early.
+              if (!forceCancelActive) {
+                await unloadModel({ model_path: currentCheckpoint });
+              }
+              // Set either way: /load can still leave no model resident, and an unneeded rollback
+              // hits already_loaded before the gate.
               previousWasUnloaded = true;
             }
             if (abortCtrl.signal.aborted) throw new Error("Cancelled");
@@ -935,6 +1008,7 @@ export function useChatModelRuntime() {
               n_cpu_moe: loadNCpuMoe,
               tensor_split: loadSplitRatio ?? undefined,
               gpu_ids: loadSelectedGpuIds ?? undefined,
+              force_cancel_active: forceCancelActive,
             });
 
             // If cancelled while loading, don't update UI to show
@@ -1173,6 +1247,8 @@ export function useChatModelRuntime() {
                   n_cpu_moe: stateBeforeUnload.loadedNCpuMoe ?? 0,
                   tensor_split: stateBeforeUnload.loadedSplitRatio ?? undefined,
                   gpu_ids: stateBeforeUnload.loadedGpuIds ?? undefined,
+                  // The failed swap already unloaded the server those runs used.
+                  force_cancel_active: true,
                 });
                 const rollbackSpeculativeType = normalizeSpeculativeType(
                   rollbackResponse.speculative_type,
@@ -1571,13 +1647,15 @@ export function useChatModelRuntime() {
     if (!params.checkpoint) {
       return false;
     }
-    const runtime = useChatRuntimeStore.getState();
-    if (runtime.modelLoading || runtime.loadingModelPick) {
+    const bailIfLoading = (): boolean => {
+      const runtime = useChatRuntimeStore.getState();
+      if (!runtime.modelLoading && !runtime.loadingModelPick) return false;
       toast.info("A model is loading", {
         description: "Wait for it to finish or cancel it first.",
       });
-      return false;
-    }
+      return true;
+    };
+    if (bailIfLoading()) return false;
     setModelsError(null);
     if (isExternalModelId(params.checkpoint)) {
       clearCheckpoint();
@@ -1585,8 +1663,21 @@ export function useChatModelRuntime() {
       return true;
     }
     try {
+      // Ejecting tears down llama-server, so every chat stops. Same prompt, but it
+      // leaves no model loaded, so it must not be worded as a reload.
+      const stopDecision = await confirmStopRunningChatsIfNeeded(
+        "Unloading the model",
+        "unload",
+      );
+      if (!stopDecision.proceed) return false;
+      // Same window as selectModel: a load may have started during the confirm.
+      if (bailIfLoading()) return false;
+
       async function performUnload(): Promise<void> {
-        await unloadModel({ model_path: params.checkpoint });
+        await unloadModel({
+          model_path: params.checkpoint,
+          force_cancel_active: stopDecision.forceCancelActive,
+        });
         clearCheckpoint();
         await refresh();
       }
diff --git a/studio/frontend/src/features/chat/hooks/use-chat-sidebar-items.ts b/studio/frontend/src/features/chat/hooks/use-chat-sidebar-items.ts
index a08bd5fa54..651833102a 100644
--- a/studio/frontend/src/features/chat/hooks/use-chat-sidebar-items.ts
+++ b/studio/frontend/src/features/chat/hooks/use-chat-sidebar-items.ts
@@ -17,6 +17,7 @@ import {
   updateStoredChatThread,
 } from "../utils/chat-history-storage";
 import { clearComposerDraft } from "../utils/composer-draft";
+import { stopChatThread } from "../utils/stop-chat-thread";
 import {
   markChatThreadsDeleted,
   removeChatThreadTombstones,
@@ -25,6 +26,8 @@ import {
 export interface SidebarItem {
   type: "single" | "compare";
   id: string;
+  /** The pane threads behind this row id; `runningByThreadId` is keyed per pane thread. */
+  threadIds?: string[];
   title: string;
   createdAt: number;
   updatedAt: number;
@@ -56,11 +59,13 @@ export function groupThreads(
       const existing = pairItems.get(t.pairId);
       if (existing) {
         existing.updatedAt = Math.max(existing.updatedAt, lastActivityAt(t));
+        existing.threadIds?.push(t.id);
         continue;
       }
       const item: SidebarItem = {
         type: "compare",
         id: t.pairId,
+        threadIds: [t.id],
         title: t.title,
         createdAt: t.createdAt,
         updatedAt: lastActivityAt(t),
@@ -160,10 +165,9 @@ export function useChatSidebarItems(options?: {
 }
 
 function cancelIfRunning(threadId: string): void {
-  const { runningByThreadId, cancelByThreadId } =
-    useChatRuntimeStore.getState();
-  if (!runningByThreadId[threadId]) return;
-  cancelByThreadId[threadId]?.();
+  // Reaches a background thread, which cancelByThreadId cannot: a deleted chat must stop,
+  // or the run keeps writing to a conversation that is gone.
+  stopChatThread(threadId);
 }
 
 export async function renameChatItem(
diff --git a/studio/frontend/src/features/chat/index.ts b/studio/frontend/src/features/chat/index.ts
index 2c1bbcefad..a96a7509bd 100644
--- a/studio/frontend/src/features/chat/index.ts
+++ b/studio/frontend/src/features/chat/index.ts
@@ -55,8 +55,12 @@ export {
 export {
   preferFullToolOutput,
   toolOutputKey,
+  toolThreadScope,
+  useToolOutputFor,
+  useUnresolvedToolPaneScope,
   useToolPaneScope,
 } from "./tool-output-scope";
+export { useToolAwaitingApproval } from "./tool-approval";
 export { PermissionModeDropdown } from "./permission-mode-select";
 export { useChatSearchStore } from "./stores/chat-search-store";
 export { usePinnedChatsStore } from "./stores/pinned-chats-store";
@@ -80,6 +84,7 @@ export {
 export { ApiProviderLogo } from "./api-provider-logo";
 export { useExternalProvidersStore } from "./stores/external-providers-store";
 export { ChatSearchDialog } from "./components/chat-search-dialog";
+export { StopRunningChatsDialog } from "./components/stop-running-chats-dialog";
 export { setTrainingCompareHandoff } from "./lib/training-compare-handoff";
 export type { ProjectRecord } from "./types";
 export { clearAllChats, countAllChats } from "./utils/clear-all-chats";
diff --git a/studio/frontend/src/features/chat/runtime-provider.tsx b/studio/frontend/src/features/chat/runtime-provider.tsx
index 2fa128bf2f..c22c753545 100644
--- a/studio/frontend/src/features/chat/runtime-provider.tsx
+++ b/studio/frontend/src/features/chat/runtime-provider.tsx
@@ -85,7 +85,11 @@ import { requestPromptQueueStop } from "./utils/prompt-queue-boundary";
 import { isAssistantLocalThreadId } from "./utils/thread-ids";
 
 const pendingHistoryAppendByMessageId = new Map<string, Promise<void>>();
-const pendingRunStartReadyByMessageId = new Map<string, Promise<void>>();
+// Resolves to the thread id assigned when this message's chat was first persisted.
+const pendingRunStartReadyByMessageId = new Map<
+  string,
+  Promise<string | undefined>
+>();
 
 type TitleResponse = {
   choices?: Array<{
@@ -699,6 +703,10 @@ function createStudioDbAdapter(
 
     async initialize(threadId: string) {
       await ensureThreadRecord({ threadId, modelType, pairId, projectId });
+      // A run already streaming on this thread filed its handles under "__default" because
+      // the id did not exist yet. Re-key them now, or the sidebar row and Stop look up an
+      // id nothing is registered against.
+      useChatRuntimeStore.getState().adoptDefaultThreadRun(threadId);
       return { remoteId: threadId, externalId: undefined };
     },
 
@@ -835,8 +843,8 @@ function trackHistoryAppend(
 
 function trackRunStartReady(
   messageId: string,
-  ready: Promise<void>,
-): Promise<void> {
+  ready: Promise<string | undefined>,
+): Promise<string | undefined> {
   pendingRunStartReadyByMessageId.set(messageId, ready);
   const cleanup = () => {
     setTimeout(() => {
@@ -851,7 +859,7 @@ function trackRunStartReady(
 
 async function waitForRunStartHistoryAppend(
   messages: Parameters<ChatModelAdapter["run"]>[0]["messages"],
-): Promise<void> {
+): Promise<string | undefined> {
   // Deep Research reserves an assistant placeholder before invoking the model
   // adapter, so the user message is not necessarily the final entry here.
   const userMessage = [...messages]
@@ -862,15 +870,16 @@ async function waitForRunStartHistoryAppend(
   }
   const runStartReady = pendingRunStartReadyByMessageId.get(userMessage.id);
   const historyAppendReady = pendingHistoryAppendByMessageId.get(userMessage.id);
-  const pending = [runStartReady, historyAppendReady].filter(
-    (ready): ready is Promise<void> => ready !== undefined,
-  );
-  if (pending.length === 0) {
-    return;
+  if (runStartReady === undefined && historyAppendReady === undefined) {
+    return undefined;
   }
   let didBecomeReady = false;
+  let adoptedThreadId: string | undefined;
   try {
-    await Promise.all(pending);
+    [adoptedThreadId] = await Promise.all([
+      runStartReady ?? Promise.resolve(undefined),
+      historyAppendReady?.then(() => undefined),
+    ]);
     didBecomeReady = true;
   } finally {
     if (
@@ -881,14 +890,22 @@ async function waitForRunStartHistoryAppend(
       pendingRunStartReadyByMessageId.delete(userMessage.id);
     }
   }
+  return adoptedThreadId;
 }
 
 function createPersistedRunAdapter(adapter: ChatModelAdapter): ChatModelAdapter {
   return {
     ...adapter,
     async *run(options) {
-      await waitForRunStartHistoryAppend(options.messages);
-      const result = adapter.run(options);
+      const adoptedThreadId = await waitForRunStartHistoryAppend(options.messages);
+      // The thread has an id by the time that resolves, but assistant-ui bound unstable_threadId
+      // before the await. Hand the run its real id so a first turn never files its handles
+      // under the unresolved key that concurrent runs share.
+      const result = adapter.run(
+        !options.unstable_threadId && adoptedThreadId
+          ? { ...options, unstable_threadId: adoptedThreadId }
+          : options,
+      );
       if (!result) {
         return;
       }
@@ -1153,7 +1170,13 @@ function useStudioRuntimeAdapters(
           : typeof store.ggufContextLength === "number" &&
             store.ggufContextLength > 0;
         if (savedUsage && withinLocalLimit && modelMatches) {
-          store.setContextUsage(savedUsage);
+          // Key by the thread this loader read, not whichever is active when the await resolves:
+          // a switch inside it would file this thread's usage under the incoming one. Same rule
+          // the adapter's end-of-run write follows.
+          store.setThreadContextUsage(remoteId, savedUsage);
+          if (store.activeThreadId === remoteId) {
+            store.setContextUsage(savedUsage);
+          }
         }
 
         // If any message has a stored parentId, reconstruct the tree so
@@ -1179,7 +1202,10 @@ function useStudioRuntimeAdapters(
 
       append({ parentId, message }: ExportedMessageRepositoryItem) {
         const initializeThread = aui.threadListItem().initialize();
-        trackRunStartReady(message.id, initializeThread.then(() => undefined));
+        trackRunStartReady(
+          message.id,
+          initializeThread.then(({ remoteId }) => remoteId),
+        );
         const write = (async () => {
           const { remoteId } = await initializeThread;
           if (isChatThreadDeleted(remoteId)) {
@@ -1308,17 +1334,6 @@ function createRuntimeHook(modelType: ModelType, pairId?: string) {
   };
 }
 
-function stopChatRun(threadId: string | null | undefined) {
-  if (!threadId) {
-    return;
-  }
-  try {
-    useChatRuntimeStore.getState().cancelByThreadId[threadId]?.();
-  } catch {
-    // The run may have ended while navigation was mounting.
-  }
-}
-
 function ThreadAutoSwitch({
   threadId,
   syncActiveThreadId = true,
@@ -1333,8 +1348,9 @@ function ThreadAutoSwitch({
   useEffect(() => {
     if (!isLoading && mainThreadId !== threadId) {
       if (syncActiveThreadId) {
-        requestPromptQueueStop();
-        stopChatRun(mainThreadId);
+        // Stop queueing prompts to the outgoing thread but leave its run alone: its runtime
+        // stays mounted and keeps streaming. Only an explicit Stop cancels one.
+        requestPromptQueueStop({ cancelActiveRun: false });
       }
       const switchResult = aui.threads().switchToThread(threadId) as unknown;
       if (
@@ -1365,16 +1381,14 @@ function ThreadNewChatSwitch({
 }: { nonce: string }): ReactElement | null {
   const aui = useAui();
   const isLoading = useAuiState(({ threads }) => threads.isLoading);
-  const mainThreadId = useAuiState(({ threads }) => threads.mainThreadId);
-  const mainThreadIdRef = useRef(mainThreadId);
-  mainThreadIdRef.current = mainThreadId;
-
+  // The outgoing thread is not read here: New Chat leaves it running.
   useEffect(() => {
     if (isLoading) {
       return;
     }
-    requestPromptQueueStop();
-    stopChatRun(mainThreadIdRef.current);
+    // New Chat leaves the previous conversation generating: its runtime stays mounted and
+    // the sidebar spins. Stopping it is its own Stop button's job.
+    requestPromptQueueStop({ cancelActiveRun: false });
     // Switch to a fresh local thread without persisting it yet; persistence
     // still happens on first message append.
     void aui.threads().switchToNewThread();
diff --git a/studio/frontend/src/features/chat/stores/chat-runtime-store.ts b/studio/frontend/src/features/chat/stores/chat-runtime-store.ts
index 9d470d866a..d0f30068e5 100644
--- a/studio/frontend/src/features/chat/stores/chat-runtime-store.ts
+++ b/studio/frontend/src/features/chat/stores/chat-runtime-store.ts
@@ -762,6 +762,30 @@ export function isDownloadableHubRepo(x: {
   );
 }
 
+type ContextUsageSnapshot = {
+  promptTokens: number;
+  completionTokens: number;
+  totalTokens: number;
+  cachedTokens: number;
+  // Anthropic-only; optional so pre-cache-stats persisted entries load.
+  cacheWriteTokens?: number;
+};
+
+/**
+ * One live run behind `runningByThreadId[id]`, with the `local` flag it started with so the
+ * model-swap gate can tell llama-server runs from external ones when runs share a key.
+ */
+type ThreadRunOwner = {
+  owner: () => void;
+  local: boolean;
+};
+
+type ToolStatusEntry = {
+  status: string;
+  startedAt: number;
+  owner?: () => void;
+};
+
 type ChatRuntimeStore = {
   settingsHydrated: boolean;
   params: InferenceParams;
@@ -771,7 +795,25 @@ type ChatRuntimeStore = {
   models: ChatModelSummary[];
   loras: ChatLoraSummary[];
   runningByThreadId: Record<string, boolean>;
+  /**
+     * The subset of `runningByThreadId` decoding on the local llama-server. Swapping the local
+     * model neither interrupts an external-provider chat nor needs its consent, which is why
+     * the backend keeps those out of `active_generations` too.
+     */
+  localRunByThreadId: Record<string, boolean>;
+  /**
+     * Which runs set `runningByThreadId[id]`; see `setThreadRunning`'s `owner`. A list, not one
+     * entry: runs without a resolved thread id share the "__default" key, so one entry would let
+     * a newer run's clear delete an older run's flag while it still generates.
+     */
+  runOwnerByThreadId: Record<string, ThreadRunOwner[]>;
   cancelByThreadId: Record<string, () => void>;
+  /**
+     * Backend cancels for the threads generating in the background. `cancelByThreadId` only holds
+     * the visible thread's `cancelRun()`, so the adapter parks a closure here that POSTs that
+     * run's own cancel_id. A list for the same reason as `runOwnerByThreadId`: "__default" is shared.
+     */
+  serverCancelByThreadId: Record<string, (() => void)[]>;
   autoTitle: boolean;
   hfToken: string;
   modelsError: string | null;
@@ -892,7 +934,16 @@ type ChatRuntimeStore = {
    * consulted when `providerSupportsBuiltinWebFetch` is true.
    */
   webFetchToolsEnabled: boolean;
-  toolStatus: string | null;
+  /**
+     * Live tool status per conversation ("Running Python: ...") with its start time. Keyed by
+     * thread, or one chat's tool call shows above every other composer; the timestamp keeps the
+     * counter running across a thread switch.
+     */
+  /**
+     * Per-run entries, newest last. Unresolved threads share "__default", so one scalar per key
+     * meant a finishing run's clear removed a sibling's status while its tool was still running.
+     */
+  toolStatusByThreadId: Record<string, ToolStatusEntry[]>;
   /** Live stdout/stderr from running tools, keyed by toolCallId. Transient:
    *  appended by tool_output, cleared on tool_end or run end. */
   toolLiveOutput: Record<string, string>;
@@ -967,9 +1018,12 @@ type ChatRuntimeStore = {
   /** Active model is a block-diffusion model (DiffusionGemma): drives the
    *  denoising-canvas artifact auto-render. */
   loadedIsDiffusion: boolean;
-  /** Live denoising frame for the in-progress diffusion message. Transient: set
-   *  per step, cleared when the run ends, never persisted into the transcript. */
-  activeDiffusionCanvas: DiffusionCanvasFrame | null;
+  /**
+     * Live denoising frame per conversation ("__default" until the id exists). Transient: set per
+     * step, cleared when the run ends, never persisted. Keyed, not global: two denoising chats
+     * overwrote each other's frame, so the visible preview flickered or vanished.
+     */
+  activeDiffusionCanvasByThreadId: Record<string, DiffusionCanvasFrame>;
   customContextLength: number | null;
   /** The pinned context the loaded model used (null = Auto), so dirty-tracking
    *  and a later fit Apply can tell an explicit pin apart from Auto. */
@@ -992,14 +1046,13 @@ type ChatRuntimeStore = {
   pendingAudioBase64: string | null;
   pendingAudioName: string | null;
   pendingImageEditReference: PendingImageEditReference | null;
-  contextUsage: {
-    promptTokens: number;
-    completionTokens: number;
-    totalTokens: number;
-    cachedTokens: number;
-    // Anthropic-only; optional so pre-cache-stats persisted entries load.
-    cacheWriteTokens?: number;
-  } | null;
+  contextUsage: ContextUsageSnapshot | null;
+  /**
+     * Per-thread copy of the above, so the bar survives a switch away and back. `contextUsage` is
+     * the VISIBLE conversation's usage and a background run may not write it, so without this a
+     * run finishing off-screen leaves nothing to restore.
+     */
+  contextUsageByThreadId: Record<string, ContextUsageSnapshot>;
   modelLoading: boolean;
   loadingModelPick: LoadingModelPick | null;
   activeNativePathToken: string | null;
@@ -1018,9 +1071,35 @@ type ChatRuntimeStore = {
   setActivePresetSource: (source: ChatPresetSource) => void;
   setModels: (models: ChatModelSummary[]) => void;
   setLoras: (loras: ChatLoraSummary[]) => void;
-  setThreadRunning: (threadId: string, running: boolean) => void;
+  /**
+     * `local` defaults to true, so an unqualified caller still counts for the model-swap gate.
+     * `owner` narrows the clear to the run that set the flag: unresolved thread ids share the
+     * "__default" key, so a blind delete would drop a sibling's live entry. Owners accumulate,
+     * so the flag survives until the last one clears.
+     */
+  setThreadRunning: (
+    threadId: string,
+    running: boolean,
+    options?: { local?: boolean; owner?: () => void },
+  ) => void;
+  /**
+     * Re-key a first turn's run handles once its thread is persisted.
+     *
+     * A run that starts before its id exists files everything under "__default". Nothing moved it
+     * afterwards, so once the user navigated away the sidebar found no run and showed no spinner;
+     * stopChatThread had no handle either and the generation carried on holding a slot.
+     */
+  adoptDefaultThreadRun: (threadId: string) => void;
+  /**
+     * Which key this run's handles live under now. `adoptDefaultThreadRun` re-keys them mid-run,
+     * so a run that started under "__default" must look its owner up instead of reusing the key
+     * it captured, or its writes and its final clear miss the entries.
+     */
+  runKeyForOwner: (fallbackKey: string, owner: () => void) => string;
   registerThreadCancel: (threadId: string, cancel: () => void) => void;
   clearThreadCancel: (threadId: string) => void;
+  registerThreadServerCancel: (threadId: string, cancel: () => void) => void;
+  clearThreadServerCancel: (threadId: string, cancel?: () => void) => void;
   setAutoTitle: (enabled: boolean) => void;
   setHfToken: (token: string) => void;
   setModelsError: (error: string | null) => void;
@@ -1074,7 +1153,15 @@ type ChatRuntimeStore = {
   setRagAutoInjectMinScore: (score: number) => void;
   setRagOcrScanned: (enabled: boolean) => void;
   setRagCaptionFigures: (enabled: boolean) => void;
-  setToolStatus: (status: string | null) => void;
+  /**
+     * `owner` is the run's identity token, as for `setThreadRunning`: unresolved threads share
+     * "__default", so without it one run's cleanup clears a concurrent run's status.
+     */
+  setToolStatus: (
+    threadId: string,
+    status: string | null,
+    owner?: () => void,
+  ) => void;
   appendToolLiveOutput: (toolCallId: string, text: string) => void;
   /** Clear one tool's live output, or all when no id is given. */
   clearToolLiveOutput: (toolCallId?: string) => void;
@@ -1083,7 +1170,13 @@ type ChatRuntimeStore = {
   /** Drop a stale preserved full output (a new run is reusing the id). */
   clearToolFullOutput: (toolCallId: string) => void;
   setGeneratingStatus: (status: string | null) => void;
-  setActiveDiffusionCanvas: (canvas: DiffusionCanvasFrame | null) => void;
+  setActiveDiffusionCanvas: (
+    threadId: string | null,
+    canvas: DiffusionCanvasFrame,
+  ) => void;
+  /** Drop only `threadId`'s canvas: a run ending in a background chat must not wipe the
+     * frame another chat is still painting. */
+  clearActiveDiffusionCanvasForThread: (threadId: string | null) => void;
   setAutoHealToolCalls: (enabled: boolean) => void;
   setNudgeToolCalls: (enabled: boolean) => void;
   setMaxToolCallsPerMessage: (value: number) => void;
@@ -1103,6 +1196,11 @@ type ChatRuntimeStore = {
   ) => void;
   clearPendingImageEditReference: () => void;
   setContextUsage: (usage: ChatRuntimeStore["contextUsage"]) => void;
+  /** A finished run's usage, kept per thread so switching back re-applies it. */
+  setThreadContextUsage: (
+    threadId: string,
+    usage: ContextUsageSnapshot,
+  ) => void;
 };
 
 type PersistedChatSettings = Awaited<
@@ -1318,7 +1416,10 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
   models: [],
   loras: [],
   runningByThreadId: {},
+  localRunByThreadId: {},
+  runOwnerByThreadId: {},
   cancelByThreadId: {},
+  serverCancelByThreadId: {},
   autoTitle: false,
   hfToken: useHfTokenStore.getState().token,
   modelsError: null,
@@ -1382,11 +1483,11 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
   ),
   ragOcrScanned: loadBool(CHAT_RAG_OCR_KEY, DEFAULT_RAG_OCR),
   ragCaptionFigures: loadBool(CHAT_RAG_CAPTION_KEY, DEFAULT_RAG_CAPTION),
-  toolStatus: null,
+  toolStatusByThreadId: {},
   toolLiveOutput: {},
   toolFullOutput: {},
   generatingStatus: null,
-  activeDiffusionCanvas: null,
+  activeDiffusionCanvasByThreadId: {},
   autoHealToolCalls: true,
   nudgeToolCalls: true,
   maxToolCallsPerMessage: 25,
@@ -1433,6 +1534,7 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
   pendingAudioName: null,
   pendingImageEditReference: null,
   contextUsage: null,
+  contextUsageByThreadId: {},
   modelLoading: false,
   loadingModelPick: null,
   activeNativePathToken: null,
@@ -1505,7 +1607,9 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       const checkpointChanged = state.params.checkpoint !== params.checkpoint;
       return {
         params,
-        ...(checkpointChanged ? { contextUsage: null } : {}),
+        ...(checkpointChanged
+          ? { contextUsage: null, contextUsageByThreadId: {} }
+          : {}),
       };
     }),
   setCustomPresets: (customPresets) =>
@@ -1528,16 +1632,94 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
     }),
   setModels: (models) => set({ models }),
   setLoras: (loras) => set({ loras }),
-  setThreadRunning: (threadId, running) =>
+  setThreadRunning: (threadId, running, options) =>
     set((state) => {
       const next = { ...state.runningByThreadId };
+      const nextLocal = { ...state.localRunByThreadId };
+      const nextOwner = { ...state.runOwnerByThreadId };
+      const owners = state.runOwnerByThreadId[threadId] ?? [];
+      const local = options?.local !== false;
       if (running) {
         next[threadId] = true;
+        if (options?.owner) {
+          nextOwner[threadId] = [...owners, { owner: options.owner, local }];
+        }
+        // Any local owner keeps the key counted by the model-swap gate, so an external run
+        // joining a shared key must not clear a sibling's flag.
+        if (local) {
+          nextLocal[threadId] = true;
+        } else if (!owners.some((o) => o.local)) {
+          delete nextLocal[threadId];
+        }
       } else {
-        delete next[threadId];
+        const remaining = options?.owner
+          ? owners.filter((o) => o.owner !== options.owner)
+          : [];
+        // An owner missing from the list was already cleared, or the key belongs to siblings
+        // only: either way this run must change nothing.
+        if (options?.owner && remaining.length === owners.length) return state;
+        // An ownerless clear predates per-run tracking, so it must not speak for runs that
+        // own the key: leave them to clear themselves.
+        if (!options?.owner && owners.length > 0) return state;
+        if (remaining.length > 0) {
+          nextOwner[threadId] = remaining;
+          if (remaining.some((o) => o.local)) {
+            nextLocal[threadId] = true;
+          } else {
+            delete nextLocal[threadId];
+          }
+        } else {
+          delete next[threadId];
+          delete nextLocal[threadId];
+          delete nextOwner[threadId];
+        }
       }
-      return { runningByThreadId: next };
+      return {
+        runningByThreadId: next,
+        localRunByThreadId: nextLocal,
+        runOwnerByThreadId: nextOwner,
+      };
     }),
+  adoptDefaultThreadRun: (threadId) =>
+    set((state) => {
+      const key = "__default";
+      if (!threadId || threadId === key) return state;
+      // Two first turns can share "__default", and nothing links a run there to the thread being
+      // persisted. Moving the arrays wholesale handed this thread the sibling's owner and stop
+      // handle too, so stopping one aborted both. Adopt only when the key holds a single run.
+      if ((state.runOwnerByThreadId[key]?.length ?? 0) > 1) return state;
+      // Only the transient run maps move. Anything already filed under the real id wins,
+      // since that is a later, better-identified run.
+      const moved: Partial<ChatRuntimeStore> = {};
+      const move = <T,>(
+        map: Record<string, T>,
+        name: keyof ChatRuntimeStore,
+      ) => {
+        const entry = map[key];
+        if (entry === undefined || map[threadId] !== undefined) return;
+        const next = { ...map };
+        delete next[key];
+        next[threadId] = entry;
+        (moved as Record<string, unknown>)[name as string] = next;
+      };
+      move(state.runningByThreadId, "runningByThreadId");
+      move(state.localRunByThreadId, "localRunByThreadId");
+      move(state.runOwnerByThreadId, "runOwnerByThreadId");
+      move(state.cancelByThreadId, "cancelByThreadId");
+      move(state.serverCancelByThreadId, "serverCancelByThreadId");
+      move(state.toolStatusByThreadId, "toolStatusByThreadId");
+      move(
+        state.activeDiffusionCanvasByThreadId,
+        "activeDiffusionCanvasByThreadId",
+      );
+      return Object.keys(moved).length > 0 ? moved : state;
+    }),
+  runKeyForOwner: (fallbackKey, owner) => {
+    for (const [key, entries] of Object.entries(get().runOwnerByThreadId)) {
+      if (entries.some((e) => e.owner === owner)) return key;
+    }
+    return fallbackKey;
+  },
   registerThreadCancel: (threadId, cancel) =>
     set((state) => {
       const next = { ...state.cancelByThreadId };
@@ -1551,6 +1733,29 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       delete next[threadId];
       return { cancelByThreadId: next };
     }),
+  registerThreadServerCancel: (threadId, cancel) =>
+    set((state) => {
+      const next = { ...state.serverCancelByThreadId };
+      next[threadId] = [...(state.serverCancelByThreadId[threadId] ?? []), cancel];
+      return { serverCancelByThreadId: next };
+    }),
+  // `cancel` narrows removal to the run that registered it: unresolved thread ids share the
+  // "__default" key, so a blind delete would drop a live sibling.
+  clearThreadServerCancel: (threadId, cancel) =>
+    set((state) => {
+      const current = state.serverCancelByThreadId[threadId];
+      if (current === undefined) return state;
+      const remaining =
+        cancel === undefined ? [] : current.filter((c) => c !== cancel);
+      if (remaining.length === current.length) return state;
+      const next = { ...state.serverCancelByThreadId };
+      if (remaining.length > 0) {
+        next[threadId] = remaining;
+      } else {
+        delete next[threadId];
+      }
+      return { serverCancelByThreadId: next };
+    }),
   setAutoTitle: (autoTitle) =>
     set((state) => {
       setScalarSettingVersion("autoTitle", autoTitle, state.autoTitle);
@@ -1598,14 +1803,24 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
           maxTokens: nextMaxTokens,
         },
         activeGgufVariant: ggufVariant ?? null,
-        ...(checkpointChanged ? { contextUsage: null } : {}),
+        ...(checkpointChanged
+          ? { contextUsage: null, contextUsageByThreadId: {} }
+          : {}),
         // Switching to an external provider disables Deep Research, which only
         // applies to the local base model.
         ...(isExternalModelId(modelId) ? { deepResearchEnabled: false } : {}),
       };
     }),
+  // Re-apply the incoming thread's own usage rather than blanking the bar: a run that finished
+  // in the background never wrote the visible value, and a still-mounted runtime skips the
+  // history loader on the way back.
   setActiveThreadId: (activeThreadId) =>
-    set({ activeThreadId, contextUsage: null }),
+    set((state) => ({
+      activeThreadId,
+      contextUsage: activeThreadId
+        ? (state.contextUsageByThreadId[activeThreadId] ?? null)
+        : null,
+    })),
   setActiveProjectId: (activeProjectId) => set({ activeProjectId }),
   setIncognito: (incognito) => {
     if (incognito) saveBool(CHAT_DEEP_RESEARCH_ENABLED_KEY, false);
@@ -1636,6 +1851,7 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       ggufNativeContextLength: null,
       modelRequiresTrustRemoteCode: false,
       contextUsage: null,
+      contextUsageByThreadId: {},
       supportsReasoning: false,
       reasoningAlwaysOn: false,
       reasoningEnabled: true,
@@ -1657,10 +1873,10 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       webFetchToolsEnabled: false,
       // Only the per-session enable pill resets; source/mode/top_k persist.
       ragEnabled: false,
-      toolStatus: null,
+      toolStatusByThreadId: {},
       toolLiveOutput: {},
       toolFullOutput: {},
-      activeDiffusionCanvas: null,
+      activeDiffusionCanvasByThreadId: {},
       kvCacheDtype: null,
       loadedKvCacheDtype: null,
       speculativeType: readPersistedSpeculativeType(),
@@ -1957,7 +2173,31 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       saveBool(CHAT_RAG_CAPTION_KEY, ragCaptionFigures);
       return { ragCaptionFigures };
     }),
-  setToolStatus: (toolStatus) => set({ toolStatus }),
+  setToolStatus: (threadId, status, owner) =>
+    set((state) => {
+      const next = { ...state.toolStatusByThreadId };
+      const entries = state.toolStatusByThreadId[threadId] ?? [];
+      const mine = entries.find((e) => e.owner === owner);
+      if (!status) {
+        // Drop only this run's entry: a sibling behind the same key may still be running a tool,
+        // and its status has to survive this clear.
+        if (mine === undefined) return state;
+        const rest = entries.filter((e) => e !== mine);
+        if (rest.length > 0) {
+          next[threadId] = rest;
+        } else {
+          delete next[threadId];
+        }
+      } else {
+        // Same text from the same run means the same call, so keep startedAt: only a new tool restarts it.
+        if (mine?.status === status) return state;
+        const entry = { status, startedAt: Date.now(), owner };
+        next[threadId] = mine
+          ? entries.map((e) => (e === mine ? entry : e))
+          : [...entries, entry];
+      }
+      return { toolStatusByThreadId: next };
+    }),
   appendToolLiveOutput: (toolCallId, text) =>
     set((state) => ({
       toolLiveOutput: {
@@ -1995,8 +2235,21 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
       delete next[toolCallId];
       return { toolLiveOutput: next };
     }),
-  setActiveDiffusionCanvas: (activeDiffusionCanvas) =>
-    set({ activeDiffusionCanvas }),
+  setActiveDiffusionCanvas: (threadId, canvas) =>
+    set((state) => ({
+      activeDiffusionCanvasByThreadId: {
+        ...state.activeDiffusionCanvasByThreadId,
+        [threadId || "__default"]: canvas,
+      },
+    })),
+  clearActiveDiffusionCanvasForThread: (threadId) =>
+    set((state) => {
+      const key = threadId || "__default";
+      if (state.activeDiffusionCanvasByThreadId[key] === undefined) return state;
+      const next = { ...state.activeDiffusionCanvasByThreadId };
+      delete next[key];
+      return { activeDiffusionCanvasByThreadId: next };
+    }),
   setGeneratingStatus: (generatingStatus) => set({ generatingStatus }),
   setAutoHealToolCalls: (autoHealToolCalls) =>
     set((state) => {
@@ -2062,7 +2315,27 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
     set({ pendingImageEditReference }),
   clearPendingImageEditReference: () =>
     set({ pendingImageEditReference: null }),
-  setContextUsage: (contextUsage) => set({ contextUsage }),
+  // Write through to the visible thread's own entry, so a value restored by the history loader
+  // survives a switch away and back: that loader runs once per mount and setActiveThreadId
+  // reads the map, so without this the bar goes blank on return.
+  setContextUsage: (contextUsage) =>
+    set((state) => {
+      if (!state.activeThreadId) return { contextUsage };
+      const next = { ...state.contextUsageByThreadId };
+      if (contextUsage) {
+        next[state.activeThreadId] = contextUsage;
+      } else {
+        delete next[state.activeThreadId];
+      }
+      return { contextUsage, contextUsageByThreadId: next };
+    }),
+  setThreadContextUsage: (threadId, usage) =>
+    set((state) => ({
+      contextUsageByThreadId: {
+        ...state.contextUsageByThreadId,
+        [threadId]: usage,
+      },
+    })),
 }));
 
 // Mirror token edits made through the shared store (e.g. Unsloth's field).
diff --git a/studio/frontend/src/features/chat/stores/stop-running-chats-dialog-store.ts b/studio/frontend/src/features/chat/stores/stop-running-chats-dialog-store.ts
new file mode 100644
index 0000000000..01ccc76f43
--- /dev/null
+++ b/studio/frontend/src/features/chat/stores/stop-running-chats-dialog-store.ts
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { create } from "zustand";
+
+type Resolver = (confirmed: boolean) => void;
+
+/** What confirming does to the model: reload it, or leave none loaded. */
+export type StopRunningChatsEffect = "reload" | "unload";
+
+// One at a time: a new request declines any pending one so no promise leaks.
+let pendingResolver: Resolver | null = null;
+
+interface StopRunningChatsDialogStore {
+  open: boolean;
+  /** How many conversations the pending action would stop. */
+  count: number;
+  /** Titles of those conversations, when known, for the dialog body. */
+  titles: string[];
+  /** What the user is about to do, e.g. "Loading a different model". */
+  action: string;
+  /** The set includes an embeddings/completions/audio request, which is not a chat. */
+  hasNonChat: boolean;
+  /** Ejecting leaves no model loaded, so it must not be described as a reload. */
+  effect: StopRunningChatsEffect;
+  requestConfirm: (args: {
+    count: number;
+    titles?: string[];
+    action?: string;
+    hasNonChat?: boolean;
+    effect?: StopRunningChatsEffect;
+  }) => Promise<boolean>;
+  resolve: (confirmed: boolean) => void;
+}
+
+export const useStopRunningChatsDialogStore =
+  create<StopRunningChatsDialogStore>()((set) => ({
+    open: false,
+    count: 0,
+    titles: [],
+    action: "",
+    hasNonChat: false,
+    effect: "reload",
+    requestConfirm: ({
+      count,
+      titles = [],
+      action = "",
+      hasNonChat = false,
+      effect = "reload",
+    }) =>
+      new Promise<boolean>((resolve) => {
+        pendingResolver?.(false);
+        pendingResolver = resolve;
+        set({ open: true, count, titles, action, hasNonChat, effect });
+      }),
+    resolve: (confirmed) => {
+      const resolver = pendingResolver;
+      pendingResolver = null;
+      set({
+        open: false,
+        count: 0,
+        titles: [],
+        action: "",
+        hasNonChat: false,
+        effect: "reload",
+      });
+      resolver?.(confirmed);
+    },
+  }));
diff --git a/studio/frontend/src/features/chat/tool-approval.ts b/studio/frontend/src/features/chat/tool-approval.ts
new file mode 100644
index 0000000000..b1908dacc0
--- /dev/null
+++ b/studio/frontend/src/features/chat/tool-approval.ts
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"use client";
+
+import { useChatRuntimeStore } from "./stores/chat-runtime-store";
+
+/**
+ * True while this card's call is parked on the Allow / Deny prompt, so it can say it is
+ * waiting rather than counting up "Running". Set when the backend gates the call.
+ */
+export function useToolAwaitingApproval(toolCallId?: string): boolean {
+  return useChatRuntimeStore(
+    (s) =>
+      !!toolCallId &&
+      Object.prototype.hasOwnProperty.call(s.toolConfirmations, toolCallId),
+  );
+}
diff --git a/studio/frontend/src/features/chat/tool-output-scope.ts b/studio/frontend/src/features/chat/tool-output-scope.ts
index a7885a3916..abf8163431 100644
--- a/studio/frontend/src/features/chat/tool-output-scope.ts
+++ b/studio/frontend/src/features/chat/tool-output-scope.ts
@@ -3,6 +3,7 @@
 
 "use client";
 
+import { useAuiState } from "@assistant-ui/react";
 import { createContext, useContext } from "react";
 import type { ModelType } from "./types";
 
@@ -20,10 +21,58 @@ export function toolPaneScope(modelType?: ModelType, pairId?: string): string {
   return `${modelType ?? "base"}\u0000${pairId ?? ""}`;
 }
 
+/**
+ * Narrow a pane scope to one conversation: two threads in a pane can both be mid "call_0",
+ * so without the thread in the key they share a store entry and swap outputs.
+ */
+export function toolThreadScope(paneScope: string, threadId?: string): string {
+  return `${paneScope}\u0000${threadId ?? ""}`;
+}
+
 export const ToolPaneScopeContext = createContext<string>(toolPaneScope());
 
+/**
+ * Store-key scope for the conversation this component renders in, taken from the surrounding
+ * runtime so reader and writer agree without a prop.
+ *
+ * `remoteId`, not `id`: the adapter gets `unstable_threadId`, which assistant-ui sources from
+ * `remoteId`, and an uninitialized thread has `id` but no `remoteId`. Reading `id` split the
+ * keys apart for the first turn of every New Chat, so live tool output never reached the card.
+ */
 export function useToolPaneScope(): string {
-  return useContext(ToolPaneScopeContext);
+  const paneScope = useContext(ToolPaneScopeContext);
+  const threadId = useAuiState(({ threadListItem }) => threadListItem.remoteId);
+  return toolThreadScope(paneScope, threadId);
+}
+
+/**
+ * Read a tool-output map for one call, tolerating a run that started before its thread had an id.
+ *
+ * The adapter captures its scope once at run start, so a first turn writes under the unresolved
+ * scope for its whole life. The autosave can assign `remoteId` mid-run, which moves this
+ * component's key but not the writer's, and the card went blank. Falling back to the pane-wide
+ * scope keeps those entries reachable; only an unpersisted first turn can be filed there.
+ */
+/** The scope a run that started before its thread had an id writes under. */
+export function useUnresolvedToolPaneScope(): string {
+  return toolThreadScope(useContext(ToolPaneScopeContext), undefined);
+}
+
+export function useToolOutputFor(
+  map: Record<string, string>,
+  paneScope: string,
+  toolCallId: string,
+): string {
+  // Unconditional: hooks cannot sit behind the early return below.
+  const unresolvedScope = useUnresolvedToolPaneScope();
+  // Only a thread mid-run can be the one that just gained its id. Local ids repeat
+  // ("call_0"), so an unconditional fallback showed a live first turn's stdout in every
+  // older conversation whose own entry had been cleared.
+  const isRunning = useAuiState(({ thread }) => thread.isRunning);
+  const own = map[toolOutputKey(paneScope, toolCallId)];
+  if (own !== undefined) return own;
+  if (!isRunning) return "";
+  return map[toolOutputKey(unresolvedScope, toolCallId)] ?? "";
 }
 
 /** Store key for the live/full tool output maps: pane scope + tool call id. */
diff --git a/studio/frontend/src/features/chat/types/api.ts b/studio/frontend/src/features/chat/types/api.ts
index 4094eeb44d..e37f71fa1a 100644
--- a/studio/frontend/src/features/chat/types/api.ts
+++ b/studio/frontend/src/features/chat/types/api.ts
@@ -35,6 +35,11 @@ export interface ListLorasResponse {
 
 export interface LoadModelRequest {
   model_path: string;
+  /**
+     * Stop any chats still generating instead of getting a 409: a load replaces the single
+     * llama-server they all decode on. Set only after the user confirms.
+     */
+  force_cancel_active?: boolean;
   nativePathLease?: string | null;
   hf_token: string | null;
   max_seq_length: number;
@@ -213,6 +218,9 @@ export interface LoadModelResponse {
 
 export interface UnloadModelRequest {
   model_path: string;
+  /** Stop any chats still generating instead of getting a 409: the unload takes down the
+   * llama-server they all decode on. */
+  force_cancel_active?: boolean;
 }
 
 export interface InferenceStatusResponse {
@@ -309,6 +317,12 @@ export interface ApiMonitorEntry {
   completion_tokens?: number | null;
   total_tokens?: number | null;
   error?: string | null;
+  // "lifecycle" is a model load/unload/download: event/reason instead of a prompt.
+  kind?: "request" | "lifecycle";
+  event?: "load" | "unload" | "download" | null;
+  reason?: "manual" | "idle" | "api" | null;
+  // 0-100 while a download row is running.
+  progress?: number | null;
 }
 
 export interface ApiMonitorResponse {
diff --git a/studio/frontend/src/features/chat/utils/confirm-stop-running-chats.ts b/studio/frontend/src/features/chat/utils/confirm-stop-running-chats.ts
new file mode 100644
index 0000000000..7b20ceb362
--- /dev/null
+++ b/studio/frontend/src/features/chat/utils/confirm-stop-running-chats.ts
@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { getActiveGenerations } from "../api/chat-api";
+import { useChatRuntimeStore } from "../stores/chat-runtime-store";
+import {
+  type StopRunningChatsEffect,
+  useStopRunningChatsDialogStore,
+} from "../stores/stop-running-chats-dialog-store";
+import { listStoredChatThreads } from "./chat-history-storage";
+
+export interface StopRunningChatsDecision {
+  /** False when the user chose to keep generating; the caller must not load. */
+  proceed: boolean;
+  /** Pass as `force_cancel_active`. True only after an explicit confirmation, so the backend's 409 still guards every other caller. */
+  forceCancelActive: boolean;
+}
+
+/**
+ * Gate a model load / reload on the chats still generating: they share one llama-server,
+ * so a reload ends all of them. Ask first, then let the backend cancel them once the load
+ * is past preflight. External-provider chats are left out of both.
+ */
+export async function confirmStopRunningChatsIfNeeded(
+  action = "Loading a different model",
+  effect: StopRunningChatsEffect = "reload",
+): Promise<StopRunningChatsDecision> {
+  // Local runs only: an external-provider chat is not stopped by the swap, so counting it
+  // would block a safe load behind a dialog. The backend excludes them for the same reason.
+  const { runningByThreadId, localRunByThreadId } =
+    useChatRuntimeStore.getState();
+  let running = Object.entries(runningByThreadId)
+    .filter(([threadId, on]) => on && localRunByThreadId[threadId])
+    .map(([threadId]) => threadId);
+  let count = running.length;
+  let hasNonChat = false;
+
+  // Always merge the backend snapshot: runningByThreadId is this tab's memory, empty after a
+  // reload and blind to a second tab, while force_cancel_active cancels every backend run.
+  // The union stays local-only, since external-provider runs are never in it.
+  try {
+    const active = await getActiveGenerations();
+    const entries = active.active ?? [];
+    const merged = new Set(running);
+    for (const threadId of active.thread_ids ?? []) {
+      merged.add(threadId);
+    }
+    running = [...merged];
+    // Count conversations, not handles: one chat holds several at once while a tool
+    // continuation registers its next leg before the previous unwinds, and active.count
+    // counts those separately. A first turn started before its id was persisted has no
+    // id to merge, so add those back or the prompt names fewer chats than will stop.
+    const unnamed = entries.filter((entry) => !entry.thread_id).length;
+    count = entries.length
+      ? running.length + unnamed
+      : Math.max(active.count ?? 0, running.length);
+    // Embeddings / completions / audio share the model but are not conversations, so the
+    // prompt must not offer to stop chats that do not exist.
+    hasNonChat = entries.some((entry) => (entry.kind ?? "chat") !== "chat");
+  } catch {
+    // Backend unreachable / older build: fall back to the local map only.
+  }
+
+  if (count === 0) {
+    return { proceed: true, forceCancelActive: false };
+  }
+
+  let titles: string[] = [];
+  try {
+    const threads = await listStoredChatThreads();
+    const byId = new Map(threads.map((t) => [t.id, t]));
+    // A compare conversation runs two pane threads, and the sidebar and the route both treat
+    // it as one chat. Counting the raw ids asked to stop two and listed its title twice. Fold
+    // panes onto their pairId, keeping the backend's count when it is higher.
+    const seen = new Set<string>();
+    for (const id of running) {
+      const thread = byId.get(id);
+      const key = thread?.pairId ?? id;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      titles.push(thread?.title || "Untitled chat");
+    }
+    count = Math.max(seen.size, count - (running.length - seen.size));
+  } catch {
+    // Titles are decoration; the count alone is enough to make the choice.
+    titles = [];
+  }
+
+  const confirmed = await useStopRunningChatsDialogStore
+    .getState()
+    .requestConfirm({ count, titles, action, hasNonChat, effect });
+
+  if (!confirmed) {
+    return { proceed: false, forceCancelActive: false };
+  }
+
+  // Deliberately no local stop: the backend holds the cancel until the load clears preflight,
+  // so stopping now would truncate every chat even for a rejected load.
+  return { proceed: true, forceCancelActive: true };
+}
diff --git a/studio/frontend/src/features/chat/utils/prompt-queue-boundary.ts b/studio/frontend/src/features/chat/utils/prompt-queue-boundary.ts
index ac1d973bfe..8013917ec8 100644
--- a/studio/frontend/src/features/chat/utils/prompt-queue-boundary.ts
+++ b/studio/frontend/src/features/chat/utils/prompt-queue-boundary.ts
@@ -1,8 +1,17 @@
 export const PROMPT_QUEUE_STOP_EVENT = "unsloth:prompt-queue-stop";
 
-export function requestPromptQueueStop() {
+export interface PromptQueueStopOptions {
+  /** Also cancel the prompt the queue already dispatched. Navigation passes `false` to
+   * leave it generating; an explicit stop passes `true` (the default). */
+  cancelActiveRun?: boolean;
+}
+
+export function requestPromptQueueStop(options: PromptQueueStopOptions = {}) {
   if (typeof window === "undefined") {
     return;
   }
-  window.dispatchEvent(new Event(PROMPT_QUEUE_STOP_EVENT));
+  const { cancelActiveRun = true } = options;
+  window.dispatchEvent(
+    new CustomEvent(PROMPT_QUEUE_STOP_EVENT, { detail: { cancelActiveRun } }),
+  );
 }
diff --git a/studio/frontend/src/features/chat/utils/stop-chat-thread.ts b/studio/frontend/src/features/chat/utils/stop-chat-thread.ts
new file mode 100644
index 0000000000..ba0fac9aa9
--- /dev/null
+++ b/studio/frontend/src/features/chat/utils/stop-chat-thread.ts
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { useChatRuntimeStore } from "../stores/chat-runtime-store";
+
+/**
+ * Stop one conversation's generation, visible or not. Returns true if a stop was dispatched.
+ *
+ * `cancelByThreadId` is assistant-ui's `cancelRun()`, registered only for the thread on screen;
+ * `serverCancelByThreadId` is registered for every run and POSTs that run's own `cancel_id`, so
+ * it is the only handle a background conversation has. Both are per-run. Runs with an unresolved
+ * thread id share the "__default" key, so stop every handle filed under it.
+ */
+export function stopChatThread(threadId: string | null | undefined): boolean {
+  if (!threadId) return false;
+  const { runningByThreadId, cancelByThreadId, serverCancelByThreadId } =
+    useChatRuntimeStore.getState();
+  if (!runningByThreadId[threadId]) return false;
+  let stopped = false;
+  try {
+    const cancel = cancelByThreadId[threadId];
+    if (cancel) {
+      cancel();
+      stopped = true;
+    }
+  } catch {
+    // The run may have ended between the read above and this call.
+  }
+  // Also after cancelRun(): a proxy that swallows the fetch abort leaves the backend decoding.
+  for (const serverCancel of serverCancelByThreadId[threadId] ?? []) {
+    try {
+      serverCancel();
+      stopped = true;
+    } catch {
+      // Same as above.
+    }
+  }
+  return stopped;
+}
diff --git a/studio/frontend/src/features/recipe-studio/hooks/use-recipe-executions.ts b/studio/frontend/src/features/recipe-studio/hooks/use-recipe-executions.ts
index a067855fd5..bc4bc2a391 100644
--- a/studio/frontend/src/features/recipe-studio/hooks/use-recipe-executions.ts
+++ b/studio/frontend/src/features/recipe-studio/hooks/use-recipe-executions.ts
@@ -2,7 +2,7 @@
 // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
 
 import { getInferenceStatus, loadModel } from "@/features/chat";
-import { toast } from "@/lib/toast";
+import { createLoadingToastIcon, toast } from "@/lib/toast";
 import { toastError } from "@/shared/toast";
 import { useCallback, useEffect, useState } from "react";
 import { useShallow } from "zustand/react/shallow";
@@ -238,8 +238,15 @@ async function loadLocalModelSelection(
 ): Promise<string | null> {
   const { target, ggufVariant } = selection;
   const modelLabel = ggufVariant ? `${target} (${ggufVariant})` : target;
-  const toastId = toast.loading(`Loading ${modelLabel}...`, {
+  let loadToastDismissed = false;
+  const toastId = toast.message(`Loading ${modelLabel}...`, {
     description: "Starting the local inference server for this recipe.",
+    duration: Number.POSITIVE_INFINITY,
+    closeButton: true,
+    icon: createLoadingToastIcon(),
+    onDismiss: () => {
+      loadToastDismissed = true;
+    },
   });
   try {
     const isGguf = GGUF_MODEL_PATTERN.test(target) || Boolean(ggufVariant);
@@ -267,7 +274,16 @@ async function loadLocalModelSelection(
       // biome-ignore lint/style/useNamingConvention: api schema
       tensor_parallel: false,
     });
-    toast.success(`Loaded ${modelLabel}`, { id: toastId, duration: 2000 });
+    const successOptions = {
+      description: undefined,
+      duration: 2000,
+      icon: undefined,
+    };
+    if (loadToastDismissed) {
+      toast.success(`Loaded ${modelLabel}`, successOptions);
+    } else {
+      toast.success(`Loaded ${modelLabel}`, { ...successOptions, id: toastId });
+    }
     return null;
   } catch (error) {
     toast.dismiss(toastId);
diff --git a/studio/frontend/src/features/settings/api/openai-auto-switch.ts b/studio/frontend/src/features/settings/api/openai-auto-switch.ts
index 47bad56eab..a7e93aa68d 100644
--- a/studio/frontend/src/features/settings/api/openai-auto-switch.ts
+++ b/studio/frontend/src/features/settings/api/openai-auto-switch.ts
@@ -13,6 +13,8 @@ export type OpenAIAutoSwitchSettings = {
   idleUnloadActive: boolean;
   // Persist the KV cache to disk on idle unload and restore it on reload.
   autoUnloadKeepKv: boolean;
+  // Fetch a GGUF named in an API request; stored independently of `enabled`, gated on it.
+  autoDownloadModel: boolean;
 };
 
 type ApiOpenAIAutoSwitchSettings = {
@@ -25,6 +27,8 @@ type ApiOpenAIAutoSwitchSettings = {
   idle_unload_active?: boolean;
   // biome-ignore lint/style/useNamingConvention: API schema
   auto_unload_keep_kv?: boolean;
+  // biome-ignore lint/style/useNamingConvention: API schema
+  auto_download_model?: boolean;
 };
 
 let cachedSettings: OpenAIAutoSwitchSettings | null = null;
@@ -39,6 +43,7 @@ function fromApi(
     defaultEnabled: settings.default_enabled,
     idleUnloadActive: settings.idle_unload_active ?? false,
     autoUnloadKeepKv: settings.auto_unload_keep_kv ?? true,
+    autoDownloadModel: settings.auto_download_model ?? false,
   };
 }
 
@@ -73,6 +78,7 @@ export async function updateOpenAIAutoSwitchSettings(
   enabled: boolean,
   autoUnloadIdleSeconds?: number,
   autoUnloadKeepKv?: boolean,
+  autoDownloadModel?: boolean,
 ): Promise<OpenAIAutoSwitchSettings> {
   const res = await authFetch("/api/settings/openai-auto-switch", {
     method: "PUT",
@@ -88,6 +94,10 @@ export async function updateOpenAIAutoSwitchSettings(
         ? {}
         : // biome-ignore lint/style/useNamingConvention: API schema
           { auto_unload_keep_kv: autoUnloadKeepKv }),
+      ...(autoDownloadModel === undefined
+        ? {}
+        : // biome-ignore lint/style/useNamingConvention: API schema
+          { auto_download_model: autoDownloadModel }),
     }),
   });
   if (!res.ok) {
diff --git a/studio/frontend/src/features/settings/api/openai-models.ts b/studio/frontend/src/features/settings/api/openai-models.ts
new file mode 100644
index 0000000000..f7f858452a
--- /dev/null
+++ b/studio/frontend/src/features/settings/api/openai-models.ts
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+import { authFetch } from "@/features/auth";
+
+export type OpenAIModel = {
+  id: string;
+  // Resident in memory now; the rest are downloaded and servable.
+  loaded?: boolean;
+  // On-disk GGUF quant. Ids stay bare for OpenAI compat, so append `:quant` to pin it.
+  quant?: string;
+};
+
+type ApiOpenAIModelList = {
+  data?: { id?: unknown; loaded?: unknown; quant?: unknown }[];
+};
+
+/**
+ * The models this server can serve: `/v1/models` returns exactly the ids
+ * `/v1/chat/completions` resolves against, and accepts the UI session JWT.
+ */
+export async function listOpenAIModels(): Promise<OpenAIModel[]> {
+  const res = await authFetch("/v1/models");
+  if (!res.ok) {
+    throw new Error(`Failed to list models (${res.status})`);
+  }
+  const body = (await res.json()) as ApiOpenAIModelList;
+  if (!Array.isArray(body?.data)) {
+    return [];
+  }
+  return body.data.flatMap((entry) =>
+    typeof entry?.id === "string" && entry.id
+      ? [
+          {
+            id: entry.id,
+            loaded: entry.loaded === true,
+            quant: typeof entry.quant === "string" ? entry.quant : undefined,
+          },
+        ]
+      : [],
+  );
+}
diff --git a/studio/frontend/src/features/settings/components/api-monitor-console.tsx b/studio/frontend/src/features/settings/components/api-monitor-console.tsx
index 0f931ff4da..332cd4f2f9 100644
--- a/studio/frontend/src/features/settings/components/api-monitor-console.tsx
+++ b/studio/frontend/src/features/settings/components/api-monitor-console.tsx
@@ -7,6 +7,7 @@ import {
   ActivityIcon,
   ChevronDownIcon,
   CircleIcon,
+  PowerOffIcon,
   RefreshCwIcon,
 } from "lucide-react";
 import {
@@ -17,11 +18,19 @@ import {
   useRef,
   useState,
 } from "react";
-import { getApiMonitor, getApiMonitorEntry } from "../../chat/api/chat-api";
+import {
+  getApiMonitor,
+  getApiMonitorEntry,
+  getInferenceStatus,
+  unloadModel,
+} from "../../chat/api/chat-api";
+import { resolveInferenceCheckpointId } from "../../chat/lib/apply-inference-status-to-store";
+import { useChatRuntimeStore } from "../../chat/stores/chat-runtime-store";
 import type { ApiMonitorEntry, ApiMonitorResponse } from "../../chat/types/api";
 
 const API_INFERENCE_PREFIX_RE = /^\/api\/inference/;
 const V1_PREFIX_RE = /^\/v1\//;
+const PAGE_SIZE = 5;
 
 function formatTime(value: number): string {
   return new Date(value * 1000).toLocaleTimeString([], {
@@ -87,6 +96,65 @@ function UsageBar({ value }: { value?: number | null }): ReactElement | null {
   );
 }
 
+function isLifecycle(entry: ApiMonitorEntry): boolean {
+  return entry.kind === "lifecycle";
+}
+
+function lifecycleLabel(entry: ApiMonitorEntry): string {
+  if (entry.event === "unload") {
+    return entry.reason === "idle" ? "Model unloaded (idle)" : "Model unloaded";
+  }
+  if (entry.event === "download") {
+    if (entry.status === "running") {
+      const pct = entry.progress;
+      return typeof pct === "number"
+        ? `Downloading model (${Math.round(pct)}%)`
+        : "Downloading model";
+    }
+    if (entry.status === "completed") return "Model downloaded";
+    // A cancel is deliberate, so saying it failed misreads the user's own action.
+    return entry.status === "cancelled"
+      ? "Model download cancelled"
+      : "Model download failed";
+  }
+  if (entry.status === "running") {
+    return "Loading model";
+  }
+  if (entry.status === "completed") {
+    return "Model loaded";
+  }
+  return "Model load failed";
+}
+
+// Load/unload rows: label, model and time. No prompt or detail, so nothing to expand.
+function LifecycleEntry({ entry }: { entry: ApiMonitorEntry }): ReactElement {
+  return (
+    <article className="min-w-0 rounded-lg border border-border/70 bg-muted/25">
+      <div className="flex w-full min-w-0 items-start justify-between gap-3 p-3">
+        <div className="min-w-0">
+          <div className="flex min-w-0 items-center gap-2">
+            <ActivityIcon
+              className={cn("size-3.5 shrink-0", statusTone(entry.status))}
+            />
+            <span className="truncate text-xs font-medium">
+              {lifecycleLabel(entry)}
+            </span>
+          </div>
+          <div className="mt-1 truncate text-ui-11 text-muted-foreground">
+            {entry.model}
+          </div>
+        </div>
+        <div className="shrink-0 text-right text-ui-11 text-muted-foreground">
+          <div>{formatTime(entry.started_at)}</div>
+          {entry.event === "load" || entry.event === "download" ? (
+            <div>{formatDuration(entry.duration_ms)}</div>
+          ) : null}
+        </div>
+      </div>
+    </article>
+  );
+}
+
 function MonitorEntry({
   entry,
   detail,
@@ -191,6 +259,7 @@ export function ApiMonitorConsole(): ReactElement {
   const [data, setData] = useState<ApiMonitorResponse | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [refreshing, setRefreshing] = useState(false);
+  const [unloading, setUnloading] = useState(false);
   const [expandedIds, setExpandedIds] = useState<Set<string>>(() => new Set());
   const [details, setDetails] = useState<Record<string, ApiMonitorEntry>>({});
   const [loadingDetails, setLoadingDetails] = useState<Set<string>>(
@@ -211,6 +280,28 @@ export function ApiMonitorConsole(): ReactElement {
     }
   }, []);
 
+  // /unload matches on the internal id, which the monitor omits, so read it from status.
+  const unloadActiveModel = useCallback(async (): Promise<void> => {
+    setUnloading(true);
+    try {
+      const status = await getInferenceStatus();
+      const checkpoint = resolveInferenceCheckpointId(status);
+      if (!checkpoint) {
+        setError(null);
+        return;
+      }
+      await unloadModel({ model_path: checkpoint });
+      // Same as the chat eject flow: the store still holds the freed checkpoint.
+      useChatRuntimeStore.getState().clearCheckpoint();
+      setError(null);
+      await loadMonitor();
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : "Failed to unload the model");
+    } finally {
+      setUnloading(false);
+    }
+  }, [loadMonitor]);
+
   useEffect(() => {
     let cancelled = false;
     let timer: number | undefined;
@@ -253,6 +344,48 @@ export function ApiMonitorConsole(): ReactElement {
   const statusLabel = data?.status ?? "idle";
   const hasActive = (data?.active_requests ?? 0) > 0;
   const entries = useMemo(() => data?.entries ?? [], [data]);
+
+  // Page 1 tracks the live list; paging back freezes the id order so history holds still.
+  const [page, setPage] = useState(0);
+  const [frozenIds, setFrozenIds] = useState<string[] | null>(null);
+  const byId = useMemo(
+    () => new Map(entries.map((entry) => [entry.id, entry])),
+    [entries],
+  );
+  const ordered = useMemo(() => {
+    if (frozenIds === null) {
+      return entries;
+    }
+    return frozenIds.flatMap((id) => {
+      const entry = byId.get(id);
+      return entry ? [entry] : [];
+    });
+  }, [byId, entries, frozenIds]);
+  const pageCount = Math.max(1, Math.ceil(ordered.length / PAGE_SIZE));
+  const pageIndex = Math.min(page, pageCount - 1);
+  const visible = ordered.slice(
+    pageIndex * PAGE_SIZE,
+    pageIndex * PAGE_SIZE + PAGE_SIZE,
+  );
+  const newerCount =
+    frozenIds === null
+      ? 0
+      : entries.filter((entry) => !frozenIds.includes(entry.id)).length;
+
+  const goToPage = useCallback(
+    (next: number): void => {
+      if (next <= 0) {
+        setFrozenIds(null);
+        setPage(0);
+        return;
+      }
+      // Freeze on the way off page 1 so the history under the cursor holds still.
+      setFrozenIds((prev) => prev ?? entries.map((entry) => entry.id));
+      setPage(next);
+    },
+    [entries],
+  );
+
   const loadDetail = useCallback(
     (id: string): void => {
       if (loadingDetailsRef.current.has(id)) {
@@ -305,8 +438,9 @@ export function ApiMonitorConsole(): ReactElement {
   );
 
   useEffect(() => {
-    for (const entry of entries) {
-      if (!expandedIds.has(entry.id)) {
+    // Only rows on screen: an expanded row on another page would keep polling.
+    for (const entry of visible) {
+      if (isLifecycle(entry) || !expandedIds.has(entry.id)) {
         continue;
       }
       const cached = detailsRef.current[entry.id];
@@ -314,7 +448,7 @@ export function ApiMonitorConsole(): ReactElement {
         loadDetail(entry.id);
       }
     }
-  }, [entries, expandedIds, loadDetail]);
+  }, [visible, expandedIds, loadDetail]);
 
   return (
     <section className="flex min-w-0 flex-col rounded-lg border border-border/70 bg-background">
@@ -339,6 +473,22 @@ export function ApiMonitorConsole(): ReactElement {
           <div className="rounded-full border border-border px-2.5 py-1 text-xs capitalize text-muted-foreground">
             {statusLabel}
           </div>
+          {/* Always rendered, disabled when idle: the only manual release must stay visible. */}
+          <Button
+            type="button"
+            variant="ghost"
+            size="sm"
+            onClick={() => void unloadActiveModel()}
+            disabled={unloading || !data?.active_model}
+            title={
+              data?.active_model
+                ? "Unload the model and free its VRAM"
+                : "No model is loaded"
+            }
+          >
+            <PowerOffIcon className="size-3.5" />
+            {unloading ? "Unloading" : "Unload"}
+          </Button>
           <Button
             type="button"
             variant="ghost"
@@ -375,19 +525,54 @@ export function ApiMonitorConsole(): ReactElement {
           </div>
         ) : (
           <div className="grid gap-3">
-            {entries.map((entry) => (
-              <MonitorEntry
-                key={entry.id}
-                entry={entry}
-                detail={details[entry.id]}
-                expanded={expandedIds.has(entry.id)}
-                loading={loadingDetails.has(entry.id)}
-                onToggle={() => toggleEntry(entry)}
-              />
-            ))}
+            {visible.map((entry) =>
+              isLifecycle(entry) ? (
+                <LifecycleEntry key={entry.id} entry={entry} />
+              ) : (
+                <MonitorEntry
+                  key={entry.id}
+                  entry={entry}
+                  detail={details[entry.id]}
+                  expanded={expandedIds.has(entry.id)}
+                  loading={loadingDetails.has(entry.id)}
+                  onToggle={() => toggleEntry(entry)}
+                />
+              ),
+            )}
           </div>
         )}
       </div>
+
+      {/* Also while frozen: retention can shrink that list below one page, and hiding the
+          pager would strand the console on a stale snapshot. */}
+      {ordered.length > PAGE_SIZE || frozenIds !== null ? (
+        <div className="flex items-center justify-between gap-2 border-t border-border/60 px-4 py-2 text-xs text-muted-foreground">
+          <span>
+            Page {pageIndex + 1} of {pageCount}
+            {newerCount > 0 ? ` (${newerCount.toLocaleString()} new)` : ""}
+          </span>
+          <div className="flex items-center gap-1">
+            <Button
+              variant="ghost"
+              size="sm"
+              className="h-7 px-2 text-xs"
+              onClick={() => goToPage(pageIndex - 1)}
+              disabled={pageIndex === 0 && frozenIds === null}
+            >
+              Newer
+            </Button>
+            <Button
+              variant="ghost"
+              size="sm"
+              className="h-7 px-2 text-xs"
+              onClick={() => goToPage(pageIndex + 1)}
+              disabled={pageIndex >= pageCount - 1}
+            >
+              Older
+            </Button>
+          </div>
+        </div>
+      ) : null}
     </section>
   );
 }
diff --git a/studio/frontend/src/features/settings/components/model-auto-switch-section.tsx b/studio/frontend/src/features/settings/components/model-auto-switch-section.tsx
index aa6857cff5..6ebd12ce3c 100644
--- a/studio/frontend/src/features/settings/components/model-auto-switch-section.tsx
+++ b/studio/frontend/src/features/settings/components/model-auto-switch-section.tsx
@@ -65,6 +65,7 @@ export function ModelAutoSwitchSection() {
     idleSeconds: number | undefined,
     syncDraft = true,
     keepKv?: boolean,
+    autoDownload?: boolean,
   ) => {
     setIsSaving(true);
     setError(null);
@@ -73,6 +74,7 @@ export function ModelAutoSwitchSection() {
         enabled,
         idleSeconds,
         keepKv,
+        autoDownload,
       );
       setSettings(saved);
       if (syncDraft) {
@@ -117,6 +119,11 @@ export function ModelAutoSwitchSection() {
     void persist(settings.enabled, undefined, false, keepKv);
   };
 
+  const handleAutoDownloadToggle = (autoDownload: boolean) => {
+    if (!settings) return;
+    void persist(settings.enabled, undefined, false, undefined, autoDownload);
+  };
+
   return (
     <SettingsSection title={t("settings.general.modelAutoSwitch.sectionTitle")}>
       <SettingsRow
@@ -129,6 +136,18 @@ export function ModelAutoSwitchSection() {
           onCheckedChange={handleToggle}
         />
       </SettingsRow>
+      <SettingsRow
+        label={t("settings.general.modelAutoSwitch.autoDownload")}
+        description={t(
+          "settings.general.modelAutoSwitch.autoDownloadDescription",
+        )}
+      >
+        <Switch
+          checked={settings?.autoDownloadModel ?? false}
+          disabled={!settings?.enabled || isSaving}
+          onCheckedChange={handleAutoDownloadToggle}
+        />
+      </SettingsRow>
       <SettingsRow
         label={t("settings.general.modelAutoSwitch.idleUnload")}
         description={t(
diff --git a/studio/frontend/src/features/settings/components/usage-examples.tsx b/studio/frontend/src/features/settings/components/usage-examples.tsx
index bba4498551..846aa0380d 100644
--- a/studio/frontend/src/features/settings/components/usage-examples.tsx
+++ b/studio/frontend/src/features/settings/components/usage-examples.tsx
@@ -29,11 +29,8 @@ import { HugeiconsIcon } from "@hugeicons/react";
 import { useEffect, useMemo, useRef, useState } from "react";
 import { Streamdown } from "streamdown";
 import { loadCodingAgents } from "../api/coding-agents";
-import {
-  type OpenAIAutoSwitchSettings,
-  loadOpenAIAutoSwitchSettings,
-  updateOpenAIAutoSwitchSettings,
-} from "../api/openai-auto-switch";
+import { loadOpenAIAutoSwitchSettings } from "../api/openai-auto-switch";
+import { type OpenAIModel, listOpenAIModels } from "../api/openai-models";
 import { buildAgentCommand, isLoopbackHost, normalizeHost } from "./agent-command";
 
 type ExampleType =
@@ -89,14 +86,7 @@ const JAVASCRIPT_TYPES = new Set<ExampleType>([
   "javascriptAdvanced",
 ]);
 
-const PROMPT = "Can Unsloth Studio do API calling?";
-// Auto-switch demo: a second call naming a different downloaded GGUF so the
-// example shows that the model field selects which model serves.
-// A placeholder the user replaces with one of their downloaded GGUFs. A fixed
-// repo is usually not one they have, so the resolver would fall through and the
-// demo would keep serving the current model instead of switching.
-const SWITCH_MODEL = "your-other-downloaded-GGUF";
-const SWITCH_PROMPT = "Now answer as a different model.";
+const PROMPT = "What is Unsloth Studio?";
 // web_search + python + terminal are the reliable built-in tools.
 const TOOLS = ["web_search", "python", "terminal"];
 const ADV = {
@@ -196,19 +186,13 @@ function winBody(model: string, variant: Variant): string {
   return JSON.stringify(body, null, 2);
 }
 
-// A leading comment (valid in both bash and PowerShell) noting the model field
-// selects the served model when auto-switch is on.
-const SWITCH_NOTE =
-  '# "Switch model by request" is on: set "model" to any downloaded GGUF to switch.\n';
-
 function curlUnix(
   base: string,
   key: string,
   model: string,
   variant: Variant,
-  autoSwitch: boolean,
 ): string {
-  return `${autoSwitch ? SWITCH_NOTE : ""}curl ${base}/v1/chat/completions \\
+  return `curl ${base}/v1/chat/completions \\
   -H "Authorization: Bearer ${key}" \\
   -H "Content-Type: application/json" \\
   -d '${shSingle(curlBodyPretty(model, variant))}'`;
@@ -219,9 +203,8 @@ function curlWindows(
   key: string,
   model: string,
   variant: Variant,
-  autoSwitch: boolean,
 ): string {
-  return `${autoSwitch ? SWITCH_NOTE : ""}$body = '${psSingle(winBody(model, variant))}'
+  return `$body = '${psSingle(winBody(model, variant))}'
 Set-Content -Path body.json -Value $body -Encoding ascii
 curl.exe ${base}/v1/chat/completions \`
   -H "Authorization: Bearer ${key}" \`
@@ -229,29 +212,11 @@ curl.exe ${base}/v1/chat/completions \`
   -d "@body.json"`;
 }
 
-// A second OpenAI call naming a different downloaded GGUF: with auto-switch on,
-// Unsloth loads it before serving, so the model field selects the served model.
-function pythonSwitchDemo(): string {
-  return `
-
-# "Switch model by request" is on: replace the model below with another GGUF you
-# have downloaded and Unsloth loads it before serving. Unknown names keep serving
-# the current model.
-response = client.chat.completions.create(
-    model=${j(SWITCH_MODEL)},
-    messages=[{"role": "user", "content": ${j(SWITCH_PROMPT)}}],
-    stream=True,
-)
-for chunk in response:
-    print(chunk.choices[0].delta.content or "", end="")`;
-}
-
 function pythonSnippet(
   base: string,
   key: string,
   model: string,
   variant: Variant,
-  autoSwitch: boolean,
 ): string {
   const named =
     variant === "advanced"
@@ -296,7 +261,7 @@ response = client.chat.completions.create(
     messages=[{"role": "user", "content": ${j(PROMPT)}}],${named}${extraBody}
     stream=True,
 )
-${loop}${autoSwitch ? pythonSwitchDemo() : ""}`;
+${loop}`;
 }
 
 function javascriptSnippet(
@@ -304,7 +269,6 @@ function javascriptSnippet(
   key: string,
   model: string,
   variant: Variant,
-  autoSwitch: boolean,
 ): string {
   const options: string[] = [];
   if (variant === "advanced") {
@@ -343,23 +307,6 @@ const response = await client.chat.completions.create({
 
 for await (const chunk of response) {
   process.stdout.write(chunk.choices?.[0]?.delta?.content || "");
-}${autoSwitch ? javascriptSwitchDemo() : ""}`;
-}
-
-function javascriptSwitchDemo(): string {
-  return `
-
-// "Switch model by request" is on: replace the model below with another GGUF you
-// have downloaded and Unsloth loads it before serving. Unknown names keep serving
-// the current model.
-const switchResponse = await client.chat.completions.create({
-  model: ${j(SWITCH_MODEL)},
-  messages: [{ role: "user", content: ${j(SWITCH_PROMPT)} }],
-  stream: true,
-});
-
-for await (const chunk of switchResponse) {
-  process.stdout.write(chunk.choices?.[0]?.delta?.content || "");
 }`;
 }
 
@@ -368,31 +315,28 @@ function buildSnippets(
   key: string,
   model: string,
   os: Os,
-  autoSwitch: boolean,
 ): Record<ExampleType, string> {
   const curl = os === "windows" ? curlWindows : curlUnix;
   return {
-    curl: curl(base, key, model, "plain", autoSwitch),
-    python: pythonSnippet(base, key, model, "plain", autoSwitch),
-    javascript: javascriptSnippet(base, key, model, "plain", autoSwitch),
-    curlTools: curl(base, key, model, "tools", autoSwitch),
-    pythonTools: pythonSnippet(base, key, model, "tools", autoSwitch),
-    javascriptTools: javascriptSnippet(base, key, model, "tools", autoSwitch),
-    curlAdvanced: curl(base, key, model, "advanced", autoSwitch),
-    pythonAdvanced: pythonSnippet(base, key, model, "advanced", autoSwitch),
-    javascriptAdvanced: javascriptSnippet(
-      base,
-      key,
-      model,
-      "advanced",
-      autoSwitch,
-    ),
+    curl: curl(base, key, model, "plain"),
+    python: pythonSnippet(base, key, model, "plain"),
+    javascript: javascriptSnippet(base, key, model, "plain"),
+    curlTools: curl(base, key, model, "tools"),
+    pythonTools: pythonSnippet(base, key, model, "tools"),
+    javascriptTools: javascriptSnippet(base, key, model, "tools"),
+    curlAdvanced: curl(base, key, model, "advanced"),
+    pythonAdvanced: pythonSnippet(base, key, model, "advanced"),
+    javascriptAdvanced: javascriptSnippet(base, key, model, "advanced"),
   };
 }
 
 const KEY_PLACEHOLDER = "sk-unsloth-YOUR_KEY";
-const MODEL_FALLBACK = "unsloth/gemma-4-E4B-it-GGUF:UD-Q5_K_XL";
 const USE_TUNNEL_KEY = "unsloth_api_use_tunnel";
+// Slow retry while /v1 has nothing to name: a download or load moves no store state.
+const CATALOG_RETRY_MS = 15000;
+// Slower beat once something is servable: an idle unload frees a model without
+// touching the store, so residency is never settled for good.
+const CATALOG_IDLE_MS = 60000;
 
 function readUseTunnelPref(): boolean {
   if (typeof window === "undefined") return true;
@@ -412,18 +356,111 @@ function writeUseTunnelPref(value: boolean): void {
   }
 }
 
-function useLoadedModelName(): string {
+// A checkpoint can be an on-disk load path, which /v1 never advertises. Mirrors _looks_like_path.
+function looksLikePath(id: string): boolean {
+  return (
+    id.startsWith("/") ||
+    id.startsWith("~") ||
+    id.startsWith(".") ||
+    id.includes("\\") ||
+    id.toLowerCase().endsWith(".gguf") ||
+    (id.match(/\//g)?.length ?? 0) >= 2
+  );
+}
+
+// Same model, ignoring any ":quant" a caller pinned.
+function sameBaseModelId(a: string, b: string): boolean {
+  const base = (id: string) => id.trim().toLowerCase().split(":")[0];
+  return a.trim().toLowerCase() === b.trim().toLowerCase() || base(a) === base(b);
+}
+
+// The model the examples name: always an id /v1 resolves against, null when there is none.
+function useExampleModelName(): string | null {
   const checkpoint = useChatRuntimeStore((s) => s.params.checkpoint);
   const ggufVariant = useChatRuntimeStore((s) => s.activeGgufVariant);
-  return useMemo(() => {
-    if (!checkpoint || checkpoint.startsWith("external::")) {
-      return MODEL_FALLBACK;
-    }
-    if (ggufVariant && !checkpoint.includes(":")) {
-      return `${checkpoint}:${ggufVariant}`;
-    }
-    return checkpoint;
+  // null until /v1/models answers: "not asked yet" must not read as "holds nothing".
+  const [catalog, setCatalog] = useState<OpenAIModel[] | null>(null);
+  // A downloaded but unloaded model is only runnable when switching is on.
+  const [autoSwitch, setAutoSwitch] = useState(false);
+  // Idle-unload on its own (UNSLOTH_MODEL_IDLE_TTL, switching off) reloads exactly
+  // what it freed: the stored checkpoint only, never an arbitrary catalog entry.
+  const [idleReload, setIdleReload] = useState(false);
+  const usableCheckpoint =
+    !!checkpoint && !checkpoint.startsWith("external::") && !looksLikePath(checkpoint);
+
+  // Always: a stored checkpoint can stop being servable without the store changing.
+  // biome-ignore lint/correctness/useExhaustiveDependencies: a load or unload must refetch the servable ids
+  useEffect(() => {
+    let cancelled = false;
+    let timeoutId: number | null = null;
+
+    const update = () => {
+      // null on failure, never [] or false: a transient error is no evidence that the
+      // server holds nothing, and those negatives blanked every example while the
+      // model was still servable. Keep the last answer and retry.
+      void Promise.all([
+        listOpenAIModels().catch(() => null),
+        loadOpenAIAutoSwitchSettings()
+          .then((s) => [s.enabled, s.idleUnloadActive] as const)
+          .catch(() => null),
+      ])
+        .then(([models, settings]) => {
+          if (cancelled) return true;
+          if (models !== null) setCatalog(models);
+          if (settings !== null) {
+            setAutoSwitch(settings[0]);
+            setIdleReload(settings[1]);
+          }
+          // Resident only slows the polling; it never stops it.
+          return models !== null && models.some((m) => m.loaded);
+        })
+        .then((resolved) => {
+          if (cancelled) return;
+          timeoutId = window.setTimeout(
+            update,
+            resolved ? CATALOG_IDLE_MS : CATALOG_RETRY_MS,
+          );
+        });
+    };
+
+    update();
+    return () => {
+      cancelled = true;
+      if (timeoutId !== null) window.clearTimeout(timeoutId);
+    };
   }, [checkpoint, ggufVariant]);
+
+  return useMemo(() => {
+    // Name something held here, with its quant to pin the file on disk.
+    const fromCatalog = (): string | null => {
+      const pick =
+        catalog?.find((m) => m.loaded) ?? (autoSwitch ? catalog?.[0] : undefined);
+      if (!pick) {
+        return null;
+      }
+      return pick.quant && !pick.id.includes(":")
+        ? `${pick.id}:${pick.quant}`
+        : pick.id;
+    };
+    // The store keeps a checkpoint across an idle unload and across the model being
+    // deleted, so it only names a runnable model while the catalog still lists it:
+    // resident, or downloaded with switching able to reload it. A null catalog means
+    // /v1/models has not answered, which is not evidence against it.
+    const entry = catalog?.find((m) => sameBaseModelId(m.id, checkpoint ?? ""));
+    const backed =
+      catalog === null || (!!entry && (entry.loaded || autoSwitch || idleReload));
+    if (usableCheckpoint && checkpoint && backed) {
+      if (checkpoint.includes(":")) {
+        return checkpoint;
+      }
+      // Pin the quant the catalog advertises, not the stored one: membership proves the
+      // repo, and the saved quant can name a file deleted while another quant remains.
+      // Fall back to the store only before /v1/models answers.
+      const quant = catalog === null ? ggufVariant : entry?.quant;
+      return quant ? `${checkpoint}:${quant}` : checkpoint;
+    }
+    return fromCatalog();
+  }, [autoSwitch, catalog, checkpoint, ggufVariant, idleReload, usableCheckpoint]);
 }
 
 // Backend PATH detection is only safe in the desktop app, where the UI owns
@@ -493,11 +530,6 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
   const base =
     useTunnel && cloudflareUrl ? cloudflareUrl : (serverUrl ?? origin);
   const localAgentDetection = canUseLocalAgentDetection(base);
-  // null while loading; the same setting the General tab exposes (shared cache).
-  const [autoSwitch, setAutoSwitch] = useState<OpenAIAutoSwitchSettings | null>(
-    null,
-  );
-  const [savingAutoSwitch, setSavingAutoSwitch] = useState(false);
 
   useEffect(() => {
     void fetchDeviceType({ force: true });
@@ -575,27 +607,13 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
     }
   }, [agent, detectedAgents, activeGgufVariant, activeNativePathToken, ggufContextLength]);
 
-  useEffect(() => {
-    let cancelled = false;
-    void loadOpenAIAutoSwitchSettings()
-      .then((s) => {
-        if (!cancelled) setAutoSwitch(s);
-      })
-      .catch(() => {
-        // Best-effort: leave the toggle off if the setting can't be read.
-      });
-    return () => {
-      cancelled = true;
-    };
-  }, []);
-
-  const model = useLoadedModelName();
+  const model = useExampleModelName();
   const key = apiKey || KEY_PLACEHOLDER;
 
-  const autoSwitchOn = autoSwitch?.enabled ?? false;
+  // Null model: nothing is servable, so there is no snippet worth copying.
   const snippets = useMemo(
-    () => buildSnippets(base, key, model, os, autoSwitchOn),
-    [base, key, model, os, autoSwitchOn],
+    () => (model ? buildSnippets(base, key, model, os) : null),
+    [base, key, model, os],
   );
   // Agent command must target the server the panel shows, not the :8888 default.
   const agentCommand = useMemo(
@@ -613,6 +631,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
       : "python";
 
   const handleCopy = async () => {
+    if (!snippets) return;
     if (await copyToClipboard(snippets[lang])) {
       setCopied(true);
       setTimeout(() => setCopied(false), 1800);
@@ -624,20 +643,6 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
     writeUseTunnelPref(next);
   };
 
-  // Same setting as the General tab; persist optimistically and revert on failure
-  // so the examples reflect the live model-switch behavior.
-  const handleToggleAutoSwitch = (next: boolean) => {
-    const idle = autoSwitch?.autoUnloadIdleSeconds ?? 0;
-    setAutoSwitch((prev) => (prev ? { ...prev, enabled: next } : prev));
-    setSavingAutoSwitch(true);
-    void updateOpenAIAutoSwitchSettings(next, idle)
-      .then(setAutoSwitch)
-      .catch(() => {
-        setAutoSwitch((prev) => (prev ? { ...prev, enabled: !next } : prev));
-      })
-      .finally(() => setSavingAutoSwitch(false));
-  };
-
   const handleCopyUrl = async () => {
     if (cloudflareUrl && (await copyToClipboard(cloudflareUrl))) {
       setCopiedUrl(true);
@@ -658,41 +663,7 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
         {t("settings.apiKeys.usageExamples")}
       </h2>
       <div className="min-w-0 max-w-full overflow-hidden rounded-lg border border-border bg-muted/20">
-        {/* Same setting as the General tab; surfaced here so the request `model`
-            actually switches the served model, which the examples below show. */}
-        <div className="flex min-w-0 items-center justify-between gap-2 border-b border-border px-2 py-1.5">
-          <div className="flex shrink-0 items-center gap-1.5">
-            <Switch
-              size="sm"
-              checked={autoSwitchOn}
-              disabled={autoSwitch === null || savingAutoSwitch}
-              onCheckedChange={handleToggleAutoSwitch}
-              aria-label={t("settings.general.modelAutoSwitch.enable")}
-            />
-            <span className="text-ui-11 font-medium text-foreground">
-              {t("settings.general.modelAutoSwitch.enable")}
-            </span>
-            <Tooltip>
-              <TooltipTrigger asChild={true}>
-                <button
-                  type="button"
-                  className="flex items-center rounded text-muted-foreground transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
-                  aria-label={t(
-                    "settings.general.modelAutoSwitch.enableDescription",
-                  )}
-                >
-                  <HugeiconsIcon
-                    icon={InformationCircleIcon}
-                    className="size-3.5"
-                  />
-                </button>
-              </TooltipTrigger>
-              <TooltipContent className="max-w-[260px] text-ui-11 leading-snug">
-                {t("settings.general.modelAutoSwitch.enableDescription")}
-              </TooltipContent>
-            </Tooltip>
-          </div>
-        </div>
+        {/* No model-auto-switch row: ModelAutoSwitchSection renders that setting just below. */}
         {cloudflareUrl ? (
           <div className="flex min-w-0 items-center justify-between gap-2 border-b border-border px-2 py-1.5">
             <div className="flex shrink-0 items-center gap-1.5">
@@ -802,25 +773,33 @@ export function UsageExamples({ apiKey }: { apiKey?: string | null }) {
             </button>
           </div>
         ) : null}
-        <div className="relative min-w-0">
-          <button
-            type="button"
-            onClick={handleCopy}
-            className="absolute right-2 top-2 z-10 flex items-center gap-1 rounded border border-border bg-background/80 px-1.5 py-1 text-ui-11 text-muted-foreground backdrop-blur transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
-            aria-label={t("settings.apiKeys.copySnippet")}
-          >
-            <HugeiconsIcon
-              icon={copied ? Tick02Icon : Copy01Icon}
-              className={cn("size-3.5", copied && "text-emerald-600")}
+        {snippets ? (
+          <div className="relative min-w-0">
+            <button
+              type="button"
+              onClick={handleCopy}
+              className="absolute right-2 top-2 z-10 flex items-center gap-1 rounded border border-border bg-background/80 px-1.5 py-1 text-ui-11 text-muted-foreground backdrop-blur transition-colors hover:text-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring"
+              aria-label={t("settings.apiKeys.copySnippet")}
+            >
+              <HugeiconsIcon
+                icon={copied ? Tick02Icon : Copy01Icon}
+                className={cn("size-3.5", copied && "text-emerald-600")}
+              />
+              {copied
+                ? t("settings.apiKeys.copied")
+                : t("settings.apiKeys.copy")}
+            </button>
+            <HighlightedCode
+              key={snippets[lang]}
+              code={snippets[lang]}
+              language={shikiLang}
             />
-            {copied ? t("settings.apiKeys.copied") : t("settings.apiKeys.copy")}
-          </button>
-          <HighlightedCode
-            key={snippets[lang]}
-            code={snippets[lang]}
-            language={shikiLang}
-          />
-        </div>
+          </div>
+        ) : (
+          <div className="min-w-0 px-3 py-2.5 text-ui-11 leading-snug text-muted-foreground">
+            {t("settings.apiKeys.usageNoModel")}
+          </div>
+        )}
         <div className="flex min-w-0 flex-col gap-1.5 border-t border-border px-3 py-2.5">
           <span className="text-ui-11 font-semibold text-foreground">
             {t("settings.apiKeys.codingAgents")}
diff --git a/studio/frontend/src/features/settings/tabs/api-keys-tab.tsx b/studio/frontend/src/features/settings/tabs/api-keys-tab.tsx
index f1e503f7a3..7a1fdc1fb2 100644
--- a/studio/frontend/src/features/settings/tabs/api-keys-tab.tsx
+++ b/studio/frontend/src/features/settings/tabs/api-keys-tab.tsx
@@ -168,12 +168,12 @@ export function ApiKeysTab() {
         )}
       </section>
 
+      <ModelAutoSwitchSection />
+
       <ApiMonitorConsole />
 
       <UsageExamples apiKey={revealed} />
 
-      <ModelAutoSwitchSection />
-
       <Dialog open={revokeTarget !== null} onOpenChange={(o) => !o && setRevokeTarget(null)}>
         <DialogContent className="max-w-md">
           <DialogHeader>
diff --git a/studio/frontend/src/features/transformers-upgrade/api/transformers-upgrade-api.ts b/studio/frontend/src/features/transformers-upgrade/api/transformers-upgrade-api.ts
index 2df9f712ff..7e1e1b0f5a 100644
--- a/studio/frontend/src/features/transformers-upgrade/api/transformers-upgrade-api.ts
+++ b/studio/frontend/src/features/transformers-upgrade/api/transformers-upgrade-api.ts
@@ -16,14 +16,19 @@ interface InstallLatestTransformersResponse {
   latest_version?: string | null;
 }
 
-/** Consented install of the latest transformers into the sidecar; synchronous, can take minutes. */
+/** Consented install of the latest transformers into the sidecar; synchronous, can take minutes.
+ *
+ * `forceCancelActive` carries the answer the user already gave the model swap's "stop N
+ * chats" prompt: without it the install 409s while those chats run, and nothing between the
+ * two dialogs stops them. Only ever true after that confirmation. */
 export async function installLatestTransformers(
   version: string,
+  forceCancelActive = false,
 ): Promise<InstallLatestTransformersResponse> {
   const response = await authFetch("/api/inference/install-latest-transformers", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ version }),
+    body: JSON.stringify({ version, force_cancel_active: forceCancelActive }),
   });
   if (!response.ok) {
     throw new Error(await readFastApiError(response));
diff --git a/studio/frontend/src/features/transformers-upgrade/hooks/use-transformers-upgrade-consent.ts b/studio/frontend/src/features/transformers-upgrade/hooks/use-transformers-upgrade-consent.ts
index 7d79d08d9c..9b942a7008 100644
--- a/studio/frontend/src/features/transformers-upgrade/hooks/use-transformers-upgrade-consent.ts
+++ b/studio/frontend/src/features/transformers-upgrade/hooks/use-transformers-upgrade-consent.ts
@@ -10,6 +10,9 @@ interface ConfirmArgs {
   upgrade: TransformersUpgradeInfo | null | undefined;
   /** When no release is installable, offer continuing into the caller's custom-code gate. */
   trustRemoteCodeFallback?: boolean;
+  /** The caller already confirmed the swap's "stop N chats" prompt: carry it into
+   *  the install, which otherwise 409s on those same chats with no way forward. */
+  forceCancelActive?: boolean;
 }
 
 /** Pause a load needing a newer transformers on the consent dialog and run the install.
@@ -18,11 +21,13 @@ export async function confirmTransformersUpgradeIfNeeded({
   modelName,
   upgrade,
   trustRemoteCodeFallback,
+  forceCancelActive,
 }: ConfirmArgs): Promise<boolean> {
   if (!upgrade) return true;
   return useTransformersUpgradeDialogStore
     .getState()
     .requestConsent(modelName, upgrade, {
       trustRemoteCodeFallback: Boolean(trustRemoteCodeFallback),
+      forceCancelActive: Boolean(forceCancelActive),
     });
 }
diff --git a/studio/frontend/src/features/transformers-upgrade/stores/transformers-upgrade-dialog-store.ts b/studio/frontend/src/features/transformers-upgrade/stores/transformers-upgrade-dialog-store.ts
index 9e307fb1a1..be37691bc6 100644
--- a/studio/frontend/src/features/transformers-upgrade/stores/transformers-upgrade-dialog-store.ts
+++ b/studio/frontend/src/features/transformers-upgrade/stores/transformers-upgrade-dialog-store.ts
@@ -18,6 +18,9 @@ interface TransformersUpgradeDialogStore {
   errorMessage: string | null;
   /** Model ships custom code; without a PyPI install the load may fall back to trust_remote_code. */
   trustRemoteCodeFallback: boolean;
+  /** The caller already confirmed the model swap's "stop N chats" prompt, so the install
+   *  may stop them too; without it the install 409s and Retry can never succeed. */
+  forceCancelActive: boolean;
   /** True once this consent's install completed. The install unloads the previous
    *  model before swapping, so the caller must treat it as already unloaded; the
    *  custom-code fallback resolves true without installing and leaves it loaded. */
@@ -34,7 +37,7 @@ interface TransformersUpgradeDialogStore {
   requestConsent: (
     modelName: string,
     upgrade: TransformersUpgradeInfo,
-    options?: { trustRemoteCodeFallback?: boolean },
+    options?: { trustRemoteCodeFallback?: boolean; forceCancelActive?: boolean },
   ) => Promise<boolean>;
   /** Accept/Retry: run the install; on success resolve(true) and close. */
   install: () => Promise<void>;
@@ -49,6 +52,7 @@ export const useTransformersUpgradeDialogStore =
     phase: "consent",
     errorMessage: null,
     trustRemoteCodeFallback: false,
+    forceCancelActive: false,
     installRan: false,
     serverUnloadedChat: false,
     requestConsent: (modelName, upgrade, options) =>
@@ -62,6 +66,7 @@ export const useTransformersUpgradeDialogStore =
           phase: "consent",
           errorMessage: null,
           trustRemoteCodeFallback: Boolean(options?.trustRemoteCodeFallback),
+          forceCancelActive: Boolean(options?.forceCancelActive),
           installRan: false,
         });
       }),
@@ -71,14 +76,14 @@ export const useTransformersUpgradeDialogStore =
       return value;
     },
     install: async () => {
-      const { upgrade, phase } = get();
+      const { upgrade, phase, forceCancelActive } = get();
       const version = upgrade?.pypi_version;
       if (!version || phase === "installing") return;
       const requestResolver = pendingResolver;
       set({ phase: "installing", errorMessage: null });
       let result: Awaited<ReturnType<typeof installLatestTransformers>>;
       try {
-        result = await installLatestTransformers(version);
+        result = await installLatestTransformers(version, forceCancelActive);
         // Latch the server-side unload IMMEDIATELY, before any resolver-identity
         // guard: even a superseded consent's install may have unloaded the chat
         // model, and the signal must survive for whichever load consumes it next.
@@ -133,6 +138,7 @@ export const useTransformersUpgradeDialogStore =
         phase: "consent",
         errorMessage: null,
         trustRemoteCodeFallback: false,
+        forceCancelActive: false,
       });
       resolver?.(installed);
     },
diff --git a/studio/frontend/src/hooks/use-gpu-info.ts b/studio/frontend/src/hooks/use-gpu-info.ts
index c7eafc7e18..e96b0ddb91 100644
--- a/studio/frontend/src/hooks/use-gpu-info.ts
+++ b/studio/frontend/src/hooks/use-gpu-info.ts
@@ -100,13 +100,29 @@ function toGpuInfo(
 }
 
 function toGpuDevices(data: SystemInfoResponse | null): SystemGpuDevice[] {
-  // Unpinnable configurations must hide every pick surface: XPU indices are
-  // torch-xpu ordinals no applicator speaks, and Vulkan-only builds pin ggml's
-  // own ordinals -- /load and /validate 400 picks on both, so the backend
-  // reports gpu.gguf_gpu_ids_supported and every gate keyed on physicalIndex
-  // (picker, persisted-pick reconcile) follows it. The device flavor lives on
-  // the TOP-LEVEL device_backend field; absent support info defaults to
-  // pinnable (older backend).
+  // GGUF loads run through llama-server, so on a Vulkan build the pickable set
+  // is the inference inventory, not the torch view: it can see cards torch
+  // cannot, and its indices are the ggml ordinals `--device Vulkan<i>` pins.
+  // The XPU ban does not apply there, it is about torch-xpu ordinals that no
+  // applicator speaks; a Vulkan pick does not use them.
+  const inference = data?.inference_gpu;
+  if (inference?.backend === "vulkan" && (inference.devices ?? []).length) {
+    const picksAccepted = inference.gguf_gpu_ids_supported !== false;
+    return (inference.devices ?? [])
+      .filter((d) => typeof d.index === "number")
+      .map((d) => ({
+        index: d.index as number,
+        name: d.name ?? `GPU ${d.index}`,
+        memoryTotalGb: d.memory_total_gb ?? 0,
+        memoryFreeGb: d.vram_free_gb ?? 0,
+        physicalIndex: picksAccepted && d.index_kind === "vulkan",
+      }));
+  }
+  // Otherwise the torch view is the pickable set. Unpinnable configurations
+  // must hide every pick surface: XPU indices are torch-xpu ordinals no
+  // applicator speaks, so /load and /validate 400 them, and the backend reports
+  // gpu.gguf_gpu_ids_supported. Absent support info defaults to pinnable
+  // (older backend).
   const pinnableBackend =
     data?.device_backend !== "xpu" &&
     data?.gpu?.gguf_gpu_ids_supported !== false;
diff --git a/studio/frontend/src/i18n/locales/ar.ts b/studio/frontend/src/i18n/locales/ar.ts
index 4b2a9e5ec0..47d5032fae 100644
--- a/studio/frontend/src/i18n/locales/ar.ts
+++ b/studio/frontend/src/i18n/locales/ar.ts
@@ -37,6 +37,8 @@ export const ar = {
     navigation: {
       newChat: "محادثة جديدة",
       returnToChat: "العودة إلى المحادثة",
+      returnToChats: "العودة إلى {count} محادثات",
+      chatGenerating: "جارٍ الإنشاء",
       compare: "مقارنة",
       search: "بحث",
       hub: "مركز النماذج",
diff --git a/studio/frontend/src/i18n/locales/de.ts b/studio/frontend/src/i18n/locales/de.ts
index a508fbb9fc..cb7d603f42 100644
--- a/studio/frontend/src/i18n/locales/de.ts
+++ b/studio/frontend/src/i18n/locales/de.ts
@@ -37,6 +37,8 @@ export const de = {
     navigation: {
       newChat: "Neuer Chat",
       returnToChat: "Zurück zum Chat",
+      returnToChats: "Zurück zu {count} Chats",
+      chatGenerating: "Wird generiert",
       compare: "Vergleichen",
       search: "Suchen",
       hub: "Modell-Hub",
diff --git a/studio/frontend/src/i18n/locales/en.ts b/studio/frontend/src/i18n/locales/en.ts
index bb472bf32c..bdfcf38231 100644
--- a/studio/frontend/src/i18n/locales/en.ts
+++ b/studio/frontend/src/i18n/locales/en.ts
@@ -34,6 +34,8 @@ export const en = {
     navigation: {
       newChat: "New chat",
       returnToChat: "Return to Chat",
+      returnToChats: "Return to {count} Chats",
+      chatGenerating: "Generating",
       compare: "Compare",
       search: "Search",
       hub: "Model hub",
@@ -284,20 +286,21 @@ export const en = {
         sectionTitle: "Model auto-switch (OpenAI API)",
         enable: "Switch model by request",
         enableDescription:
-          "When an OpenAI-compatible request names a different downloaded GGUF, load it before serving. Off by default; unknown names keep serving the loaded model.",
+          "Load a downloaded GGUF named in an API request before serving. Off by default.",
+        autoDownload: "Download missing models",
+        autoDownloadDescription:
+          "Fetch a GGUF named in an API request that is not downloaded yet. Anyone with an API key can then use disk and bandwidth.",
         idleUnload: "Idle auto-unload",
         idleUnloadDescription:
-          "Unload the model after this many idle seconds to free VRAM; the next request reloads it. 0 keeps it loaded. Minimum 60 seconds.",
-        idleNeedsEnable:
-          "Turn on Switch model by request so an unloaded model reloads on next use.",
-        idleActiveViaEnv:
-          "Idle auto-unload is active via the UNSLOTH_MODEL_IDLE_TTL environment variable.",
+          "Free VRAM after this many idle seconds. 0 keeps it loaded, minimum 60.",
+        idleNeedsEnable: "Turn on Switch model by request first.",
+        idleActiveViaEnv: "Active via UNSLOTH_MODEL_IDLE_TTL.",
         loadError: "Failed to load model auto-switch settings.",
         saveError: "Failed to save model auto-switch settings.",
         idleError: "Enter 0 to keep the model loaded, or at least 60 seconds.",
         keepKv: "Keep chat context across idle unload",
         keepKvDescription:
-          "Save the model's KV cache to disk before an idle unload and restore it on reload, so resumed chats skip re-reading their history. Chat context is written to disk (up to 10 GB) until it is restored or cleaned up.",
+          "Save the KV cache before an idle unload so resumed chats skip re-reading history. Up to 10 GB on disk.",
       },
       previewSharing: {
         sectionTitle: "Preview sharing",
@@ -818,6 +821,8 @@ export const en = {
       copyAccessToken: "Copy access token",
       copyNow: "Copy now - this won't be shown again.",
       usageExamples: "Usage examples",
+      usageNoModel:
+        "Load or download a model to see runnable examples. This server has no model to name yet.",
       usageTools: "Tools",
       exampleCurlTools: "curl + tools",
       examplePythonTools: "Python + tools",
diff --git a/studio/frontend/src/i18n/locales/es.ts b/studio/frontend/src/i18n/locales/es.ts
index 26e5e062dd..f7cb0e11f6 100644
--- a/studio/frontend/src/i18n/locales/es.ts
+++ b/studio/frontend/src/i18n/locales/es.ts
@@ -37,6 +37,8 @@ export const es = {
     navigation: {
       newChat: "Nuevo chat",
       returnToChat: "Volver al chat",
+      returnToChats: "Volver a {count} chats",
+      chatGenerating: "Generando",
       compare: "Comparar",
       search: "Buscar",
       hub: "Centro de modelos",
diff --git a/studio/frontend/src/i18n/locales/fr.ts b/studio/frontend/src/i18n/locales/fr.ts
index 704eac3fe2..4f2838391f 100644
--- a/studio/frontend/src/i18n/locales/fr.ts
+++ b/studio/frontend/src/i18n/locales/fr.ts
@@ -37,6 +37,8 @@ export const fr = {
     navigation: {
       newChat: "Nouvelle discussion",
       returnToChat: "Retour à la discussion",
+      returnToChats: "Retour à {count} discussions",
+      chatGenerating: "Génération en cours",
       compare: "Comparer",
       search: "Rechercher",
       hub: "Hub de modèles",
diff --git a/studio/frontend/src/i18n/locales/hi.ts b/studio/frontend/src/i18n/locales/hi.ts
index c18a86809f..33b827f314 100644
--- a/studio/frontend/src/i18n/locales/hi.ts
+++ b/studio/frontend/src/i18n/locales/hi.ts
@@ -37,6 +37,8 @@ export const hi = {
     navigation: {
       newChat: "नई चैट",
       returnToChat: "चैट पर लौटें",
+      returnToChats: "{count} चैट पर लौटें",
+      chatGenerating: "जनरेट हो रहा है",
       compare: "तुलना करें",
       search: "खोजें",
       hub: "मॉडल हब",
diff --git a/studio/frontend/src/i18n/locales/ja.ts b/studio/frontend/src/i18n/locales/ja.ts
index 9cde9c98ed..978fde6281 100644
--- a/studio/frontend/src/i18n/locales/ja.ts
+++ b/studio/frontend/src/i18n/locales/ja.ts
@@ -38,6 +38,8 @@ export const ja = {
     navigation: {
       newChat: "新規チャット",
       returnToChat: "チャットに戻る",
+      returnToChats: "{count} 件のチャットに戻る",
+      chatGenerating: "生成中",
       compare: "比較",
       search: "検索",
       hub: "モデルハブ",
diff --git a/studio/frontend/src/i18n/locales/ko.ts b/studio/frontend/src/i18n/locales/ko.ts
index a5b7c14940..aa8a4fd47b 100644
--- a/studio/frontend/src/i18n/locales/ko.ts
+++ b/studio/frontend/src/i18n/locales/ko.ts
@@ -37,6 +37,8 @@ export const ko = {
     navigation: {
       newChat: "새 채팅",
       returnToChat: "채팅으로 돌아가기",
+      returnToChats: "채팅 {count}개로 돌아가기",
+      chatGenerating: "생성 중",
       compare: "비교",
       search: "검색",
       hub: "모델 허브",
diff --git a/studio/frontend/src/i18n/locales/pt-br.ts b/studio/frontend/src/i18n/locales/pt-br.ts
index 5922e69890..84cd3f945e 100644
--- a/studio/frontend/src/i18n/locales/pt-br.ts
+++ b/studio/frontend/src/i18n/locales/pt-br.ts
@@ -37,6 +37,8 @@ export const ptBR = {
     navigation: {
       newChat: "Novo Chat",
       returnToChat: "Retornar ao Chat",
+      returnToChats: "Retornar a {count} chats",
+      chatGenerating: "Gerando",
       compare: "Comparar",
       search: "Buscar",
       hub: "Hub de modelos",
diff --git a/studio/frontend/src/i18n/locales/ru.ts b/studio/frontend/src/i18n/locales/ru.ts
index c680ff1ba9..7725212e3b 100644
--- a/studio/frontend/src/i18n/locales/ru.ts
+++ b/studio/frontend/src/i18n/locales/ru.ts
@@ -37,6 +37,8 @@ export const ru = {
     navigation: {
       newChat: "Новый чат",
       returnToChat: "Вернуться к чату",
+      returnToChats: "Вернуться к {count} чатам",
+      chatGenerating: "Генерация",
       compare: "Сравнить",
       search: "Поиск",
       hub: "Хаб моделей",
diff --git a/studio/frontend/src/i18n/locales/zh-CN.ts b/studio/frontend/src/i18n/locales/zh-CN.ts
index 22f1e06d80..06326ed008 100644
--- a/studio/frontend/src/i18n/locales/zh-CN.ts
+++ b/studio/frontend/src/i18n/locales/zh-CN.ts
@@ -37,6 +37,8 @@ export const zhCN = {
     navigation: {
       newChat: "新聊天",
       returnToChat: "返回聊天",
+      returnToChats: "返回 {count} 个聊天",
+      chatGenerating: "生成中",
       compare: "对比",
       search: "搜索",
       hub: "模型中心",
diff --git a/studio/frontend/src/lib/toast.ts b/studio/frontend/src/lib/toast.ts
index 6b1635b42e..b500c11ec2 100644
--- a/studio/frontend/src/lib/toast.ts
+++ b/studio/frontend/src/lib/toast.ts
@@ -4,5 +4,15 @@
 // Re-export of sonner. Swipe blocking lives on the Toaster via
 // `swipeDirections={[]}`, so no per-toast dismissible override.
 
+import { Spinner } from "@/components/ui/spinner";
+import { createElement } from "react";
+
+function createLoadingToastIcon() {
+  return createElement(Spinner, {
+    className: "size-4 text-muted-foreground",
+  });
+}
+
 export { toast } from "sonner";
 export type { ExternalToast } from "sonner";
+export { createLoadingToastIcon };
diff --git a/studio/frontend/vite.config.ts b/studio/frontend/vite.config.ts
index 8d34383a48..477eb050bb 100644
--- a/studio/frontend/vite.config.ts
+++ b/studio/frontend/vite.config.ts
@@ -9,6 +9,13 @@ import { defineConfig } from "vite";
 // https://vite.dev/config/
 export default defineConfig({
   plugins: [react(), tailwindcss()],
+  // Keep an unrelated PostCSS config in an ancestor directory from leaking
+  // into Studio installs. Tailwind is provided by its dedicated Vite plugin.
+  css: {
+    postcss: {
+      plugins: [],
+    },
+  },
   optimizeDeps: {
     include: ["@dagrejs/dagre", "@dagrejs/graphlib"],
   },
diff --git a/studio/install_llama_prebuilt.py b/studio/install_llama_prebuilt.py
index 9b787dbb15..346796a8c7 100644
--- a/studio/install_llama_prebuilt.py
+++ b/studio/install_llama_prebuilt.py
@@ -65,6 +65,54 @@ EXIT_ERROR = 1
 EXIT_BUSY = 3
 EXIT_NO_SPACE = 4
 
+# Every gfx a Windows AMD host can be served: ggml-org release.yml windows-hip GPU_TARGETS
+# plus the fork's windows-rocm bundles. Must stay a superset of the manifest's windows-rocm
+# mapped_targets, else auto-Vulkan steals a host the fork already builds for. Below this
+# floor (e.g. gfx803 / RX 480) HIP has no prebuilt and Vulkan is the practical Windows
+# llama-server backend (#7357).
+WINDOWS_HIP_PREBUILT_GFX_TARGETS = frozenset(
+    {
+        "gfx908",
+        "gfx90a",
+        "gfx1030",
+        "gfx1031",
+        "gfx1032",
+        "gfx1034",
+        "gfx1100",
+        "gfx1101",
+        "gfx1102",
+        "gfx1103",
+        "gfx1150",
+        "gfx1151",
+        "gfx1200",
+        "gfx1201",
+    }
+)
+# Family labels forwarded by update markers / --rocm-gfx (gfx110X.zip assets).
+WINDOWS_ROCM_FAMILY_GFX_LABELS = frozenset({"gfx103x", "gfx110x", "gfx120x"})
+
+# Exactly ggml-org release.yml's windows-hip "radeon" gpu_targets. The set above adds the
+# fork-only bundles (gfx1034, gfx1103, gfx908, gfx90a), served only against the fork.
+UPSTREAM_WINDOWS_HIP_GFX_TARGETS = frozenset(
+    {
+        "gfx1030",
+        "gfx1031",
+        "gfx1032",
+        "gfx1100",
+        "gfx1101",
+        "gfx1102",
+        "gfx1150",
+        "gfx1151",
+        "gfx1200",
+        "gfx1201",
+    }
+)
+
+# install_kinds that really are a Vulkan bundle. A Vulkan request can still end on a CPU
+# bundle (no Vulkan archive on Windows arm64; x64 falls through when it is missing or fails
+# validation), so check against this to keep the marker honest (#7357).
+VULKAN_INSTALL_KINDS = frozenset({"linux-vulkan", "windows-vulkan"})
+
 # DiskPart-prompt suppression. RunAsInvoker does NOT stop amd-smi's runtime
 # elevation (its manifest is asInvoker), so this is just harmless belt-and-
 # suspenders for manifest-elevating tools. The real guard is _amd_smi_allowed():
@@ -282,6 +330,7 @@ class HostInfo:
     has_rocm: bool = False
     has_intel_gpu: bool = False
     rocm_gfx_target: str | None = None
+    rocm_gfx_targets: list[str] = field(default_factory = list)
     # (major, minor) from platform.mac_ver(); None off macOS or if unparseable.
     # Skips a macos prebuilt whose minimum-OS exceeds this host.
     macos_version: tuple[int, int] | None = None
@@ -2159,47 +2208,37 @@ def run_capture(
     return result
 
 
-def _pick_rocm_gfx_target(out: str) -> str | None:
-    """Choose the gfx target rocminfo / hipinfo report for the active GPU.
+def _list_rocm_gfx_targets(out: str) -> list[str]:
+    """List gfx targets rocminfo / hipinfo report, one entry per physical GPU.
 
-    A bare first-match picked the wrong device on mixed APU + dGPU hosts
-    (e.g. Strix Halo gfx1151 + discrete RX 7900 gfx1100). Respect
-    HIP_VISIBLE_DEVICES / ROCR_VISIBLE_DEVICES / CUDA_VISIBLE_DEVICES so the
-    asset matches what HIP actually runs on. Falls back to the first GPU when
-    no env var is set.
-
-    rocminfo / hipinfo print the same gfx token multiple times per GPU (Name,
-    ISA, marketing-name). We first try to split the output on per-GPU section
-    headers (rocminfo: "Agent N" blocks, hipinfo: "device#N" entries) and take
-    exactly one gfx token per section. This gives the correct per-GPU list even
-    on same-arch multi-GPU hosts (e.g. two RX 7900 XTX cards) where global
-    dict.fromkeys dedup would collapse both cards to a single entry and make
-    HIP_VISIBLE_DEVICES=1 point out of range.
-
-    Falls back to insertion-order dedup when the output has no recognisable
-    section markers (flat gfx-string inputs, unit-test stubs, etc.).
-
-    Empty / "-1" env values mean no AMD GPU is visible to HIP: return None.
+    Both repeat the same gfx token per GPU (Name, ISA, marketing-name), so split on per-GPU
+    section headers to keep two entries on a dual same-arch host; flat strings and test stubs
+    fall back to insertion-order dedup.
     """
-    # Try to build a per-GPU token list by splitting on section boundaries.
-    # rocminfo sections are introduced by "Agent N" lines (optionally between
-    # rows of asterisks). hipinfo sections start with "device#N".
     _sections = re.split(
         r"(?mi)^\s*\*+\s*$\s*agent\s+\d+\s*$|\bdevice\s*#\s*\d+\b",
         out,
     )
     if len(_sections) > 1:
-        # Section-based: one gfx token per GPU section preserves physical order.
         _tokens: list[str] = []
         for _sec in _sections[1:]:
             _m = re.search(r"gfx[1-9][0-9a-z]{2,3}", _sec.lower())
             if _m:
                 _tokens.append(_m.group(0))
     else:
-        # Fallback: insertion-order dedup (handles flat strings / unknown formats).
         _raw = re.findall(r"gfx[1-9][0-9a-z]{2,3}", out.lower())
         _tokens = list(dict.fromkeys(_raw))
+    return _tokens
 
+
+def _pick_rocm_gfx_target(out: str) -> str | None:
+    """Choose the gfx target rocminfo / hipinfo report for the active GPU.
+
+    A bare first-match picked the wrong device on mixed APU + dGPU hosts (Strix Halo gfx1151
+    + RX 7900 gfx1100), so honour HIP_VISIBLE_DEVICES / ROCR_VISIBLE_DEVICES /
+    CUDA_VISIBLE_DEVICES; no env var means the first GPU, empty / "-1" means none (None).
+    """
+    _tokens = _list_rocm_gfx_targets(out)
     if not _tokens:
         return None
 
@@ -2407,6 +2446,7 @@ def detect_host() -> HostInfo:
 
     has_rocm = False
     rocm_gfx_target: str | None = None
+    rocm_gfx_targets: list[str] = []
     if is_linux and not has_usable_nvidia:
         # WSL2 ROCDXG: the system rocminfo enumerates the GPU over /dev/dxg
         # only when HSA_ENABLE_DXG_DETECTION=1 (a no-op on bare metal), and
@@ -2444,6 +2484,7 @@ def detect_host() -> HostInfo:
             if _result.returncode == 0 and _result.stdout.strip():
                 if _check(_result.stdout):
                     has_rocm = True
+                    rocm_gfx_targets = _list_rocm_gfx_targets(_result.stdout)
                     rocm_gfx_target = _pick_rocm_gfx_target(_result.stdout)
                     break
     elif is_windows and not has_usable_nvidia:
@@ -2489,6 +2530,7 @@ def detect_host() -> HostInfo:
                 if _check(_result.stdout):
                     has_rocm = True
                     # hipinfo reports "gcnArchName: gfx1100" -- extract if present
+                    rocm_gfx_targets = _list_rocm_gfx_targets(_result.stdout)
                     rocm_gfx_target = _pick_rocm_gfx_target(_result.stdout)
                     break
         # Note: amdhip64.dll presence alone is NOT treated as GPU evidence
@@ -2551,6 +2593,7 @@ def detect_host() -> HostInfo:
         has_rocm = has_rocm,
         has_intel_gpu = has_intel_gpu,
         rocm_gfx_target = rocm_gfx_target,
+        rocm_gfx_targets = rocm_gfx_targets,
         macos_version = macos_version,
     )
 
@@ -2573,12 +2616,12 @@ def _apply_host_overrides(
     force_cpu: bool = False,
 ) -> HostInfo:
     """Fold setup.sh/setup.ps1's forwarded detection into the host profile.
-    A forwarded gfx (--rocm-gfx or UNSLOTH_ROCM_GFX_ARCH) is authoritative and
-    implies ROCm: the installer's own hipinfo/amd-smi probe can miss the arch on
-    amd-smi-only hosts or when setup inferred it from the GPU name, leaving
-    rocm_gfx_target None and no per-gfx ROCm prebuilt selected. force_cpu is the
-    opposite explicit signal (arm64 Linux GPU host whose source build failed):
-    drop GPU attributes so the CPU prebuilt for this OS/arch is selected."""
+    A forwarded gfx (--rocm-gfx or UNSLOTH_ROCM_GFX_ARCH) implies ROCm and fills the gap
+    where our own hipinfo/amd-smi probe misses the arch (amd-smi-only hosts, or setup
+    inferring it from the GPU name), leaving no per-gfx ROCm prebuilt selected; it stays
+    authoritative except for the two advisory shapes narrowed below. force_cpu is the
+    opposite explicit signal (arm64 Linux GPU host whose source build failed): drop GPU
+    attributes so the CPU prebuilt for this OS/arch is selected."""
     if force_cpu:
         return dataclasses_replace(
             host,
@@ -2586,11 +2629,43 @@ def _apply_host_overrides(
             has_physical_nvidia = False,
             has_rocm = False,
             rocm_gfx_target = None,
+            rocm_gfx_targets = [],
             has_intel_gpu = False,
         )
     gfx = _normalize_forwarded_gfx(override_rocm_gfx)
     if gfx:
-        return dataclasses_replace(host, has_rocm = True, rocm_gfx_target = gfx)
+        # setup.ps1's pick is not fully visible-device aware (neither branch reads
+        # CUDA_VISIBLE_DEVICES; amd-smi matches a bare integer only, so "1,0" falls back to
+        # GPU 0), while _pick_rocm_gfx_target() honours all three vars with HIP's semantics.
+        # So keep a probed active arch when the forward is only advisory, else
+        # _should_auto_vulkan_for_amd_windows() reads a HIP-supported GPU the user masked
+        # off and installs an unusable HIP bundle instead of Vulkan. Advisory means:
+        #   * another GPU the probe saw ON THIS HOST, i.e. setup picked a different card;
+        #   * a family label (gfx110X), a bundle name the update path emits from the marker
+        #     asset and never a real arch -- it would upgrade an in-generation-but-unbuilt
+        #     GPU (gfx1033) into a bundle it must not be served.
+        # Anything else the probe never reported is an operator override for a host whose
+        # arch the probe gets wrong or stale, exactly what --rocm-gfx documents, so it stays
+        # authoritative. UNSLOTH_ROCM_GFX_ARCH also still wins.
+        _manual = _normalize_forwarded_gfx(os.environ.get("UNSLOTH_ROCM_GFX_ARCH"))
+        _physical = _host_rocm_gfx_targets(host)
+        _active = _active_rocm_gfx_target(host)
+        _advisory = gfx in _physical or gfx in WINDOWS_ROCM_FAMILY_GFX_LABELS
+        if gfx != _manual and _active and gfx != _active and _advisory:
+            return dataclasses_replace(host, has_rocm = True)
+        return dataclasses_replace(
+            host,
+            has_rocm = True,
+            rocm_gfx_target = gfx,
+            # ADD the forwarded arch to the probe's per-GPU list, never replace it: that
+            # list is the PHYSICAL inventory _should_auto_vulkan_for_amd_windows() reads,
+            # and a forward says which GPU HIP should target, not which cards exist.
+            # Dropping a probe-confirmed GPU would let a stale below-floor forward
+            # auto-route a box with a HIP-capable card to Vulkan, which then enumerates
+            # that card regardless of HIP_VISIBLE_DEVICES. An empty probe still yields
+            # [gfx], so the driver-only host the forward exists for keeps auto-Vulkan.
+            rocm_gfx_targets = list(dict.fromkeys([*_physical, gfx])),
+        )
     if override_has_rocm and not host.has_rocm:
         return dataclasses_replace(host, has_rocm = True)
     return host
@@ -5464,6 +5539,18 @@ def _fork_manifest_release_plans(
     raise PrebuiltFallback("no installable published llama.cpp releases were found")
 
 
+def persisted_llama_backend(llama_backend: str | None, choice: AssetChoice) -> str | None:
+    """The backend to record for an install that actually landed ``choice``.
+
+    A Vulkan request can end on a non-Vulkan bundle (no upstream Vulkan archive for Windows
+    arm64; x64 falls through to win-cpu-x64 when it is missing or fails validation), and
+    recording "vulkan" there would make the updater re-assert a backend that was never
+    installed. Mirrors force_cpu: persist the real outcome only."""
+    if llama_backend == "vulkan" and choice.install_kind not in VULKAN_INSTALL_KINDS:
+        return None
+    return llama_backend
+
+
 def write_prebuilt_metadata(
     install_dir: Path,
     *,
@@ -5474,6 +5561,7 @@ def write_prebuilt_metadata(
     approved_checksums: ApprovedReleaseChecksums,
     prebuilt_fallback_used: bool,
     force_cpu: bool = False,
+    llama_backend: str | None = None,
 ) -> None:
     source_asset_name, source_sha256 = selected_source_archive_metadata(
         approved_checksums,
@@ -5502,6 +5590,9 @@ def write_prebuilt_metadata(
         # so a forced CPU install is not re-routed to a GPU bundle (#7213). An automatic
         # --cpu-fallback (e.g. arm64 GPU-build recovery) stays False so it can heal to GPU.
         "force_cpu": force_cpu,
+        # Deliberate or auto-selected Vulkan backend (#7357); the updater re-asserts it so
+        # AMD hosts are not swapped back to HIP. Dropped if the winning attempt was not Vulkan.
+        "llama_backend": persisted_llama_backend(llama_backend, choice),
         "asset_sha256": choice.expected_sha256,
         "source": choice.source_label,
         # Binary-side repo/tag for non-fork sources (e.g. the ggml-org upstream
@@ -5549,6 +5640,23 @@ def sync_marker_force_cpu(install_dir: Path, persist_force_cpu: bool) -> None:
     log(f"existing install reused; recorded force_cpu={persist_force_cpu} from this run")
 
 
+def sync_marker_llama_backend(install_dir: Path, llama_backend: str | None) -> None:
+    """Sync the persisted llama.cpp backend when the bundle is reused unchanged."""
+    marker_path = install_dir / "UNSLOTH_PREBUILT_INFO.json"
+    try:
+        marker = json.loads(marker_path.read_text())
+    except (OSError, ValueError):
+        return
+    if not isinstance(marker, dict) or marker.get("llama_backend") == llama_backend:
+        return
+    if llama_backend is None:
+        marker.pop("llama_backend", None)
+    else:
+        marker["llama_backend"] = llama_backend
+    marker_path.write_text(json.dumps(marker, indent = 2) + "\n")
+    log(f"existing install reused; recorded llama_backend={llama_backend!r} from this run")
+
+
 def expected_install_fingerprint(
     *,
     llama_tag: str,
@@ -5841,6 +5949,7 @@ def validate_prebuilt_choice(
     prebuilt_fallback_used: bool,
     quantized_path: Path,
     force_cpu: bool = False,
+    llama_backend: str | None = None,
 ) -> tuple[Path, Path]:
     source_repo, source_ref, source_archive, exact_source = preferred_source_archive(
         approved_checksums, llama_tag
@@ -5882,6 +5991,7 @@ def validate_prebuilt_choice(
         approved_checksums = approved_checksums,
         prebuilt_fallback_used = prebuilt_fallback_used,
         force_cpu = force_cpu,
+        llama_backend = llama_backend,
     )
     # Hashless external prebuilts are not in the approved-sha256
     # manifest and rely on the functional smoke test as their only integrity gate,
@@ -5969,6 +6079,7 @@ def validate_prebuilt_attempts(
     initial_fallback_used: bool = False,
     existing_install_dir: Path | None = None,
     force_cpu: bool = False,
+    llama_backend: str | None = None,
 ) -> tuple[AssetChoice, Path, bool]:
     attempt_list = list(attempts)
     if not attempt_list:
@@ -6030,6 +6141,7 @@ def validate_prebuilt_attempts(
                 prebuilt_fallback_used = tried_fallback,
                 quantized_path = quantized_path,
                 force_cpu = force_cpu,
+                llama_backend = llama_backend,
             )
         except Exception as exc:
             remove_tree(staging_dir)
@@ -6055,12 +6167,43 @@ def validate_prebuilt_attempts(
     raise PrebuiltFallback("no prebuilt bundle passed validation")
 
 
-def force_vulkan_requested() -> bool:
-    """Whether UNSLOTH_FORCE_VULKAN opts this host into the Vulkan llama.cpp
-    prebuilt instead of its detected CUDA/ROCm backend (e.g. so an AMD user can
-    run the Vulkan build for inference). Scoped to the llama.cpp backend; the
-    torch/training stack installs separately and still sees the real GPU.
+def _normalized_llama_backend(value: str | None) -> str | None:
+    if not value:
+        return None
+    backend = value.strip().lower()
+    if backend in {"vulkan", "hip", "rocm", "cpu"}:
+        return "hip" if backend == "rocm" else backend
+    return None
+
+
+def llama_backend_from_env() -> str | None:
+    """Read an explicit llama.cpp backend preference from the environment.
+
+    Only ``UNSLOTH_LLAMA_BACKEND`` is honored. ``UNSLOTH_LLAMA_CPP_BACKEND`` is a separate
+    setup variable meaning ``auto``/``cpu`` (not a backend name) that setup warns about and
+    otherwise ignores, so reading it here would force Vulkan behind that warning.
     """
+    return _normalized_llama_backend(os.environ.get("UNSLOTH_LLAMA_BACKEND"))
+
+
+def resolved_llama_backend(llama_backend: str | None = None) -> str | None:
+    """The explicit backend for this run: --llama-backend, else the env var. None when
+    neither is set or the value is not a backend name we know."""
+    return _normalized_llama_backend(llama_backend) or llama_backend_from_env()
+
+
+def force_vulkan_requested(llama_backend: str | None = None) -> bool:
+    """Whether this run should install the upstream Vulkan llama.cpp prebuilt.
+
+    Triggered by ``UNSLOTH_LLAMA_BACKEND=vulkan``, legacy ``UNSLOTH_FORCE_VULKAN``, or
+    ``--llama-backend vulkan``. Scoped to the llama.cpp backend; the torch/training stack
+    installs separately and still sees the real GPU.
+    """
+    backend = resolved_llama_backend(llama_backend)
+    if backend is not None:
+        # Authoritative, so =hip is a real opt-out a stale UNSLOTH_FORCE_VULKAN cannot
+        # overrule.
+        return backend == "vulkan"
     return os.environ.get("UNSLOTH_FORCE_VULKAN", "").strip().lower() in (
         "1",
         "true",
@@ -6068,6 +6211,117 @@ def force_vulkan_requested() -> bool:
     )
 
 
+def _host_rocm_gfx_targets(host: HostInfo) -> list[str]:
+    if host.rocm_gfx_targets:
+        return [target.lower() for target in host.rocm_gfx_targets]
+    if host.rocm_gfx_target:
+        return [host.rocm_gfx_target.lower()]
+    return []
+
+
+def _active_rocm_gfx_target(host: HostInfo) -> str | None:
+    """The gfx HIP will run on (visible-device aware), not every physical GPU."""
+    if host.rocm_gfx_target:
+        return host.rocm_gfx_target.lower().strip()
+    return None
+
+
+def _hip_visible_device_mask_set() -> bool:
+    """Whether a HIP visible-device mask is in force for this process.
+
+    The Windows arch probe is hipinfo, itself a HIP application, so under a mask it
+    enumerates the VISIBLE devices, not the physical ones. Presence is the whole test: a
+    partial mask leaves the inventory unknowable, and an all-hiding "" / "-1" is the
+    strongest form of that, not an exemption, since --rocm-gfx can still supply an arch
+    (setup infers it from the display adapter, which no HIP mask touches) and would
+    auto-route a host on which the user hid every AMD GPU. Reads the same three vars as
+    _pick_rocm_gfx_target, so the two cannot disagree about the host."""
+    return any(
+        os.environ.get(_env) is not None
+        for _env in ("HIP_VISIBLE_DEVICES", "ROCR_VISIBLE_DEVICES", "CUDA_VISIBLE_DEVICES")
+    )
+
+
+def _windows_hip_gfx_targets(published_repo: str | None) -> frozenset[str]:
+    """gfx targets the Windows HIP bundle of ``published_repo`` is actually built for.
+
+    The combined floor above includes the FORK's windows-rocm bundles, and only the fork is
+    planned from a manifest: resolve_simple_install_release_plans() sends every other
+    --published-repo (ggml-org, but equally any mirror of upstream-standard assets) to
+    direct_upstream_release_plan(), whose AMD branch offers win-hip-radeon then CPU and never
+    Vulkan. Answering "supported" there for a fork-only arch would silently land it on
+    HIP/CPU instead of the Vulkan bundle that would actually run, so gate on the fork rather
+    than exempting one repo, mirroring that dispatch exactly, spelling included: an empty
+    value defaults to the fork, and a differently cased repo really does take the upstream
+    path and must be answered with upstream coverage."""
+    if (published_repo or DEFAULT_PUBLISHED_REPO) == DEFAULT_PUBLISHED_REPO:
+        return WINDOWS_HIP_PREBUILT_GFX_TARGETS
+    return UPSTREAM_WINDOWS_HIP_GFX_TARGETS
+
+
+def _gfx_is_windows_hip_supported(gfx: str, published_repo: str | None = None) -> bool:
+    token = gfx.lower().strip()
+    if token in WINDOWS_ROCM_FAMILY_GFX_LABELS:
+        # A bundle name, not an arch, so the concrete GPU is unknown here. The fork builds
+        # every member; upstream builds all but gfx1034 / gfx1103. Answering "unsupported"
+        # to cover that pair would move gfx1030..1032 / gfx1100..1102 off a working HIP
+        # build onto Vulkan for a member the label cannot identify, so HIP serves it either
+        # way. A concrete arch below still answers per repo, which is where gfx1034 and
+        # gfx1103 do reach Vulkan.
+        return True
+    return token in _windows_hip_gfx_targets(published_repo)
+
+
+def _host_has_windows_hip_prebuilt_gfx(host: HostInfo, published_repo: str | None = None) -> bool:
+    active = _active_rocm_gfx_target(host)
+    if not active:
+        return False
+    return _gfx_is_windows_hip_supported(active, published_repo)
+
+
+def _should_auto_vulkan_for_amd_windows(host: HostInfo, published_repo: str | None = None) -> bool:
+    """True when NO AMD GPU on the host reaches the Windows HIP prebuilt floor."""
+    active = _active_rocm_gfx_target(host)
+    if not active:
+        # ROCm confirmed but gfx unknown (--has-rocm only): keep the HIP / fork / source path.
+        return False
+    if not (
+        host.is_windows
+        and host.has_rocm
+        # PHYSICAL, not merely usable: Vulkan ignores CUDA_VISIBLE_DEVICES and would
+        # enumerate a card hidden by it. Same gate as the Intel auto path below.
+        and not host.has_physical_nvidia
+    ):
+        return False
+    # Judge every PHYSICAL AMD gfx, not just the active one. The visible-device vars choose
+    # `active`, but the Vulkan runtime honours none of them (it enumerates through
+    # GGML_VK_VISIBLE_DEVICES and Vulkan ordinals), so masking down to a below-floor card
+    # must not route the install to Vulkan: the installed backend would happily enumerate
+    # the HIP-capable card the user deliberately hid, possibly one reserved for another
+    # workload. Auto-fall back only when no AMD device on the box can be exposed to HIP; an
+    # explicit vulkan opt-in is unaffected.
+    #
+    # Under a mask the probe cannot supply that inventory at all (hipinfo sees only visible
+    # devices), so "no AMD GPU here reaches the floor" is unprovable and guessing wrong is
+    # the same reserved-card handover. An all-hiding "" / "-1" is included: a forwarded
+    # --rocm-gfx still reconstructs an arch there, and auto-routing would then hand Vulkan
+    # every AMD GPU the user hid. A mask is only ever set deliberately, and the driver-only
+    # single-GPU host this fallback exists for does not set one.
+    if _hip_visible_device_mask_set():
+        return False
+    targets = list(dict.fromkeys([*_host_rocm_gfx_targets(host), active]))
+    return not any(_gfx_is_windows_hip_supported(target, published_repo) for target in targets)
+
+
+def _has_no_vulkan_prebuilt(host: HostInfo) -> bool:
+    """Platforms that ship no Vulkan prebuilt at all, so routing there is pointless.
+
+    Upstream builds win-vulkan for x64 only; Windows arm64 gets CPU plus opencl-adreno, so
+    rewriting it to Vulkan-only would just swap the published bundle for the upstream CPU
+    one. macOS is handled separately (Metal)."""
+    return host.is_windows and host.is_arm64
+
+
 def _vulkan_only_host(host: HostInfo) -> HostInfo:
     """Rewrite ``host`` so the asset selectors take their Vulkan branch.
 
@@ -6081,52 +6335,79 @@ def _vulkan_only_host(host: HostInfo) -> HostInfo:
         has_usable_nvidia = False,
         has_physical_nvidia = False,
         has_rocm = False,
+        rocm_gfx_target = None,
+        rocm_gfx_targets = [],
         has_intel_gpu = True,
     )
 
 
 def _route_to_vulkan_prebuilt(
-    host: HostInfo, published_repo: str, published_release_tag: str, *, force_cpu: bool
-) -> tuple[HostInfo, str, str]:
+    host: HostInfo,
+    published_repo: str,
+    published_release_tag: str,
+    *,
+    force_cpu: bool,
+    llama_backend: str | None = None,
+) -> tuple[HostInfo, str, str, str | None]:
     """Point a Vulkan-capable host at the upstream ggml-org Vulkan prebuilt.
 
-    The unsloth published repo ships only CUDA/ROCm/CPU assets, so Vulkan comes
-    from UPSTREAM_REPO. Two triggers route here, both suppressed when a CPU flag
-    (--cpu-fallback or --force-cpu, folded into force_cpu) wins:
-      * UNSLOTH_FORCE_VULKAN forces Vulkan over the detected CUDA/ROCm backend;
-      * an auto-detected Intel GPU with NO physical NVIDIA/ROCm -- the purpose
-        of the has_intel_gpu probe, since the fork manifest ships no Vulkan asset.
-    Applied by BOTH the install path and the --resolve-prebuilt probe so the
-    "is a prebuilt available" answer matches what actually gets installed.
+    The unsloth published repo ships only CUDA/ROCm/CPU assets, so Vulkan comes from
+    UPSTREAM_REPO. Three triggers route here, all suppressed when a CPU flag (--cpu-fallback
+    or --force-cpu, folded into force_cpu) wins:
+      * ``UNSLOTH_LLAMA_BACKEND=vulkan`` / ``UNSLOTH_FORCE_VULKAN`` / ``--llama-backend
+        vulkan`` forces Vulkan over the detected CUDA/ROCm backend;
+      * Windows AMD with no HIP-prebuilt gfx arch auto-falls back to Vulkan (#7357);
+      * an auto-detected Intel GPU with NO physical NVIDIA/ROCm, the purpose of the
+        has_intel_gpu probe, since the fork manifest ships no Vulkan asset.
+    Applied by BOTH the install path and the --resolve-prebuilt probe so the "is a prebuilt
+    available" answer matches what actually gets installed.
 
-    Returns the (possibly rewritten) host, repo, and release tag.
+    Returns the (possibly rewritten) host, repo, release tag, and a backend to persist in
+    the install marker when updates must re-assert Vulkan.
     """
-    forced = force_vulkan_requested()
-    # Gate auto-routing on no PHYSICAL NVIDIA, not merely no usable one: a mixed
-    # NVIDIA+Intel host that hides NVIDIA with CUDA_VISIBLE_DEVICES=""/-1 keeps
-    # has_physical_nvidia=True while has_usable_nvidia goes False. Vulkan ignores
-    # CUDA_VISIBLE_DEVICES, so auto-routing such a host would let it grab the
-    # reserved NVIDIA GPU. An explicit UNSLOTH_FORCE_VULKAN still overrides.
+    forced = force_vulkan_requested(llama_backend)
+    # Auto-fall back only when the run named no backend: an explicit hip/cpu is the opt-out.
+    explicit_backend = resolved_llama_backend(llama_backend)
+    auto_no_hip = explicit_backend is None and _should_auto_vulkan_for_amd_windows(
+        host, published_repo
+    )
+    # No PHYSICAL NVIDIA, not merely no usable one: Vulkan ignores CUDA_VISIBLE_DEVICES, so
+    # auto-routing a host that hides its NVIDIA card would let it grab the reserved GPU.
     auto_intel = host.has_intel_gpu and not host.has_physical_nvidia and not host.has_rocm
-    if force_cpu or not (forced or auto_intel):
-        return host, published_repo, published_release_tag
+    if force_cpu or not (forced or auto_intel or auto_no_hip):
+        return host, published_repo, published_release_tag, None
     if host.is_macos:
         if forced:
             log(
-                "UNSLOTH_FORCE_VULKAN is set but ignored on macOS "
+                "UNSLOTH_LLAMA_BACKEND=vulkan is set but ignored on macOS "
                 "(Metal is used; there is no Vulkan prebuilt)"
             )
-        return host, published_repo, published_release_tag
-    if forced:
+        return host, published_repo, published_release_tag, None
+    if _has_no_vulkan_prebuilt(host):
+        if forced:
+            log(
+                "Vulkan llama.cpp backend requested but ignored on Windows arm64 "
+                "(upstream ships no Vulkan arm64 prebuilt); keeping the published bundle"
+            )
+        return host, published_repo, published_release_tag, None
+    if auto_no_hip:
+        active = _active_rocm_gfx_target(host) or "unknown"
         log(
-            "UNSLOTH_FORCE_VULKAN is set; installing the upstream Vulkan "
-            "llama.cpp prebuilt instead of the detected GPU backend"
+            "Active AMD GPU arch is not supported by the Windows HIP prebuilt "
+            f"({active}); installing the upstream Vulkan llama.cpp prebuilt instead"
         )
-        # Forcing may override a detected NVIDIA/ROCm host, so normalize it to
-        # Vulkan-only; an auto-detected Intel host already is.
         host = _vulkan_only_host(host)
+        persist_backend = "vulkan"
+    elif forced:
+        log(
+            "Vulkan llama.cpp backend requested; installing the upstream Vulkan "
+            "prebuilt instead of the detected GPU backend"
+        )
+        host = _vulkan_only_host(host)
+        persist_backend = "vulkan"
     else:
         log("Intel GPU detected; installing the upstream Vulkan llama.cpp prebuilt")
+        persist_backend = None
     # Swapping the fork for upstream invalidates a fork release pin: the two use
     # different tag namespaces (fork b9596-mix-<sha> vs upstream b9596), so a
     # pinned fork tag would make the upstream resolver query a nonexistent
@@ -6135,7 +6416,7 @@ def _route_to_vulkan_prebuilt(
     # (repo unchanged here) is preserved.
     if published_repo != UPSTREAM_REPO:
         published_release_tag = ""
-    return host, UPSTREAM_REPO, published_release_tag
+    return host, UPSTREAM_REPO, published_release_tag, persist_backend
 
 
 def diffusion_visual_server_backfill_needed(
@@ -6299,6 +6580,7 @@ def install_prebuilt(
     override_rocm_gfx: str | None = None,
     force_cpu: bool = False,
     persist_force_cpu: bool = False,
+    llama_backend: str | None = None,
     instruction_cleanup_root: Path | None = None,
 ) -> None:
     # force_cpu drops GPU detection (mechanism, both --cpu-fallback and --force-cpu);
@@ -6310,8 +6592,12 @@ def install_prebuilt(
         override_rocm_gfx = override_rocm_gfx,
         force_cpu = force_cpu,
     )
-    host, published_repo, published_release_tag = _route_to_vulkan_prebuilt(
-        host, published_repo, published_release_tag, force_cpu = force_cpu
+    host, published_repo, published_release_tag, persist_llama_backend = _route_to_vulkan_prebuilt(
+        host,
+        published_repo,
+        published_release_tag,
+        force_cpu = force_cpu,
+        llama_backend = llama_backend,
     )
     choice: AssetChoice | None = None
     cleanup_root = install_dir if instruction_cleanup_root is None else instruction_cleanup_root
@@ -6356,6 +6642,10 @@ def install_prebuilt(
                     # Reused bundle is unchanged, but a fresh --force-cpu still must be
                     # recorded so the updater re-asserts it (#7213).
                     sync_marker_force_cpu(install_dir, persist_force_cpu)
+                    sync_marker_llama_backend(
+                        install_dir,
+                        persisted_llama_backend(persist_llama_backend, current.attempts[0]),
+                    )
                     return
             with scratch_dir("unsloth-llama-prebuilt-") as work_dir:
                 probe_path = work_dir / "stories260K.gguf"
@@ -6376,6 +6666,10 @@ def install_prebuilt(
                                 f"{plan.release_tag} upstream_tag={plan.llama_tag}; skipping reinstall"
                             )
                             sync_marker_force_cpu(install_dir, persist_force_cpu)
+                            sync_marker_llama_backend(
+                                install_dir,
+                                persisted_llama_backend(persist_llama_backend, choice),
+                            )
                             return
                     log(
                         "selected "
@@ -6398,6 +6692,7 @@ def install_prebuilt(
                             existing_install_dir = install_dir,
                             # Persist only the deliberate choice, not a transient fallback.
                             force_cpu = persist_force_cpu,
+                            llama_backend = persist_llama_backend,
                         )
                     except ExistingInstallSatisfied:
                         return
@@ -6519,6 +6814,16 @@ def parse_args() -> argparse.Namespace:
             "bundle that would revive the Intel iGPU crash (#7213)."
         ),
     )
+    parser.add_argument(
+        "--llama-backend",
+        choices = ("vulkan",),
+        help = (
+            "Force the llama.cpp prebuilt backend. vulkan installs the upstream Vulkan "
+            "bundle and records the choice so Studio updates keep it; ignored on hosts "
+            "with no Vulkan prebuilt (macOS, Windows arm64). "
+            "Same effect as UNSLOTH_LLAMA_BACKEND=vulkan / UNSLOTH_FORCE_VULKAN=1."
+        ),
+    )
     resolve_group = parser.add_mutually_exclusive_group()
     resolve_group.add_argument(
         "--resolve-llama-tag",
@@ -6683,8 +6988,12 @@ def main() -> int:
         )
         # Same Vulkan routing the install path applies, so the probe's answer
         # matches what would install (an Intel/forced-Vulkan host -> upstream).
-        host, repo, release_tag = _route_to_vulkan_prebuilt(
-            host, args.published_repo, args.published_release_tag or "", force_cpu = _cpu_mechanism
+        host, repo, release_tag, _persist_llama_backend = _route_to_vulkan_prebuilt(
+            host,
+            args.published_repo,
+            args.published_release_tag or "",
+            force_cpu = _cpu_mechanism,
+            llama_backend = args.llama_backend,
         )
         try:
             _requested, plans = resolve_simple_install_release_plans(
@@ -6726,6 +7035,7 @@ def main() -> int:
         # updater re-asserts it. --cpu-fallback stays transient and heals to GPU.
         force_cpu = args.cpu_fallback or args.force_cpu,
         persist_force_cpu = args.force_cpu,
+        llama_backend = args.llama_backend,
         instruction_cleanup_root = install_arg.absolute(),
     )
     return EXIT_SUCCESS
diff --git a/studio/install_manifest.py b/studio/install_manifest.py
new file mode 100644
index 0000000000..8f48dcf35d
--- /dev/null
+++ b/studio/install_manifest.py
@@ -0,0 +1,305 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Install-completeness manifest for Unsloth Studio.
+
+install_python_stack.py drops the manifest before the dependency pass and writes
+it back only after the last step, so its presence means "the install finished".
+Read by `unsloth studio verify-install`, `desktop-capabilities` (and through it
+the Tauri preflight) and setup.sh/setup.ps1's fast path.
+
+Without it an installer killed part-way leaves a venv with `unsloth` but not
+studio.txt's dependencies, which still answers `-h` and so looked ready right up
+until the backend died on `import structlog`.
+
+Must import inside that half-installed venv: stdlib only, `packaging` optional.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import platform
+import re
+import sys
+import time
+from pathlib import Path
+from typing import Dict, List, Optional, Tuple
+
+MANIFEST_NAME = "unsloth_install_manifest.json"
+MANIFEST_SCHEMA = 1
+
+# Fingerprinted into the manifest, relative to studio/backend/requirements/.
+# Editing one (a --local install) invalidates it and forces a dependency pass.
+TRACKED_REQUIREMENT_FILES: Tuple[str, ...] = (
+    "studio.txt",
+    "base.txt",
+    "extras.txt",
+    "extras-no-deps.txt",
+    "no-torch-runtime.txt",
+    "single-env/data-designer-deps.txt",
+    "single-env/data-designer.txt",
+)
+
+# The import chain studio/backend/run.py walks on startup.
+BOOT_REQUIREMENT_FILE = "studio.txt"
+
+
+def venv_root() -> Path:
+    """Directory holding pyvenv.cfg for the interpreter running this code."""
+    return Path(sys.prefix)
+
+
+def manifest_path(root: Optional[Path] = None) -> Path:
+    return (root or venv_root()) / MANIFEST_NAME
+
+
+def requirements_root(script_dir: Optional[Path] = None) -> Path:
+    """studio/backend/requirements/ next to this module (or a given studio/ dir)."""
+    return (script_dir or Path(__file__).resolve().parent) / "backend" / "requirements"
+
+
+def _sha256(path: Path) -> Optional[str]:
+    try:
+        return hashlib.sha256(path.read_bytes()).hexdigest()
+    except OSError:
+        return None
+
+
+def requirement_digests(req_root: Optional[Path] = None) -> Dict[str, str]:
+    """sha256 of every tracked requirement file that exists."""
+    root = req_root or requirements_root()
+    digests: Dict[str, str] = {}
+    for name in TRACKED_REQUIREMENT_FILES:
+        digest = _sha256(root / name)
+        if digest is not None:
+            digests[name] = digest
+    return digests
+
+
+def _canonical(name: str) -> str:
+    """PEP 503 normalisation, so PyJWT / pyjwt / py_jwt compare equal."""
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def _installed_version(dist_name: str, installed: Optional[Dict[str, str]] = None) -> Optional[str]:
+    if installed is not None:
+        return installed.get(_canonical(dist_name))
+    from importlib.metadata import PackageNotFoundError, version
+    try:
+        return version(dist_name)
+    except PackageNotFoundError:
+        return None
+    except Exception:
+        return None
+
+
+def remove_manifest(root: Optional[Path] = None) -> bool:
+    """Called before the dependency pass so an aborted run cannot leave a valid one.
+
+    True when no manifest remains. A surviving marker (Windows raises on a
+    read-only or locked file) still names this version and these digests, so a
+    pass killed afterwards would verify as complete.
+    """
+    try:
+        manifest_path(root).unlink()
+    except FileNotFoundError:
+        return True
+    except OSError:
+        return False
+    return True
+
+
+def write_manifest(
+    root: Optional[Path] = None,
+    req_root: Optional[Path] = None,
+    steps_total: int = 0,
+    package_name: str = "unsloth",
+) -> Optional[Path]:
+    """Record a completed install. Never raises: no manifest reads as incomplete,
+    which is the safe answer."""
+    payload = {
+        "schema": MANIFEST_SCHEMA,
+        "completed_at_ms": int(time.time() * 1000),
+        "package": package_name,
+        "package_version": _installed_version(package_name),
+        "python": platform.python_version(),
+        "platform": f"{sys.platform}-{platform.machine()}",
+        "prefix": str(venv_root()),
+        "steps_total": steps_total,
+        "requirement_files": requirement_digests(req_root),
+    }
+    path = manifest_path(root)
+    try:
+        tmp = path.with_suffix(".json.tmp")
+        tmp.write_text(json.dumps(payload, indent = 2, sort_keys = True), encoding = "utf-8")
+        os.replace(tmp, path)
+        return path
+    except OSError:
+        return None
+
+
+def read_manifest(root: Optional[Path] = None) -> Optional[dict]:
+    try:
+        raw = manifest_path(root).read_text(encoding = "utf-8")
+    except OSError:
+        return None
+    try:
+        data = json.loads(raw)
+    except ValueError:
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def _parse_requirement_line(line: str) -> Optional[Tuple[str, str, str]]:
+    """(distribution name, marker, specifier) for a requirement, or None.
+
+    Covers what studio.txt uses: names, specifiers, inline comments, markers.
+    pip flags are skipped.
+    """
+    text = line.split("#", 1)[0].strip()
+    if not text or text.startswith("-"):
+        return None
+    try:
+        from packaging.requirements import Requirement
+        requirement = Requirement(text)
+        return (
+            requirement.name,
+            str(requirement.marker or ""),
+            str(requirement.specifier),
+        )
+    except Exception:
+        pass
+    marker = ""
+    if ";" in text:
+        text, marker = text.split(";", 1)
+        marker = marker.strip()
+    name = text.strip()
+    for sep in ("===", "==", ">=", "<=", "~=", "!=", ">", "<", "[", " "):
+        idx = name.find(sep)
+        if idx > 0:
+            name = name[:idx]
+    name = name.strip()
+    return (name, marker, "") if name else None
+
+
+def _marker_applies(marker: str) -> bool:
+    """True when the environment marker matches (or cannot be evaluated)."""
+    if not marker:
+        return True
+    try:
+        from packaging.markers import Marker
+    except Exception:
+        # No packaging: assume it applies. Over-reporting costs one extra pass.
+        return True
+    try:
+        return bool(Marker(marker).evaluate())
+    except Exception:
+        return True
+
+
+def _version_satisfies(version: str, specifier: str) -> bool:
+    if not specifier:
+        return True
+    try:
+        from packaging.specifiers import SpecifierSet
+        return SpecifierSet(specifier).contains(version)
+    except Exception:
+        return False
+
+
+def missing_requirements(
+    req_file: Optional[Path] = None, installed: Optional[Dict[str, str]] = None
+) -> List[str]:
+    """Distribution names that are missing or outside their required versions.
+
+    Checked via importlib.metadata, not import names, because studio.txt lists
+    PyJWT / python-docx / pymupdf whose import names (jwt, docx, fitz) differ.
+
+    `installed` (canonical distribution name -> version) checks a venv other
+    than the one running this code, which importlib.metadata cannot see.
+    """
+    from importlib.metadata import PackageNotFoundError, distribution
+
+    path = req_file or (requirements_root() / BOOT_REQUIREMENT_FILE)
+    try:
+        lines = path.read_text(encoding = "utf-8").splitlines()
+    except OSError:
+        return []
+
+    missing: List[str] = []
+    for line in lines:
+        parsed = _parse_requirement_line(line)
+        if parsed is None:
+            continue
+        name, marker, specifier = parsed
+        if not _marker_applies(marker):
+            continue
+        if installed is not None:
+            version = installed.get(_canonical(name))
+            if version is None or not _version_satisfies(version, specifier):
+                missing.append(name)
+            continue
+        try:
+            dist = distribution(name)
+        except PackageNotFoundError:
+            missing.append(name)
+        except Exception:
+            missing.append(name)
+        else:
+            if not _version_satisfies(dist.version, specifier):
+                missing.append(name)
+    return missing
+
+
+def verify_install(
+    root: Optional[Path] = None,
+    req_root: Optional[Path] = None,
+    package_name: str = "unsloth",
+    installed: Optional[Dict[str, str]] = None,
+) -> dict:
+    """Report whether the managed install finished and can still boot.
+
+    Reason strings are surfaced verbatim by the desktop preflight as its
+    staleness reason, so keep them stable.
+
+    Pass `installed` (and the matching `root` / `req_root`) to describe a venv
+    other than this interpreter's; without it the version and dependency checks
+    would answer for the venv the caller happens to be running in.
+    """
+    reqs = req_root or requirements_root()
+    missing = missing_requirements(reqs / BOOT_REQUIREMENT_FILE, installed = installed)
+    deps_ok = not missing
+
+    manifest = read_manifest(root)
+    manifest_ok = False
+    reason: Optional[str] = None
+
+    if manifest is None:
+        reason = "studio_install_incomplete"
+    elif manifest.get("schema") != MANIFEST_SCHEMA:
+        reason = "studio_install_manifest_schema"
+    else:
+        # `update --package X` records X, so comparing against unsloth would
+        # report a permanent version change.
+        current = _installed_version(manifest.get("package") or package_name, installed)
+        recorded = manifest.get("package_version")
+        if current and recorded and current != recorded:
+            reason = "studio_install_version_changed"
+        elif manifest.get("requirement_files") != requirement_digests(reqs):
+            reason = "studio_install_requirements_changed"
+        else:
+            manifest_ok = True
+
+    if manifest_ok and not deps_ok:
+        # Install finished but the boot deps are gone: venv edited afterwards.
+        reason = "studio_deps_missing"
+
+    return {
+        "ok": manifest_ok and deps_ok,
+        "manifest_ok": manifest_ok,
+        "deps_ok": deps_ok,
+        "missing": missing,
+        "reason": None if (manifest_ok and deps_ok) else (reason or "studio_deps_missing"),
+    }
diff --git a/studio/install_python_stack.py b/studio/install_python_stack.py
index a91f26910f..4004a3b048 100644
--- a/studio/install_python_stack.py
+++ b/studio/install_python_stack.py
@@ -28,6 +28,9 @@ _BACKEND_DIR = Path(__file__).resolve().parent / "backend"
 if str(_BACKEND_DIR) not in sys.path:
     sys.path.insert(1, str(_BACKEND_DIR))
 
+# setup.sh/setup.ps1 invoke this by path, so its directory is sys.path[0].
+import install_manifest  # noqa: E402
+
 from backend.utils.wheel_utils import (
     flash_attn_package_version,
     flash_attn_wheel_url,
@@ -94,6 +97,40 @@ def _strix_needs_amd_arch_index(ver: tuple[int, int]) -> bool:
     return key is not None and key < _ROCM_ARCH_INDEX_FLOOR
 
 
+# MI50 / Radeon VII (gfx906, Vega 20): rocm6.4+/7.x wheels bundle ROCm libraries
+# whose Tensile kernels dropped gfx906 (rocBLAS "TensileLibrary.dat ... not read
+# for gfx906", ROCm/TheRock#1844), failing at the first BLAS call. The rocm6.3
+# index is the last one whose wheels run on gfx906 (torch 2.7.0 verified on MI50
+# 32GB; up to 2.9 in community use). Uses the _default (<2.11) pkg specs -- the
+# rocm7.2 floor of 2.11 cannot be satisfied there. Mirrors install.sh.
+_GFX906_LEGACY_TAG = "rocm6.3"
+
+
+def _gfx906_needs_legacy_index(ver: tuple[int, int]) -> bool:
+    """True when the generic tag picked for the host ROCm version is newer than
+    rocm6.3, i.e. its wheels lack gfx906 kernels and must be rerouted."""
+    key = next((k for k in sorted(_ROCM_TORCH_INDEX, reverse = True) if ver >= k), None)
+    return key is not None and key > (6, 3)
+
+
+def _runtime_target_is_gfx906() -> bool:
+    """True when the runtime GPU target is gfx906 (MI50 / Radeon VII).
+
+    An explicit UNSLOTH_ROCM_GFX_ARCH wins (mirrors _infer_linux_amd_gfx_arch /
+    the display path), so a host whose rocminfo/amd-smi emit no gfx token can
+    still opt in. Otherwise report gfx906 only when it is the SOLE distinct arch:
+    _detect_amd_gfx_codes() de-duplicates arches, which loses per-device ordinals
+    on a mixed host, so a non-gfx906 selection is never mis-identified as gfx906
+    (and downgraded to rocm6.3). Mixed gfx906+dGPU hosts opt in with the env var.
+    """
+    # Normalize a copied HIP gcnArchName (gfx906:sramecc-:xnack- -> gfx906) so the
+    # feature-flag suffix does not defeat the exact comparison (mirrors device_type.py).
+    override = (os.environ.get("UNSLOTH_ROCM_GFX_ARCH") or "").strip().lower().split(":")[0]
+    if override:
+        return override == "gfx906"
+    return set(_detect_amd_gfx_codes()) == {"gfx906"}
+
+
 # AMD per-arch leaves needing the torch 2.11 floor (the _grouped_mm <2.11 bug).
 # Mirrors *FloorMap in install.ps1 / setup.ps1; other arches ship <2.11 and stay bare.
 _ROCM_GFX_TORCH211_LEAVES: frozenset[str] = frozenset(
@@ -939,6 +976,34 @@ def _detect_bnb_rocm_dll_ver() -> str | None:
     return max(all_vers, key = lambda v: int(v)) if all_vers else None
 
 
+# Set right before the base unsloth install (which resolves its unconditional
+# bitsandbytes dependency); read by _ensure_rocm_torch to drop a freshly pulled
+# generic wheel on gfx906 while leaving a pre-existing source build untouched.
+_GFX906_BNB_ABSENT_BEFORE_BASE = False
+
+
+def _bitsandbytes_installed() -> bool:
+    """True if bitsandbytes is importable in the target venv. Runs a fresh
+    subprocess so a package installed earlier this run is seen; only checks the
+    spec (does NOT import bitsandbytes)."""
+    try:
+        return (
+            subprocess.run(
+                [
+                    sys.executable,
+                    "-c",
+                    "import importlib.util, sys; "
+                    "sys.exit(0 if importlib.util.find_spec('bitsandbytes') else 1)",
+                ],
+                capture_output = True,
+                timeout = 60,
+            ).returncode
+            == 0
+        )
+    except Exception:
+        return False
+
+
 _BNB_ROCM_SITECUSTOMIZE_BEGIN = "# BEGIN Unsloth BNB_ROCM_VERSION"
 _BNB_ROCM_SITECUSTOMIZE_END = "# END Unsloth BNB_ROCM_VERSION"
 _BNB_ROCM_VERSION_SOURCE_ENV = "UNSLOTH_BNB_ROCM_VERSION_SOURCE"
@@ -1890,13 +1955,25 @@ def _ensure_rocm_torch() -> None:
             )
             rocm_torch_ready = True
 
+    # An explicit UNSLOTH_ROCM_GFX_ARCH=gfx906 pins the runtime target to the
+    # MI50 / Radeon VII path; it must win over the Strix probe-order detection
+    # below (a mixed Strix + MI50 host could otherwise route to gfx1151), so the
+    # Strix override is skipped when it is set.
+    _gfx906_arch_override = (os.environ.get("UNSLOTH_ROCM_GFX_ARCH") or "").strip().lower().split(
+        ":"
+    )[0] == "gfx906"
+
     # Strix Halo / Point (gfx1151 / gfx1150) need torch from AMD's per-gfx index
     # (2.11+rocm7.13); any generic pytorch.org rocm index lacks the fixes (ROCm 7.1
     # segfaults in _grouped_mm). See _strix_needs_amd_arch_index for the floor gate.
     _strix_override_url: "str | None" = None
     _strix_override_pkgs: "tuple[str, str, str] | None" = None
     # An explicit ROCm pin is authoritative: never auto-reroute it.
-    if _strix_needs_amd_arch_index(ver) and _explicit_rocm_torch_index_url() is None:
+    if (
+        _strix_needs_amd_arch_index(ver)
+        and _explicit_rocm_torch_index_url() is None
+        and not _gfx906_arch_override
+    ):
         gfx_codes = _detect_amd_gfx_codes()
         _strix_gfx = {"gfx1151", "gfx1150", "gfx1152"}
         _detected_strix = _strix_gfx.intersection(gfx_codes)
@@ -1933,6 +2010,34 @@ def _ensure_rocm_torch() -> None:
                     f"   skipping AMD per-gfx index override.\n"
                 )
 
+    # gfx906 (MI50 / Radeon VII): is this the runtime GPU target? Used below to skip
+    # the generic bitsandbytes wheel (no gfx906 kernels). This must hold even under
+    # an explicit torch-index pin: a gfx906 host that pins rocm6.3 (without also
+    # setting UNSLOTH_ROCM_GFX_ARCH) would otherwise reinstall the prebuilt bnb wheel
+    # over the user's source-built gfx906 bnb. So a pin suppresses only the torch
+    # reroute (_gfx906_override below), NOT the gfx906 detection for the bnb skip.
+    _runtime_is_gfx906 = _gfx906_arch_override or _runtime_target_is_gfx906()
+    # Reroute torch to the last gfx906-capable wheel family (rocm6.3) only when the
+    # host ROCm version would otherwise pick a newer, kernel-less index -- and never
+    # over an explicit pin or an active Strix reroute (the pin/Strix path installs
+    # its own index; only the bnb skip must still apply on those paths).
+    _gfx906_override = (
+        _runtime_is_gfx906
+        and _gfx906_needs_legacy_index(ver)
+        and _explicit_rocm_torch_index_url() is None
+        and _strix_override_url is None
+    )
+    if _gfx906_override:
+        print(
+            f"\n   gfx906 (MI50 / Radeon VII / Vega 20) is the runtime target with ROCm "
+            f"{ver[0]}.{ver[1]}.\n"
+            f"   Routing torch install to the {_GFX906_LEGACY_TAG} index: the last wheel\n"
+            f"   family that runs on gfx906 (newer rocm wheels ship without gfx906 BLAS\n"
+            f"   kernels and fail at first use). gfx906 is a community-maintained legacy\n"
+            f"   path: 16-bit LoRA and full finetuning work; bitsandbytes 4-bit QLoRA\n"
+            f"   requires a source build of bitsandbytes for gfx906 (see docs.unsloth.ai/amd).\n"
+        )
+
     # The Strix override must fire even when has_hip_torch is True: an existing
     # torch.version.hip == "7.1" is exactly the broken combo it repairs.
     if _strix_override_url is not None and _strix_override_pkgs is not None:
@@ -1954,6 +2059,29 @@ def _ensure_rocm_torch() -> None:
             constrain = False,
         )
         rocm_torch_ready = True
+    # gfx906 fires even when has_hip_torch is True: a +rocm7.x build IS the broken
+    # combo it repairs. A torch already on rocm6.3 wheels is left alone (the tag
+    # check below is False, and rocm_torch_ready is already True from has_hip_torch,
+    # so the generic fallback is skipped).
+    elif _gfx906_override and _GFX906_LEGACY_TAG not in _installed_torch_ver:
+        index_url = f"{_PYTORCH_WHL_BASE}/{_GFX906_LEGACY_TAG}"
+        _torch_pkg, _vision_pkg, _audio_pkg = _ROCM_TORCH_PKG_SPECS["_default"]
+        print(
+            f"   gfx906 legacy override -- installing torch from "
+            f"{_strip_index_url_credentials(index_url)}"
+        )
+        pip_install(
+            f"ROCm torch (gfx906, {_GFX906_LEGACY_TAG})",
+            "--force-reinstall",
+            "--no-cache-dir",
+            _torch_pkg,
+            _vision_pkg,
+            _audio_pkg,
+            "--index-url",
+            index_url,
+            constrain = False,
+        )
+        rocm_torch_ready = True
     elif not rocm_torch_ready:
         # Reinstall when torch is not ROCm yet, OR a ROCm build's family differs from a pin.
         # Gate on rocm_torch_ready (not has_hip_torch alone) so a successful inferred-gfx
@@ -2002,11 +2130,33 @@ def _ensure_rocm_torch() -> None:
             )
             rocm_torch_ready = True
 
+    # gfx906 has no prebuilt bitsandbytes: the continuous-release/PyPI wheels ship
+    # no gfx906 kernels, and force-reinstalling them would clobber a user's
+    # source-built bnb (the only 4-bit path on this arch) on every `studio update`.
+    # Skip the auto-install and leave whatever bnb is present.
+    if rocm_torch_ready and _runtime_is_gfx906:
+        print(
+            _dim(
+                "   gfx906: skipping prebuilt bitsandbytes (no gfx906 kernels). "
+                "Build bitsandbytes from source for 4-bit QLoRA -- "
+                "see docs.unsloth.ai/get-started/install-and-update/amd."
+            )
+        )
+        # The base install resolves unsloth's unconditional bitsandbytes dep to a
+        # generic CUDA wheel with no gfx906 kernels ("invalid device function" at
+        # 4-bit use). Drop it if this run pulled it in; a pre-existing source build
+        # (present before the base install) is left untouched.
+        if _GFX906_BNB_ABSENT_BEFORE_BASE and _bitsandbytes_installed():
+            print(_dim("   gfx906: removing generic bitsandbytes pulled in as a dependency"))
+            subprocess.run(
+                [sys.executable, "-m", "pip", "uninstall", "-y", "bitsandbytes"],
+                capture_output = True,
+            )
     # Install bitsandbytes only when torch links against ROCm. Prefers the
     # continuous-release_main wheel (bnb PR #1887 4-bit GEMV fix), falling back
     # to PyPI when the pre-release wheel won't install. Use pip for the
     # pre-release wheel because uv rejects its filename/metadata version mismatch.
-    if rocm_torch_ready:
+    elif rocm_torch_ready:
         _bnb_url = _bnb_rocm_prerelease_url()
         _bnb_installed = False
         if _bnb_url is not None:
@@ -2709,6 +2859,18 @@ def install_python_stack() -> int:
             base_total += 2  # flash-attn + torch final repair (step 13), Linux
     _TOTAL = (base_total - 1) if skip_base else base_total
 
+    # Drop it up front: a missing manifest is what tells the CLI, setup.sh and
+    # the preflight that an interrupted run left the venv half-built. Stop if it
+    # survives rather than mutate the venv behind a marker that still verifies.
+    if not install_manifest.remove_manifest():
+        print(
+            f"error: could not remove the stale {install_manifest.MANIFEST_NAME} in "
+            f"{install_manifest.venv_root()}; refusing to install behind a marker "
+            "that would still report this venv as complete",
+            file = sys.stderr,
+        )
+        return 1
+
     # 1. Try uv for faster installs (before pip upgrade -- uv venvs don't
     #    include pip by default).
     USE_UV = _bootstrap_uv()
@@ -2767,6 +2929,13 @@ def install_python_stack() -> int:
             "mlx-vlm",
         )
 
+    # gfx906: the base install below resolves unsloth's unconditional bitsandbytes
+    # dep to a generic CUDA wheel (no gfx906 kernels). Record bnb's presence now so
+    # _ensure_rocm_torch can drop a freshly pulled wheel while keeping a source build.
+    global _GFX906_BNB_ABSENT_BEFORE_BASE
+    if not skip_base:
+        _GFX906_BNB_ABSENT_BEFORE_BASE = not _bitsandbytes_installed()
+
     # 3. Core packages: unsloth-zoo + unsloth (or custom package name)
     if skip_base:
         pass
@@ -3080,6 +3249,23 @@ def install_python_stack() -> int:
         **_windows_hidden_subprocess_kwargs(),
     )
 
+    # 15. Record success. Written last so an earlier kill leaves none. Exiting 0
+    # without it reports a finished install every later check calls unfinished.
+    if (
+        install_manifest.write_manifest(
+            req_root = REQ_ROOT,
+            steps_total = _TOTAL,
+            package_name = package_name,
+        )
+        is None
+    ):
+        print(
+            f"error: could not write {install_manifest.MANIFEST_NAME} to "
+            f"{install_manifest.venv_root()}",
+            file = sys.stderr,
+        )
+        return 1
+
     _step(_LABEL, "installed")
     return 0
 
diff --git a/studio/setup.ps1 b/studio/setup.ps1
index bb21ce2da6..ea84068809 100644
--- a/studio/setup.ps1
+++ b/studio/setup.ps1
@@ -74,6 +74,20 @@ $script:NvccPath = $null
 $script:CudaToolkitRoot = $null
 $script:CudaArch = $null
 
+function Exit-SetupFailure {
+    param(
+        [Parameter(Mandatory = $true)][string]$Message,
+        [int]$Code = 1
+    )
+    if ($Code -eq 0) { $Code = 1 }
+    if (@("1", "true") -contains $env:UNSLOTH_TAURI_MODE) {
+        $singleLine = ($Message -replace '[\r\n]+', ' ').Trim()
+        [Console]::Out.WriteLine("[TAURI:ERROR] $singleLine")
+        [Console]::Out.Flush()
+    }
+    exit $Code
+}
+
 # Detect if running from pip install (no frontend/ dir in studio)
 $FrontendDir = Join-Path $ScriptDir "frontend"
 $OxcValidatorDir = Join-Path $ScriptDir "backend\core\data_recipe\oxc-validator"
@@ -851,7 +865,7 @@ function Ensure-BuildToolsForLlamaSourceBuild {
         Write-Host "        Manual install:" -ForegroundColor Red
         Write-Host '        1. winget install Microsoft.VisualStudio.2022.BuildTools --source winget' -ForegroundColor Yellow
         Write-Host '        2. Open Visual Studio Installer -> Modify -> check "Desktop development with C++"' -ForegroundColor Yellow
-        exit 1
+        Exit-SetupFailure "Visual Studio Build Tools are required for the llama.cpp source build"
     }
 }
 
@@ -1652,7 +1666,7 @@ if (-not $HasGit) {
     if (-not $HasGit) {
         Write-Host "[ERROR] Git is required but could not be installed automatically." -ForegroundColor Red
         Write-Host "        Install Git from https://git-scm.com/download/win and re-run." -ForegroundColor Red
-        exit 1
+        Exit-SetupFailure "Git is required but could not be installed automatically"
     }
     step "git" "$(git --version)"
 } else {
@@ -1821,7 +1835,7 @@ if (-not $NvccPath -and $IncompatibleToolkit) {
     Write-Host "========================================================================" -ForegroundColor Red
     Write-Host "[ERROR] CUDA source build cannot use the installed toolkit with this driver." -ForegroundColor Red
     Write-Host "========================================================================" -ForegroundColor Red
-    exit 1
+    Exit-SetupFailure "The installed CUDA toolkit is incompatible with the current driver"
 }
 
 # -- No toolkit at all: install via winget (only when a source build needs it) --
@@ -1893,7 +1907,7 @@ if (-not $NvccPath) {
     } else {
         Write-Host "        Install CUDA Toolkit from https://developer.nvidia.com/cuda-downloads" -ForegroundColor Yellow
     }
-    exit 1
+    Exit-SetupFailure "A compatible CUDA Toolkit could not be found or installed"
 }
 
 # -- Set CUDA env vars so cmake AND MSBuild can find the toolkit --
@@ -2043,7 +2057,7 @@ if (-not $IsPipInstall) {
         if (-not (Test-Path -LiteralPath $NodeOverride -PathType Container)) {
             Write-Host "ERROR: UNSLOTH_STUDIO_HOME/STUDIO_HOME=$NodeOverride does not exist." -ForegroundColor Red
             Write-Host "       Run install.ps1 to create the install root before 'unsloth studio update'." -ForegroundColor Red
-            exit 1
+            Exit-SetupFailure "UNSLOTH_STUDIO_HOME/STUDIO_HOME=$NodeOverride does not exist"
         }
         $NodeParent = (Resolve-Path -LiteralPath $NodeOverride).Path
         # An override pointing at the legacy default maps to the legacy sibling
@@ -2227,7 +2241,7 @@ if ($PythonOk) {
     if (-not $HasPython) {
         Write-Host "[ERROR] Python could not be installed automatically." -ForegroundColor Red
         Write-Host "        Install Python 3.12 from https://python.org/downloads/" -ForegroundColor Yellow
-        exit 1
+        Exit-SetupFailure "Python could not be installed automatically"
     }
     step "python" "$(python --version 2>&1)"
     $PythonOk = $true
@@ -2237,7 +2251,7 @@ if ($PythonOk) {
     Write-Host "[ERROR] No supported Python (3.11-3.13) found on this system." -ForegroundColor Red
     Write-Host "        py.exe could not locate -3.11/-3.12/-3.13 and `python` on PATH is unsupported." -ForegroundColor Yellow
     Write-Host "        Install Python 3.12 from https://python.org/downloads/" -ForegroundColor Yellow
-    exit 1
+    Exit-SetupFailure "No supported Python 3.11-3.13 was found"
 }
 
 # Add user-scheme Python Scripts dir to PATH (nt_user only, no venv fallback).
@@ -2319,7 +2333,7 @@ if ($NeedNodeForSetup) {
             if (-not (Test-Path -LiteralPath $nodeOwnedMarker) -and -not (Test-Path -LiteralPath $nodeMeta)) {
                 Write-Host "[ERROR] $NodeDir already exists and is not an Unsloth-owned Node install." -ForegroundColor Red
                 Write-Host "        Move it aside or choose an empty UNSLOTH_STUDIO_HOME before re-running." -ForegroundColor Yellow
-                exit 1
+                Exit-SetupFailure "$NodeDir is not an Unsloth-owned Node install"
             }
         }
         substep "installing isolated Node (system Node/npm left untouched)..."
@@ -2331,12 +2345,12 @@ if ($NeedNodeForSetup) {
         if ($nodeExit -eq 3) {
             Write-Host $nodeOut -ForegroundColor DarkGray
             step "node" "install blocked by another active Unsloth install" "Red"
-            exit 3
+            Exit-SetupFailure "Node install is blocked by another active Unsloth install" 3
         } elseif ($nodeExit -ne 0) {
             Write-Host $nodeOut -ForegroundColor DarkGray
             Write-Host "[ERROR] Could not install an isolated Node automatically." -ForegroundColor Red
             Write-Host "        Install Node >= 20.19 (with npm >= 11) from https://nodejs.org/ and re-run, or check your network." -ForegroundColor Yellow
-            exit 1
+            Exit-SetupFailure "Could not install an isolated Node runtime"
         }
         if ($NodeOverride -and (Test-Path -LiteralPath $NodeDir -PathType Container)) {
             New-Item -ItemType File -Force -Path (Join-Path $NodeDir ".unsloth-studio-owned") -ErrorAction SilentlyContinue | Out-Null
@@ -2456,7 +2470,7 @@ if ($NeedFrontendBuild -and -not $IsPipInstall) {
             Write-Host "[ERROR] npm install failed (exit code $npmExit)" -ForegroundColor Red
             Write-Host "   Try running 'npm install' manually in frontend/ to see errors" -ForegroundColor Yellow
             Show-NpmRegistryHint
-            exit 1
+            Exit-SetupFailure "Frontend dependency installation failed (exit code $npmExit)"
         }
     }
 
@@ -2467,7 +2481,7 @@ if ($NeedFrontendBuild -and -not $IsPipInstall) {
         $ErrorActionPreference = $prevEAP_npm
         foreach ($gi in $HiddenGitignores) { Rename-Item -Path "$gi._twbuild" -NewName (Split-Path $gi -Leaf) -Force -ErrorAction SilentlyContinue }
         Write-Host "[ERROR] npm run build failed (exit code $buildExit)" -ForegroundColor Red
-        exit 1
+        Exit-SetupFailure "Frontend build failed (exit code $buildExit)"
     }
     Pop-Location
     $ErrorActionPreference = $prevEAP_npm
@@ -2498,7 +2512,7 @@ if ((Test-Path $OxcValidatorDir) -and $NodeSource -ne "skip" -and (Get-Command n
         $ErrorActionPreference = $prevEAP_oxc
         Write-Host "[ERROR] OXC validator npm install failed (exit code $oxcInstallExit)" -ForegroundColor Red
         Show-NpmRegistryHint
-        exit 1
+        Exit-SetupFailure "OXC validator dependency installation failed (exit code $oxcInstallExit)"
     }
     Pop-Location
     $ErrorActionPreference = $prevEAP_oxc
@@ -2597,7 +2611,7 @@ if (-not $PythonCmd) {
     Write-Host "[ERROR] No standalone Python 3.11-3.13 found (conda Python is not supported)." -ForegroundColor Red
     Write-Host "        Install Python from https://python.org/downloads/ or via:" -ForegroundColor Yellow
     Write-Host "        winget install -e --id Python.Python.3.12" -ForegroundColor Yellow
-    exit 1
+    Exit-SetupFailure "No standalone Python 3.11-3.13 was found"
 }
 
 substep "Python found: $PythonCmd"
@@ -2630,12 +2644,12 @@ if ($_studioOverride) {
             Remove-Item -LiteralPath $_setupWriteProbe -Force -ErrorAction SilentlyContinue
         } catch {
             Write-Host "ERROR: $_studioOverrideVar=$StudioHome is not writable." -ForegroundColor Red
-            exit 1
+            Exit-SetupFailure "$_studioOverrideVar=$StudioHome is not writable"
         }
     } else {
         Write-Host "ERROR: $_studioOverrideVar=$_studioOverride does not exist." -ForegroundColor Red
         Write-Host "       Run install.ps1 to create the install root before 'unsloth studio update'." -ForegroundColor Red
-        exit 1
+        Exit-SetupFailure "$_studioOverrideVar=$_studioOverride does not exist"
     }
 } else {
     $StudioHome = Join-Path $env:USERPROFILE ".unsloth\studio"
@@ -2679,7 +2693,7 @@ function Assert-StudioOwnedOrAbsent {
         }
         Write-Host "[ERROR] $Path already exists and is not marked as an Unsloth-owned $Label." -ForegroundColor Red
         Write-Host "        Move it aside or choose an empty UNSLOTH_STUDIO_HOME before re-running." -ForegroundColor Yellow
-        exit 1
+        Exit-SetupFailure "$Label path is not an Unsloth-owned install: $Path"
     }
 }
 function Mark-StudioOwned {
@@ -2815,7 +2829,7 @@ if ((Test-Path -LiteralPath $VenvDir -PathType Container) -and -not $NoTorchMode
             substep "Stale venv detected ($reason)." "Yellow"
             Write-Host "   [ERROR] The existing Unsloth environment needs repair." -ForegroundColor Red
             Write-Host "           Re-run install.ps1 so it can replace the environment safely with rollback." -ForegroundColor Yellow
-            exit 1
+            Exit-SetupFailure "The existing Unsloth environment needs repair"
         }
         substep "Stale venv detected ($reason) -- rebuilding..." "Yellow"
         # why: mirror install.ps1 env-mode guard so an update against a custom
@@ -2829,14 +2843,14 @@ if ((Test-Path -LiteralPath $VenvDir -PathType Container) -and -not $NoTorchMode
         ) {
             Write-Host "[ERROR] $VenvDir already exists but does not look like an Unsloth Studio install." -ForegroundColor Red
             Write-Host "        Move it aside or choose an empty UNSLOTH_STUDIO_HOME before re-running." -ForegroundColor Yellow
-            exit 1
+            Exit-SetupFailure "$VenvDir is not an Unsloth Studio environment"
         }
         try {
             Remove-Item -LiteralPath $VenvDir -Recurse -Force -ErrorAction Stop
         } catch {
             Write-Host "   [ERROR] Could not remove stale venv: $($_.Exception.Message)" -ForegroundColor Red
             Write-Host "           Close any running Unsloth/Python processes and re-run setup." -ForegroundColor Red
-            exit 1
+            Exit-SetupFailure "Could not remove the stale environment at $VenvDir"
         }
     }
 }
@@ -2845,7 +2859,7 @@ if (-not (Test-Path -LiteralPath $VenvDir)) {
     Write-Host "[ERROR] Virtual environment not found at $VenvDir" -ForegroundColor Red
     Write-Host "        Run install.ps1 first to create the environment:" -ForegroundColor Yellow
     Write-Host "        irm https://unsloth.ai/install.ps1 | iex" -ForegroundColor Yellow
-    exit 1
+    Exit-SetupFailure "Virtual environment not found at $VenvDir"
 } else {
     substep "reusing existing virtual environment at $VenvDir"
     $_venvPyExe = Join-Path $VenvDir "Scripts\python.exe"
@@ -2963,6 +2977,26 @@ sys.exit(0 if (major, minor) >= (4, 14) else 1)
             substep "anyio >=4.14 found (#6483) -- forcing dependency pass to repair..." "Cyan"
             $SkipPythonDeps = $false
         }
+        # An interrupted install leaves $_PkgName current while studio.txt
+        # never finished, so the compare above says "up to date" and update --
+        # plus the desktop Repair button -- no-ops on a venv that cannot boot.
+        $_studioInstallIncomplete = $false
+        try {
+            & python -c "
+import sys
+sys.path.insert(0, sys.argv[1])
+try:
+    import install_manifest
+except Exception:
+    sys.exit(0)  # older tree without the manifest helper: leave the fast path alone
+sys.exit(0 if install_manifest.verify_install()['ok'] else 1)
+" "$PSScriptRoot" 2>$null
+            if ($LASTEXITCODE -ne 0) { $_studioInstallIncomplete = $true }
+        } catch {}
+        if ($_studioInstallIncomplete) {
+            substep "studio install incomplete -- forcing dependency pass to repair..." "Cyan"
+            $SkipPythonDeps = $false
+        }
         # ...but not if an AMD GPU is present and installed PyTorch is CPU-only
         # (host predates ROCm-wheel support, or GPU added later): the fast "up to
         # date" path would leave the user on CPU torch with Train/Export disabled.
@@ -3009,6 +3043,28 @@ if ($script:PinChangedForceReinstall) { $SkipPythonDeps = $false }
 
 if (-not $SkipPythonDeps) {
 
+# install_python_stack.py drops the manifest before its own dependency pass, but
+# pip, torch and triton are replaced first here. Drop it now so a run killed in
+# those leaves the venv marked half-built, not behind a marker that verifies.
+$_ManifestDropped = $true
+try {
+    & python -c "
+import sys
+sys.path.insert(0, sys.argv[1])
+try:
+    import install_manifest
+except Exception:
+    sys.exit(0)  # older tree without the manifest helper
+sys.exit(0 if install_manifest.remove_manifest() else 1)
+" "$PSScriptRoot" 2>$null
+    if ($LASTEXITCODE -ne 0) { $_ManifestDropped = $false }
+} catch { $_ManifestDropped = $false }
+if (-not $_ManifestDropped) {
+    Write-Host "[ERROR] Could not remove the stale unsloth_install_manifest.json." -ForegroundColor Red
+    Write-Host "        Refusing to install behind a marker that still reports this venv as complete." -ForegroundColor Red
+    exit 1
+}
+
 if ($script:UnslothVerbose) {
     Fast-Install --upgrade pip
 } else {
@@ -3216,7 +3272,7 @@ if (-not $ROCmIndexUrl -and ($CuTag -eq "cpu" -or $ROCmCpuFallback)) {
     if ($torchInstallExit -ne 0) {
         Write-Host "[FAILED] PyTorch install failed (exit code $torchInstallExit)" -ForegroundColor Red
         Write-Host (Redact-InstallOutput $output) -ForegroundColor Red
-        exit 1
+        Exit-SetupFailure "PyTorch installation failed (exit code $torchInstallExit)"
     }
 } elseif (-not $ROCmIndexUrl) {
     substep "installing PyTorch with CUDA support ($CuTag)..."
@@ -3248,7 +3304,7 @@ if (-not $ROCmIndexUrl -and ($CuTag -eq "cpu" -or $ROCmCpuFallback)) {
     if ($torchInstallExit -ne 0) {
         Write-Host "[FAILED] PyTorch CUDA install failed (exit code $torchInstallExit)" -ForegroundColor Red
         Write-Host (Redact-InstallOutput $output) -ForegroundColor Red
-        exit 1
+        Exit-SetupFailure "PyTorch CUDA installation failed (exit code $torchInstallExit)"
     }
 
     # Install Triton for Windows (enables torch.compile -- without it training can hang)
@@ -3284,7 +3340,7 @@ $ErrorActionPreference = $prevEAP
 if ($stackExit -ne 0) {
     Write-Host "[FAILED] Python dependency installation failed (exit code $stackExit)" -ForegroundColor Red
     Write-Host "   Re-run the installer or check the error above for details." -ForegroundColor Red
-    exit 1
+    Exit-SetupFailure "Python dependency installation failed (exit code $stackExit)"
 }
 
 } else {
@@ -3362,7 +3418,7 @@ foreach ($pkg in @("transformers==5.3.0", "huggingface_hub==1.8.0", "hf_xet==1.4
         Write-Host "[FAIL] Could not install $pkg into .venv_t5_530/" -ForegroundColor Red
         Write-Host (Redact-InstallOutput $output) -ForegroundColor Red
         $ErrorActionPreference = $prevEAP_t5
-        exit 1
+        Exit-SetupFailure "Could not install $pkg into .venv_t5_530"
     }
 }
 if ($script:UnslothVerbose) {
@@ -3397,7 +3453,7 @@ foreach ($pkg in @("transformers==5.5.0", "huggingface_hub==1.8.0", "hf_xet==1.4
         Write-Host "[FAIL] Could not install $pkg into .venv_t5_550/" -ForegroundColor Red
         Write-Host (Redact-InstallOutput $output) -ForegroundColor Red
         $ErrorActionPreference = $prevEAP_t5
-        exit 1
+        Exit-SetupFailure "Could not install $pkg into .venv_t5_550"
     }
 }
 if ($script:UnslothVerbose) {
@@ -3432,7 +3488,7 @@ foreach ($pkg in @("transformers==5.10.2", "huggingface_hub==1.8.0", "hf_xet==1.
         Write-Host "[FAIL] Could not install $pkg into .venv_t5_510/" -ForegroundColor Red
         Write-Host (Redact-InstallOutput $output) -ForegroundColor Red
         $ErrorActionPreference = $prevEAP_t5
-        exit 1
+        Exit-SetupFailure "Could not install $pkg into .venv_t5_510"
     }
 }
 if ($script:UnslothVerbose) {
@@ -3547,7 +3603,7 @@ if (-not $LlamaPr -and $LlamaPrForce -and $LlamaPrForce -match '^\d+$' -and [int
 if ($LlamaPr) {
     if ($LlamaPr -notmatch '^\d+$' -or [int]$LlamaPr -le 0) {
         Write-Host "[ERROR] UNSLOTH_LLAMA_PR=$LlamaPr is not a valid PR number" -ForegroundColor Red
-        exit 1
+        Exit-SetupFailure "UNSLOTH_LLAMA_PR=$LlamaPr is not a valid PR number"
     }
     step "llama.cpp" "UNSLOTH_LLAMA_PR=$LlamaPr -- will build from PR head" "Yellow"
     $ResolvedLlamaTag = "pr-$LlamaPr"
@@ -3563,7 +3619,7 @@ $LocalLlamaCppSrc = $env:UNSLOTH_LOCAL_LLAMA_CPP_DIR
 if ($LocalLlamaCppSrc) {
     if (-not (Test-Path -LiteralPath $LocalLlamaCppSrc -PathType Container)) {
         step "llama.cpp" "UNSLOTH_LOCAL_LLAMA_CPP_DIR does not exist: $LocalLlamaCppSrc" "Red"
-        exit 1
+        Exit-SetupFailure "UNSLOTH_LOCAL_LLAMA_CPP_DIR does not exist: $LocalLlamaCppSrc"
     }
     $ResolvedLocal = (Resolve-Path -LiteralPath $LocalLlamaCppSrc).Path
     # Reusing a local dir disables both the prebuilt download and the source
@@ -3594,7 +3650,7 @@ if ($LocalLlamaCppSrc) {
         # and leave Unsloth with no usable binary.
         if (-not $LocalLlamaServerFound) {
             step "llama.cpp" "no llama-server.exe under $ResolvedLocal (looked for .\llama-server.exe, .\build\bin and .\build\bin\Release) -- build llama.cpp there first, or drop --with-llama-cpp-dir" "Red"
-            exit 1
+            Exit-SetupFailure "No llama-server.exe was found under $ResolvedLocal"
         }
         # If the target is already a junction/symlink (e.g. a previous
         # --with-llama-cpp-dir run), delete only the link via DirectoryInfo.Delete().
@@ -3620,7 +3676,7 @@ if ($LocalLlamaCppSrc) {
             if (Test-Path -LiteralPath $LlamaCppDir) {
                 step "llama.cpp" "install blocked by active llama.cpp process" "Yellow"
                 substep "Close Unsloth or other llama.cpp users and retry" "Yellow"
-                exit 3
+                Exit-SetupFailure "llama.cpp install is blocked by an active llama.cpp process" 3
             }
         }
         cmd /c "mklink /J `"$LlamaCppDir`" `"$ResolvedLocal`"" 2>&1 | Out-Null
@@ -3762,7 +3818,7 @@ if ($LocalLlamaCppLinked) {
                 substep "Existing install was restored" "Yellow"
             }
             substep "Close Unsloth or other llama.cpp users and retry" "Yellow"
-            exit 3
+            Exit-SetupFailure "llama.cpp install is blocked by an active llama.cpp process" 3
         } elseif ($prebuiltExit -eq 4) {
             step "llama.cpp" "not enough disk space to install llama.cpp" "Yellow"
             Write-LlamaFailureLog -Output $prebuiltOutput
@@ -4025,7 +4081,7 @@ if ($LocalLlamaCppLinked) {
                 } else {
                     Write-Host "[ERROR] CMake 4.2+ is required to build llama.cpp with the Visual Studio 2026 generator, and no older Visual Studio toolchain was found to fall back to." -ForegroundColor Red
                     Write-Host "        Upgrade CMake from https://cmake.org/download/ and re-run, or use a prebuilt llama.cpp bundle." -ForegroundColor Red
-                    exit 1
+                    Exit-SetupFailure "CMake cannot drive the Visual Studio 2026 generator"
                 }
             }
         }
@@ -4532,5 +4588,5 @@ Write-Host ""
 # failure. Direct 'unsloth studio update' does not set SKIP_STUDIO_BASE,
 # so it keeps degraded installs successful.
 if ($script:LlamaCppDegraded -and $env:SKIP_STUDIO_BASE -eq "1") {
-    exit 1
+    Exit-SetupFailure "llama.cpp setup did not produce a usable server"
 }
diff --git a/studio/setup.sh b/studio/setup.sh
index b4088c15b6..f623c9ab0b 100755
--- a/studio/setup.sh
+++ b/studio/setup.sh
@@ -67,6 +67,18 @@ fi
 step()    { printf "  ${C_DIM}%-15.15s${C_RST}${3:-$C_OK}%s${C_RST}\n" "$1" "$2"; }
 substep() { printf "  %-15s${2:-$C_DIM}%s${C_RST}\n" "" "$1"; }
 
+setup_fail() {
+    local exit_code=$1
+    shift
+    [ "$exit_code" -ne 0 ] || exit_code=1
+    local message
+    message=$(printf '%s' "$*" | tr '\r\n' '  ')
+    case "${UNSLOTH_TAURI_MODE:-0}" in
+        1|true) printf '[TAURI:ERROR] %s\n' "$message" ;;
+    esac
+    exit "$exit_code"
+}
+
 # ── Helper: can the controlling terminal actually be opened for reading? ──
 # `test -r` only checks permission bits, which look fine in containers and
 # systemd units where open() then fails with ENXIO. Probe with a real open.
@@ -173,7 +185,7 @@ _run_quiet() {
         exit_code=$?
         step "error" "$label failed (exit code $exit_code)" "$C_ERR" >&2
         if [ "$on_fail" = "exit" ]; then
-            exit "$exit_code"
+            setup_fail "$exit_code" "$label failed (exit code $exit_code)"
         else
             return "$exit_code"
         fi
@@ -182,7 +194,10 @@ _run_quiet() {
     local tmplog
     tmplog=$(mktemp) || {
         step "error" "Failed to create temporary file" "$C_ERR" >&2
-        [ "$on_fail" = "exit" ] && exit 1 || return 1
+        if [ "$on_fail" = "exit" ]; then
+            setup_fail 1 "Failed to create temporary file for $label"
+        fi
+        return 1
     }
 
     if "$@" >"$tmplog" 2>&1; then
@@ -196,7 +211,7 @@ _run_quiet() {
         rm -f "$tmplog"
 
         if [ "$on_fail" = "exit" ]; then
-            exit "$exit_code"
+            setup_fail "$exit_code" "$label failed (exit code $exit_code)"
         else
             return "$exit_code"
         fi
@@ -549,10 +564,14 @@ if [ -n "$_studio_override" ]; then
     if [ ! -d "$_studio_override" ]; then
         echo "ERROR: $_studio_override_var=$_studio_override does not exist." >&2
         echo "       Run install.sh to create the install root before 'unsloth studio update'." >&2
-        exit 1
+        setup_fail 1 "$_studio_override_var=$_studio_override does not exist"
     fi
-    [ -w "$_studio_override" ] || { echo "ERROR: $_studio_override_var=$_studio_override is not writable." >&2; exit 1; }
-    STUDIO_HOME="$(CDPATH= cd -P -- "$_studio_override" && pwd -P)" || exit 1
+    if [ ! -w "$_studio_override" ]; then
+        echo "ERROR: $_studio_override_var=$_studio_override is not writable." >&2
+        setup_fail 1 "$_studio_override_var=$_studio_override is not writable"
+    fi
+    STUDIO_HOME="$(CDPATH= cd -P -- "$_studio_override" && pwd -P)" ||
+        setup_fail 1 "Could not resolve $_studio_override_var=$_studio_override"
 else
     STUDIO_HOME="$HOME/.unsloth/studio"
 fi
@@ -598,7 +617,7 @@ _assert_studio_owned_or_absent() {
         fi
         echo "ERROR: $_aso_dir already exists and is not marked as an Unsloth-owned $_aso_label." >&2
         echo "       Move it aside or choose an empty UNSLOTH_STUDIO_HOME before re-running." >&2
-        exit 1
+        setup_fail 1 "$_aso_label path is not an Unsloth-owned install: $_aso_dir"
     fi
 }
 
@@ -716,12 +735,12 @@ elif [ "$NODE_SOURCE" = bundled ]; then
         step "node" "install blocked by another active Unsloth install" "$C_ERR"
         sed 's/^/   | /' "$_NODE_LOG" >&2; rm -f "$_NODE_LOG"
         substep "close other Unsloth installs and retry"
-        exit 3
+        setup_fail 3 "Node install is blocked by another active Unsloth install"
     elif [ "$_NODE_STATUS" -ne 0 ]; then
         step "node" "isolated Node install failed" "$C_ERR"
         sed 's/^/   | /' "$_NODE_LOG" >&2; rm -f "$_NODE_LOG"
         substep "install Node >= 20.19 (with npm >= 11) yourself and re-run, or check your network"
-        exit 1
+        setup_fail 1 "Could not install an isolated Node runtime"
     fi
     grep -Fq "already matches" "$_NODE_LOG" && verbose_substep "isolated Node already up to date"
     rm -f "$_NODE_LOG"
@@ -854,7 +873,7 @@ if [ "$_bun_install_ok" = false ]; then
     if [ "$_npm_install_rc" -ne 0 ]; then
         _suggest_npm_registry "$_FRONTEND_INSTALL_LOG"
         rm -f "$_FRONTEND_INSTALL_LOG"
-        exit "$_npm_install_rc"
+        setup_fail "$_npm_install_rc" "Frontend dependency installation failed (exit code $_npm_install_rc)"
     fi
 fi
 _CAPTURE_LOG=""
@@ -894,7 +913,7 @@ if [ -d "$_OXC_DIR" ] && [ "${NODE_SOURCE:-}" != skip ] && command -v npm &>/dev
     if [ "$_oxc_install_rc" -ne 0 ]; then
         _suggest_npm_registry "$_OXC_INSTALL_LOG"
         rm -f "$_OXC_INSTALL_LOG"
-        exit "$_oxc_install_rc"
+        setup_fail "$_oxc_install_rc" "OXC validator dependency installation failed (exit code $_oxc_install_rc)"
     fi
     rm -f "$_OXC_INSTALL_LOG"
     cd "$SCRIPT_DIR"
@@ -932,7 +951,7 @@ if [ ! -x "$VENV_DIR/bin/python" ]; then
             if ! run_quiet_no_exit "install Colab backend deps" pip install -q -r "$_COLAB_REQS_TMP"; then
                 rm -f "$_COLAB_REQS_TMP"
                 step "python" "Colab backend dependency install failed" "$C_ERR"
-                exit 1
+                setup_fail 1 "Colab backend dependency installation failed"
             fi
         else
             step "python" "no Colab backend dependencies resolved from requirements file" "$C_WARN"
@@ -943,7 +962,7 @@ if [ ! -x "$VENV_DIR/bin/python" ]; then
         step "python" "venv not found at $VENV_DIR" "$C_ERR"
         substep "Run install.sh first to create the environment:"
         substep "curl -fsSL https://unsloth.ai/install.sh | sh"
-        exit 1
+        setup_fail 1 "Virtual environment not found at $VENV_DIR"
     fi
 else
     source "$VENV_DIR/bin/activate"
@@ -1025,6 +1044,21 @@ sys.exit(0 if (major, minor) >= (4, 14) else 1)
             substep "anyio >=4.14 found (#6483) -- forcing dependency pass to repair..."
             _SKIP_PYTHON_DEPS=false
         fi
+        # An interrupted install leaves $_PKG_NAME current while studio.txt
+        # never finished, so the compare above says "up to date" and update --
+        # plus the desktop Repair button -- no-ops on a venv that cannot boot.
+        if ! "$VENV_DIR/bin/python" -c "
+import sys
+sys.path.insert(0, sys.argv[1])
+try:
+    import install_manifest
+except Exception:
+    sys.exit(0)  # older tree without the manifest helper: leave the fast path alone
+sys.exit(0 if install_manifest.verify_install()['ok'] else 1)
+" "$SCRIPT_DIR" 2>/dev/null; then
+            substep "studio install incomplete -- forcing dependency pass to repair..."
+            _SKIP_PYTHON_DEPS=false
+        fi
     elif [ -n "$INSTALLED_VER" ] && [ -n "$LATEST_VER" ]; then
         substep "$_PKG_NAME $INSTALLED_VER -> $LATEST_VER available, updating..."
     elif [ -z "$LATEST_VER" ]; then
@@ -1277,7 +1311,7 @@ fi
 if [ -n "$_LLAMA_PR" ]; then
     if ! [[ "$_LLAMA_PR" =~ ^[0-9]+$ ]] || [ "$_LLAMA_PR" -le 0 ]; then
         step "llama.cpp" "UNSLOTH_LLAMA_PR=$_LLAMA_PR is not a valid PR number" "$C_ERR"
-        exit 1
+        setup_fail 1 "UNSLOTH_LLAMA_PR=$_LLAMA_PR is not a valid PR number"
     fi
     step "llama.cpp" "UNSLOTH_LLAMA_PR=$_LLAMA_PR -- will build from PR head" "$C_WARN"
     _RESOLVED_LLAMA_TAG="pr-$_LLAMA_PR"
@@ -1313,7 +1347,7 @@ _LOCAL_LLAMA_CPP_LINKED=false
 if [ -n "${UNSLOTH_LOCAL_LLAMA_CPP_DIR:-}" ]; then
     if [ ! -d "$UNSLOTH_LOCAL_LLAMA_CPP_DIR" ]; then
         step "llama.cpp" "UNSLOTH_LOCAL_LLAMA_CPP_DIR does not exist: $UNSLOTH_LOCAL_LLAMA_CPP_DIR" "$C_ERR"
-        exit 1
+        setup_fail 1 "UNSLOTH_LOCAL_LLAMA_CPP_DIR does not exist: $UNSLOTH_LOCAL_LLAMA_CPP_DIR"
     fi
     _RESOLVED_LOCAL="$(CDPATH= cd -P -- "$UNSLOTH_LOCAL_LLAMA_CPP_DIR" && pwd -P)"
     # Canonicalize the install path the same way before comparing: _RESOLVED_LOCAL
@@ -1351,7 +1385,7 @@ if [ -n "${UNSLOTH_LOCAL_LLAMA_CPP_DIR:-}" ]; then
         # with no usable binary.
         if ! _has_local_llama_server "$_RESOLVED_LOCAL"; then
             step "llama.cpp" "no llama-server under $_RESOLVED_LOCAL (looked for ./llama-server and ./build/bin/llama-server) -- build llama.cpp there first, or drop --with-llama-cpp-dir" "$C_ERR"
-            exit 1
+            setup_fail 1 "No llama-server was found under $_RESOLVED_LOCAL"
         fi
         # A stale link from a previous --with-llama-cpp-dir run isn't Unsloth-owned
         # content; drop it before the ownership check so re-runs stay idempotent
@@ -1460,7 +1494,7 @@ else
             substep "existing install was restored"
         fi
         substep "close Unsloth or other llama.cpp users and retry"
-        exit 3
+        setup_fail 3 "llama.cpp install is blocked by an active llama.cpp process"
     elif [ "$_PREBUILT_STATUS" -eq 4 ]; then
         step "llama.cpp" "not enough disk space to install llama.cpp" "$C_WARN"
         print_llama_error_log "$_PREBUILT_LOG"
@@ -2217,5 +2251,5 @@ echo ""
 # successful -- the footer above already reports the limitation and Unsloth
 # is still usable for non-GGUF workflows.
 if [ "$_LLAMA_CPP_DEGRADED" = true ] && [ "${SKIP_STUDIO_BASE:-0}" = "1" ]; then
-    exit 1
+    setup_fail 1 "llama.cpp setup did not produce a usable server"
 fi
diff --git a/studio/src-tauri/src/desktop_backend_owner.rs b/studio/src-tauri/src/desktop_backend_owner.rs
index c7d0a7b309..8a174a0731 100644
--- a/studio/src-tauri/src/desktop_backend_owner.rs
+++ b/studio/src-tauri/src/desktop_backend_owner.rs
@@ -528,7 +528,7 @@ fn lifecycle_control_block_reason(liveness: &DesktopLiveness) -> Option<String>
         return Some("desktop_auth_unsupported".to_string());
     }
     if liveness.desktop_manageability_version.unwrap_or(0)
-        < crate::preflight::DESKTOP_MANAGEABILITY_VERSION
+        < crate::preflight::DESKTOP_BACKEND_MANAGEABILITY_VERSION
     {
         return Some("desktop_manageability_unsupported".to_string());
     }
@@ -1014,14 +1014,12 @@ mod tests {
         assert!(!metadata_is_well_formed(&metadata));
     }
 
-    #[test]
-    fn liveness_verification_requires_root_kind_and_token_sha() {
-        let metadata = metadata(1, Some(8888));
-        let liveness = DesktopLiveness {
+    fn owned_liveness(manageability: u16) -> DesktopLiveness {
+        DesktopLiveness {
             status: Some("alive".to_string()),
             service: Some("Unsloth UI Backend".to_string()),
             desktop_protocol_version: Some(1),
-            desktop_manageability_version: Some(1),
+            desktop_manageability_version: Some(manageability),
             supports_desktop_auth: Some(true),
             supports_desktop_backend_ownership: Some(true),
             studio_root_id: Some(ROOT_ID.to_string()),
@@ -1029,7 +1027,57 @@ mod tests {
                 kind: Some(OWNER_KIND_TAURI.to_string()),
                 token_sha256: Some(token_sha256(TOKEN)),
             }),
-        };
+        }
+    }
+
+    #[test]
+    fn legacy_manageability_backend_stays_lifecycle_controllable() {
+        // A backend from the previous app version reports manageability 1.
+        // studio_install_ok is CLI-side, not part of this backend's HTTP
+        // contract: blocking makes preflight answer ExternalConflict and never
+        // adopt a process the root id and token already prove is ours.
+        assert_eq!(lifecycle_control_block_reason(&owned_liveness(1)), None);
+        assert_eq!(
+            lifecycle_control_block_reason(&owned_liveness(
+                crate::preflight::DESKTOP_MANAGEABILITY_VERSION
+            )),
+            None
+        );
+
+        // The bits a live backend really must carry are still enforced.
+        let mut no_ownership = owned_liveness(1);
+        no_ownership.supports_desktop_backend_ownership = Some(false);
+        assert_eq!(
+            lifecycle_control_block_reason(&no_ownership).as_deref(),
+            Some("desktop_backend_ownership_unsupported")
+        );
+
+        let mut no_auth = owned_liveness(1);
+        no_auth.supports_desktop_auth = Some(false);
+        assert_eq!(
+            lifecycle_control_block_reason(&no_auth).as_deref(),
+            Some("desktop_auth_unsupported")
+        );
+
+        let mut old_protocol = owned_liveness(1);
+        old_protocol.desktop_protocol_version = Some(0);
+        assert_eq!(
+            lifecycle_control_block_reason(&old_protocol).as_deref(),
+            Some("desktop_protocol_incompatible")
+        );
+
+        let mut no_manageability = owned_liveness(1);
+        no_manageability.desktop_manageability_version = None;
+        assert_eq!(
+            lifecycle_control_block_reason(&no_manageability).as_deref(),
+            Some("desktop_manageability_unsupported")
+        );
+    }
+
+    #[test]
+    fn liveness_verification_requires_root_kind_and_token_sha() {
+        let metadata = metadata(1, Some(8888));
+        let liveness = owned_liveness(1);
         assert!(liveness_verifies_metadata(&liveness, &metadata));
 
         let mut wrong_root = liveness;
diff --git a/studio/src-tauri/src/diagnostics/mod.rs b/studio/src-tauri/src/diagnostics/mod.rs
index 998efc893e..3fdbac06dd 100644
--- a/studio/src-tauri/src/diagnostics/mod.rs
+++ b/studio/src-tauri/src/diagnostics/mod.rs
@@ -31,6 +31,10 @@ pub const TAIL_MAX_LINES: usize = 1000;
 pub const TAIL_MAX_BYTES: usize = 200 * 1024;
 pub const REPORT_MAX_BYTES: usize = 1024 * 1024;
 
+pub(crate) fn redact_for_display(text: &str) -> String {
+    redaction::redact_text(text, &mut redaction::RedactionReport::default())
+}
+
 pub(crate) const MAX_STATE_ITEMS: usize = 200;
 pub(crate) const MAX_PHASE_LINE_BYTES: usize = 16 * 1024;
 pub(crate) const FOOTER_BUDGET_BYTES: usize = 8 * 1024;
diff --git a/studio/src-tauri/src/diagnostics/redaction.rs b/studio/src-tauri/src/diagnostics/redaction.rs
index 0c7a92944a..bd36f9254e 100644
--- a/studio/src-tauri/src/diagnostics/redaction.rs
+++ b/studio/src-tauri/src/diagnostics/redaction.rs
@@ -16,6 +16,8 @@ pub(crate) fn redact_text(text: &str, report: &mut RedactionReport) -> String {
     }
     out = replace_regex(private_key_re(), &out, "<redacted private key>", report);
     out = replace_regex(url_credentials_re(), &out, "$1<redacted>@", report);
+    out = replace_regex(url_query_value_re(), &out, "$1=<redacted>", report);
+    out = replace_regex(url_fragment_re(), &out, "$1#<redacted>", report);
     out = replace_regex(auth_header_re(), &out, "$1: <redacted>", report);
     out = replace_regex(cookie_re(), &out, "$1: <redacted>", report);
     out = replace_regex(token_re(), &out, "<redacted token>", report);
@@ -110,6 +112,16 @@ fn url_credentials_re() -> &'static Regex {
     RE.get_or_init(|| Regex::new(r"(?i)\b([a-z][a-z0-9+.-]*://)[^/\s:@]+(:[^/\s@]*)?@").unwrap())
 }
 
+fn url_query_value_re() -> &'static Regex {
+    static RE: OnceLock<Regex> = OnceLock::new();
+    RE.get_or_init(|| Regex::new(r"([?&][^=\s&`]+)=[^&#\s`]+").unwrap())
+}
+
+fn url_fragment_re() -> &'static Regex {
+    static RE: OnceLock<Regex> = OnceLock::new();
+    RE.get_or_init(|| Regex::new(r"(?i)(https?://[^\s`#]+)#[^\s`]+").unwrap())
+}
+
 fn auth_header_re() -> &'static Regex {
     static RE: OnceLock<Regex> = OnceLock::new();
     RE.get_or_init(|| Regex::new(r"(?i)\b(authorization|proxy-authorization)\s*[:=]\s*(bearer|basic)?\s*[A-Za-z0-9._~+/=-]+").unwrap())
@@ -183,6 +195,7 @@ mod tests {
             "API_KEY=secret123\n",
             "native_path_lease=abc.DEF_123\n",
             "url=https://user:pass@example.com/path\n",
+            "signed=https://example.com/object?X-Amz-Signature=presignedvalue987&version=1#fragmentsecret\n",
             "email=alex@example.com\n",
             "path=/Users/alex/.unsloth/studio/logs/install.log\n",
             "win=C:\\Users\\Alex\\.unsloth\\studio\\logs\\install.log\n",
@@ -198,6 +211,9 @@ mod tests {
         assert!(!redacted.contains("abc.DEF_123"));
         assert!(redacted.contains("native_path_lease=<redacted native path lease>"));
         assert!(redacted.contains("https://<redacted>@example.com/path"));
+        assert!(!redacted.contains("presignedvalue987"));
+        assert!(!redacted.contains("fragmentsecret"));
+        assert!(redacted.contains("?X-Amz-Signature=<redacted>&version=<redacted>#<redacted>"));
         assert!(!redacted.contains("alex@example.com"));
         assert!(redacted.contains("<studio_home>"));
         assert!(!redacted.contains("PRIVATE KEY-----\nabc"));
diff --git a/studio/src-tauri/src/install.rs b/studio/src-tauri/src/install.rs
index 024b730735..d7226bf901 100644
--- a/studio/src-tauri/src/install.rs
+++ b/studio/src-tauri/src/install.rs
@@ -1,6 +1,7 @@
 use crate::diagnostics::{self, AttemptLog, DiagnosticsState};
 use log::{error, info, warn};
 use process_wrap::std::*;
+use std::collections::VecDeque;
 use std::io::BufRead;
 use std::path::{Path, PathBuf};
 use std::process::{Command, ExitStatus, Stdio};
@@ -38,6 +39,160 @@ pub fn new_install_state() -> InstallState {
 
 use crate::process::trim_line_endings;
 
+const FAILURE_CONTEXT_LINES: usize = 8;
+const FAILURE_CONTEXT_LINE_BYTES: usize = 1_000;
+
+fn generic_failure_message(code: i32) -> String {
+    format!(
+        "Installation failed with exit code {}. Open the installer logs for details.",
+        code
+    )
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum InstallOutputStream {
+    Stdout,
+    Stderr,
+}
+
+struct InstallOutputLine {
+    stream: InstallOutputStream,
+    text: String,
+}
+
+#[derive(Default)]
+struct InstallFailureContext {
+    explicit_error: Option<String>,
+    explicit_error_stream: Option<InstallOutputStream>,
+    default_error: Option<String>,
+    output_tail: VecDeque<InstallOutputLine>,
+}
+
+impl InstallFailureContext {
+    fn observe_stdout(&mut self, text: &str) -> bool {
+        if text.starts_with("[TAURI:ERROR_CLEAR] ") {
+            self.clear_failure(InstallOutputStream::Stdout);
+            return true;
+        }
+        if text.starts_with("[TAURI:OUTPUT_CLEAR] ") {
+            self.clear_stream(InstallOutputStream::Stdout);
+            return true;
+        }
+        if let Some(message) = text.strip_prefix("[TAURI:ERROR] ") {
+            let message = message.trim();
+            if !message.is_empty() {
+                self.explicit_error = Some(Self::bounded_line(message));
+                self.explicit_error_stream = Some(InstallOutputStream::Stdout);
+            }
+            return false;
+        }
+        if let Some(message) = text.strip_prefix("[TAURI:ERROR_OUTPUT] ") {
+            self.capture_output_error(InstallOutputStream::Stdout, message);
+            return true;
+        }
+        if let Some(message) = text.strip_prefix("[TAURI:ERROR_DEFAULT] ") {
+            let message = message.trim();
+            if !message.is_empty() {
+                self.default_error = Some(Self::bounded_line(message));
+            }
+            return true;
+        }
+        if !text.starts_with("[TAURI:") {
+            self.push_output(InstallOutputStream::Stdout, text);
+        }
+        false
+    }
+
+    fn observe_stderr(&mut self, text: &str) -> bool {
+        if text.starts_with("[TAURI:ERROR_CLEAR] ") {
+            self.clear_failure(InstallOutputStream::Stderr);
+            return true;
+        }
+        if text.starts_with("[TAURI:OUTPUT_CLEAR] ") {
+            self.clear_stream(InstallOutputStream::Stderr);
+            return true;
+        }
+        if let Some(message) = text.strip_prefix("[TAURI:ERROR_OUTPUT] ") {
+            self.capture_output_error(InstallOutputStream::Stderr, message);
+            return true;
+        }
+        self.push_output(InstallOutputStream::Stderr, text);
+        false
+    }
+
+    fn capture_output_error(&mut self, stream: InstallOutputStream, fallback: &str) {
+        let fallback = fallback.trim();
+        let detail = self
+            .output_tail
+            .iter()
+            .rev()
+            .find(|line| line.stream == stream)
+            .map(|line| line.text.as_str());
+        if let Some(error) = match (fallback.is_empty(), detail) {
+            (_, Some(detail)) if fallback == detail => Some(detail.to_owned()),
+            (false, Some(detail)) => Some(Self::bounded_line(&format!("{fallback}: {detail}"))),
+            (false, None) => Some(Self::bounded_line(fallback)),
+            (true, Some(detail)) => Some(detail.to_owned()),
+            (true, None) => None,
+        } {
+            self.explicit_error = Some(error);
+            self.explicit_error_stream = Some(stream);
+        }
+    }
+
+    fn clear_failure(&mut self, stream: InstallOutputStream) {
+        if self.explicit_error_stream == Some(stream) {
+            self.explicit_error = None;
+            self.explicit_error_stream = None;
+        }
+        if stream == InstallOutputStream::Stdout {
+            self.default_error = None;
+        }
+        self.clear_stream(stream);
+    }
+
+    fn clear_stream(&mut self, stream: InstallOutputStream) {
+        self.output_tail.retain(|line| line.stream != stream);
+    }
+
+    fn push_output(&mut self, stream: InstallOutputStream, text: &str) {
+        let text = text.trim();
+        if text.is_empty() {
+            return;
+        }
+        let text = Self::bounded_line(text);
+        self.output_tail
+            .push_back(InstallOutputLine { stream, text });
+        while self.output_tail.len() > FAILURE_CONTEXT_LINES {
+            self.output_tail.pop_front();
+        }
+    }
+
+    fn bounded_line(text: &str) -> String {
+        let mut text = diagnostics::redact_for_display(text);
+        let boundary =
+            diagnostics::valid_utf8_boundary(&text, text.len().min(FAILURE_CONTEXT_LINE_BYTES));
+        text.truncate(boundary);
+        text
+    }
+
+    fn message(&self, code: i32) -> String {
+        let detail = self
+            .explicit_error
+            .as_deref()
+            .or(self.default_error.as_deref())
+            .or_else(|| self.output_tail.back().map(|line| line.text.as_str()));
+        match detail {
+            Some(detail) => format!("Installation failed: {}", detail),
+            None => generic_failure_message(code),
+        }
+    }
+}
+
+fn is_elevation_request(code: i32, packages: &[String]) -> bool {
+    code == 2 && !packages.is_empty()
+}
+
 // ── Script Resolution ──
 
 /// Returns (script_path, args) depending on dev vs production mode.
@@ -232,7 +387,7 @@ fn spawn_script(
 // ── Stream ──
 
 /// Spawns reader threads for stdout/stderr.
-/// Parses [TAURI:*] lines from stdout for structured events.
+/// Parses structured events from stdout and failure controls from both streams.
 fn stream_output(
     app: &AppHandle,
     state: &InstallState,
@@ -241,14 +396,19 @@ fn stream_output(
     attempt: AttemptLog,
     stdout: Option<std::process::ChildStdout>,
     stderr: Option<std::process::ChildStderr>,
-) -> Vec<std::thread::JoinHandle<()>> {
+) -> (
+    Vec<std::thread::JoinHandle<()>>,
+    Arc<Mutex<InstallFailureContext>>,
+) {
     let mut threads = Vec::new();
+    let failure_context = Arc::new(Mutex::new(InstallFailureContext::default()));
 
     if let Some(out) = stdout {
         let app_clone = app.clone();
         let state_clone = Arc::clone(state);
         let diagnostics_clone = diagnostics.clone();
         let attempt_clone = attempt.clone();
+        let failure_context_clone = Arc::clone(&failure_context);
         threads.push(std::thread::spawn(move || {
             let mut reader = std::io::BufReader::new(out);
             let mut buf = Vec::new();
@@ -259,6 +419,14 @@ fn stream_output(
                     Ok(_) => {
                         let text = String::from_utf8_lossy(trim_line_endings(&buf)).into_owned();
                         diagnostics::append_phase_line(&attempt_clone.handle, "stdout", &text);
+                        let is_failure_control = failure_context_clone
+                            .lock()
+                            .map(|mut context| context.observe_stdout(&text))
+                            .unwrap_or(false);
+                        if is_failure_control {
+                            info!("[install][stdout] {}", text);
+                            continue;
+                        }
                         // Parse structured Tauri protocol lines
                         if let Some(packages) = text.strip_prefix("[TAURI:NEED_SUDO] ") {
                             let pkgs: Vec<String> =
@@ -314,6 +482,7 @@ fn stream_output(
     if let Some(err) = stderr {
         let app_clone = app.clone();
         let attempt_clone = attempt.clone();
+        let failure_context_clone = Arc::clone(&failure_context);
         threads.push(std::thread::spawn(move || {
             let mut reader = std::io::BufReader::new(err);
             let mut buf = Vec::new();
@@ -324,6 +493,14 @@ fn stream_output(
                     Ok(_) => {
                         let text = String::from_utf8_lossy(trim_line_endings(&buf)).into_owned();
                         diagnostics::append_phase_line(&attempt_clone.handle, "stderr", &text);
+                        let is_failure_control = failure_context_clone
+                            .lock()
+                            .map(|mut context| context.observe_stderr(&text))
+                            .unwrap_or(false);
+                        if is_failure_control {
+                            info!("[install][stderr] {}", text);
+                            continue;
+                        }
                         warn!("[install][stderr] {}", text);
                         let _ = app_clone.emit(event_mode.progress_event(), &text);
                     }
@@ -336,7 +513,7 @@ fn stream_output(
         }));
     }
 
-    threads
+    (threads, failure_context)
 }
 
 // ── Wait & Finalize ──
@@ -457,7 +634,7 @@ fn run_install_with_event_mode(
             return Err(msg);
         }
     };
-    let threads = stream_output(
+    let (threads, failure_context) = stream_output(
         &app,
         &state,
         event_mode,
@@ -490,12 +667,12 @@ fn run_install_with_event_mode(
         }
         Ok((status, intentional)) => {
             let code = status.code().unwrap_or(-1);
-            if code == 2 {
+            let packages = state
+                .lock()
+                .map(|install| install.needed_packages.clone())
+                .unwrap_or_default();
+            if is_elevation_request(code, &packages) {
                 // Script needs elevated package install — report to frontend
-                let packages = state
-                    .lock()
-                    .map(|i| i.needed_packages.clone())
-                    .unwrap_or_default();
                 diagnostics::record_elevation_packages(&diagnostics, &attempt, &packages);
                 diagnostics::finish_attempt(
                     &diagnostics,
@@ -508,7 +685,10 @@ fn run_install_with_event_mode(
                 let _ = app.emit(event_mode.needs_elevation_event(), &packages);
                 Err("NEEDS_ELEVATION".to_string())
             } else {
-                let msg = format!("Installer exited with code {}", code);
+                let msg = failure_context
+                    .lock()
+                    .map(|context| context.message(code))
+                    .unwrap_or_else(|_| generic_failure_message(code));
                 diagnostics::finish_attempt(
                     &diagnostics,
                     &attempt,
@@ -896,5 +1076,211 @@ mod tests {
             "repair-needs-elevation"
         );
         assert!(!InstallEventMode::Repair.emit_terminal_events());
+        assert!(!is_elevation_request(2, &[]));
+        assert!(is_elevation_request(2, &["cmake".to_string()]));
+        assert!(!is_elevation_request(1, &["cmake".to_string()]));
+    }
+
+    #[test]
+    fn explicit_installer_error_beats_stderr_noise() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout("[TAURI:ERROR] Failed to install PyTorch");
+        context.observe_stderr("rollback cleanup failed");
+        assert_eq!(
+            context.message(7),
+            "Installation failed: Failed to install PyTorch"
+        );
+    }
+
+    #[test]
+    fn command_error_includes_preceding_output_from_the_same_stream() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout("unrelated stdout");
+        context.observe_stderr("resolver error: no space left on device");
+        assert!(context.observe_stderr("[TAURI:ERROR_OUTPUT] install unsloth failed (exit code 1)"));
+        context.observe_stdout("[TAURI:ERROR_DEFAULT] Failed to install unsloth");
+        assert_eq!(
+            context.message(1),
+            "Installation failed: install unsloth failed (exit code 1): resolver error: no space left on device"
+        );
+    }
+
+    #[test]
+    fn command_error_without_output_uses_its_fallback() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout("unrelated output from an earlier step");
+        assert!(context.observe_stdout("[TAURI:OUTPUT_CLEAR] create venv"));
+        assert!(context.observe_stdout("[TAURI:ERROR_OUTPUT] create venv failed (exit code 2)"));
+        assert_eq!(
+            context.message(2),
+            "Installation failed: create venv failed (exit code 2)"
+        );
+    }
+
+    #[test]
+    fn recovered_retry_clears_stale_installer_error() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stderr("ERROR: transient PyTorch download failure");
+        assert!(context.observe_stderr("[TAURI:ERROR_OUTPUT] install PyTorch failed (exit code 1)"));
+        assert!(context.observe_stdout("[TAURI:ERROR_CLEAR] install PyTorch recovered after retry"));
+        assert!(context.observe_stderr("[TAURI:ERROR_CLEAR] install PyTorch recovered after retry"));
+        context.observe_stderr("ERROR: studio setup failed");
+        let message = context.message(7);
+        assert!(message.contains("studio setup failed"));
+        assert!(!message.contains("install PyTorch"));
+        assert!(!message.contains("transient PyTorch"));
+    }
+
+    #[test]
+    fn recovery_clear_is_order_independent_across_streams() {
+        let mut context = InstallFailureContext::default();
+        assert!(context.observe_stdout("[TAURI:ERROR_CLEAR] install PyTorch recovered"));
+        context.observe_stderr("ERROR: transient PyTorch download failure");
+        assert!(context.observe_stderr("[TAURI:ERROR_OUTPUT] install PyTorch failed (exit code 1)"));
+        assert!(context.observe_stderr("[TAURI:ERROR_CLEAR] install PyTorch recovered"));
+        context.observe_stdout("[TAURI:ERROR] later setup failure");
+        assert!(context.observe_stderr("[TAURI:ERROR_CLEAR] delayed recovery clear"));
+        assert_eq!(
+            context.message(1),
+            "Installation failed: later setup failure"
+        );
+    }
+
+    #[test]
+    fn successful_fallback_clears_unstructured_stderr() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stderr("bitsandbytes pre-release install failed");
+        assert!(context.observe_stderr("[TAURI:ERROR_CLEAR] bitsandbytes pypi fallback recovered"));
+        context.observe_stderr("mkdir: cannot create directory: Permission denied");
+        assert_eq!(
+            context.message(1),
+            "Installation failed: mkdir: cannot create directory: Permission denied"
+        );
+    }
+
+    #[test]
+    fn setup_failure_uses_explicit_producer_error_before_default() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout("CMake not found -- installing via winget");
+        context.observe_stdout("[TAURI:ERROR] UNSLOTH_LLAMA_PR=invalid is not a valid PR number");
+        assert!(context.observe_stdout("[TAURI:ERROR_DEFAULT] studio setup failed (exit code 4)"));
+        assert_eq!(
+            context.message(4),
+            "Installation failed: UNSLOTH_LLAMA_PR=invalid is not a valid PR number"
+        );
+    }
+
+    #[test]
+    fn setup_failure_uses_default_without_specific_output() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout("Finishing setup");
+        assert!(context.observe_stdout("[TAURI:ERROR_DEFAULT] studio setup failed (exit code 4)"));
+        context.observe_stderr("restored previous environment");
+        assert_eq!(
+            context.message(4),
+            "Installation failed: studio setup failed (exit code 4)"
+        );
+    }
+
+    #[test]
+    fn explicit_setup_error_survives_optional_output_and_footer() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout("[TAURI:ERROR] llama.cpp setup did not produce a usable server");
+        context.observe_stderr("whisper.cpp source build failed (exit code 1)");
+        context.observe_stdout(
+            "whisper.cpp    prebuilt install failed; browser and Transformers dictation remain available",
+        );
+        for index in 0..10 {
+            context.observe_stdout(&format!("setup footer line {index}"));
+        }
+        assert!(context.observe_stdout("[TAURI:ERROR_DEFAULT] studio setup failed (exit code 1)"));
+        assert_eq!(
+            context.message(1),
+            "Installation failed: llama.cpp setup did not produce a usable server"
+        );
+    }
+
+    #[test]
+    fn setup_default_outranks_nonfatal_failure_output() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout("long paths failed to enable");
+        context.observe_stderr("Triton install failed; torch.compile may not work");
+        assert!(context.observe_stdout("[TAURI:ERROR_DEFAULT] studio setup failed (exit code 3)"));
+        assert_eq!(
+            context.message(3),
+            "Installation failed: studio setup failed (exit code 3)"
+        );
+    }
+
+    #[test]
+    fn latest_output_is_used_without_structured_context() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stderr("first diagnostic");
+        context.observe_stderr("mv: cannot move build: Permission denied");
+        assert_eq!(
+            context.message(1),
+            "Installation failed: mv: cannot move build: Permission denied"
+        );
+    }
+
+    #[test]
+    fn structured_rollback_progress_does_not_replace_failure_output() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stderr("ln: cannot create symbolic link: Permission denied");
+        context.observe_stdout(
+            "[TAURI:PROGRESS] restoring previous environment after failed install...",
+        );
+        context.observe_stdout("[TAURI:PROGRESS] restored previous environment");
+        assert_eq!(
+            context.message(1),
+            "Installation failed: ln: cannot create symbolic link: Permission denied"
+        );
+    }
+
+    #[test]
+    fn installer_exit_code_is_not_duplicated() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout("[TAURI:ERROR] Failed to install PyTorch (exit code 7)");
+        let message = context.message(7);
+        assert_eq!(
+            message,
+            "Installation failed: Failed to install PyTorch (exit code 7)"
+        );
+        assert_eq!(message.matches("exit code 7").count(), 1);
+    }
+
+    #[test]
+    fn stderr_fallback_redacts_secrets() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stderr("ERROR: download failed for https://user:pass@example.com/package");
+        let message = context.message(1);
+        assert!(message.contains("ERROR: download failed"));
+        assert!(message.contains("https://<redacted>@example.com/package"));
+        assert!(!message.contains("user:pass"));
+    }
+
+    #[test]
+    fn failure_context_is_bounded_and_utf8_safe() {
+        let mut context = InstallFailureContext::default();
+        context.observe_stdout(&format!(
+            "[TAURI:ERROR] {}https://user:secret@example.com/package",
+            "é".repeat(500)
+        ));
+        for index in 0..20 {
+            context.observe_stderr(&format!("{index}: {}", "é".repeat(1_000)));
+        }
+        let explicit_error = context.explicit_error.as_ref().unwrap();
+        assert!(explicit_error.len() <= FAILURE_CONTEXT_LINE_BYTES);
+        assert!(explicit_error.is_char_boundary(explicit_error.len()));
+        assert!(!explicit_error.contains("secret"));
+        assert_eq!(context.output_tail.len(), FAILURE_CONTEXT_LINES);
+        assert!(context
+            .output_tail
+            .iter()
+            .all(|line| line.text.len() <= FAILURE_CONTEXT_LINE_BYTES));
+        assert!(context
+            .output_tail
+            .iter()
+            .all(|line| line.text.is_char_boundary(line.text.len())));
     }
 }
diff --git a/studio/src-tauri/src/preflight.rs b/studio/src-tauri/src/preflight.rs
index 7ef5244754..16ea8adf99 100644
--- a/studio/src-tauri/src/preflight.rs
+++ b/studio/src-tauri/src/preflight.rs
@@ -14,7 +14,8 @@ use std::path::PathBuf;
 use types::{BackendProbe, ManagedProbe};
 pub use types::{DesktopPreflightDisposition, DesktopPreflightResult, ExternalBackendConflict};
 pub(crate) use version::{
-    backend_version_stale_reason, DESKTOP_MANAGEABILITY_VERSION, DESKTOP_PROTOCOL_VERSION,
+    backend_version_stale_reason, DESKTOP_BACKEND_MANAGEABILITY_VERSION,
+    DESKTOP_MANAGEABILITY_VERSION, DESKTOP_PROTOCOL_VERSION,
 };
 
 #[cfg(test)]
@@ -577,7 +578,7 @@ exit 1
                 r#"#!/bin/sh
 if [ "$1" = "-h" ]; then exit 0; fi
 if [ "$1" = "studio" ] && [ "$2" = "desktop-capabilities" ] && [ "$3" = "--json" ]; then
-  printf '{"desktop_protocol_version":1,"desktop_manageability_version":1,"supports_api_only":true,"supports_provision_desktop_auth":true,"supports_desktop_backend_ownership":true,"version":"2026.5.3"}'
+  printf '{"desktop_protocol_version":1,"desktop_manageability_version":2,"supports_api_only":true,"supports_provision_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_install_ok":true,"version":"2026.5.3"}'
   exit 0
 fi
 exit 1
@@ -589,7 +590,7 @@ exit 1
                 r#"#!/bin/sh
 if [ "$1" = "-h" ]; then exit 0; fi
 if [ "$1" = "studio" ] && [ "$2" = "desktop-capabilities" ] && [ "$3" = "--json" ]; then
-  printf '{"desktop_protocol_version":1,"desktop_manageability_version":1,"supports_api_only":true,"supports_provision_desktop_auth":false,"supports_desktop_backend_ownership":true,"desktop_auth_stale_reason":"cap_false","version":"2026.5.3"}'
+  printf '{"desktop_protocol_version":1,"desktop_manageability_version":2,"supports_api_only":true,"supports_provision_desktop_auth":false,"supports_desktop_backend_ownership":true,"desktop_auth_stale_reason":"cap_false","studio_install_ok":true,"version":"2026.5.3"}'
   exit 0
 fi
 if [ "$1" = "studio" ] && [ "$2" = "provision-desktop-auth" ] && [ "$3" = "--help" ]; then exit 0; fi
@@ -642,7 +643,7 @@ if [ "$1" = "-h" ]; then
 fi
 if [ "$1" = "studio" ] && [ "$2" = "desktop-capabilities" ] && [ "$3" = "--json" ]; then
   if [ -f "$modecap" ]; then exit 42; fi
-  printf '{"desktop_protocol_version":1,"desktop_manageability_version":1,"supports_api_only":true,"supports_provision_desktop_auth":true,"supports_desktop_backend_ownership":true,"version":"2026.5.3"}'
+  printf '{"desktop_protocol_version":1,"desktop_manageability_version":2,"supports_api_only":true,"supports_provision_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_install_ok":true,"version":"2026.5.3"}'
   exit 0
 fi
 exit 1
@@ -712,7 +713,7 @@ exit 1
     fn desktop_ready_health_with_owner(root_id: &str, include_owner: bool) -> String {
         let owner = desktop_owner_json(include_owner);
         format!(
-            r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.3","desktop_protocol_version":1,"desktop_manageability_version":1,"supports_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_root_id":"{root_id}"{owner}}}"#
+            r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.3","desktop_protocol_version":1,"desktop_manageability_version":2,"supports_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_root_id":"{root_id}"{owner}}}"#
         )
     }
 
@@ -772,7 +773,7 @@ exit 1
     async fn backend_with_auth_support_but_missing_protocol_is_old() {
         let probe = probe_test_backend(
             format!(
-                r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.3","desktop_manageability_version":1,"supports_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_root_id":"{EXPECTED_ROOT_ID}"{}}}"#,
+                r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.3","desktop_manageability_version":2,"supports_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_root_id":"{EXPECTED_ROOT_ID}"{}}}"#,
                 desktop_owner_json(true)
             ),
             "401 Unauthorized",
@@ -790,6 +791,41 @@ exit 1
         assert!(matches!(probe, BackendProbe::Ready { .. }));
     }
 
+    #[tokio::test]
+    async fn legacy_manageability_same_root_backend_is_still_ready() {
+        // Same migration window as the owned-backend case: a server from the
+        // release before the CLI gained studio_install_ok reports manageability
+        // 1. That capability is CLI-side, so it must not turn a live,
+        // protocol-compatible backend into a conflict the user has to kill.
+        let probe = probe_test_backend(
+            format!(
+                r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.3","desktop_protocol_version":1,"desktop_manageability_version":1,"supports_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_root_id":"{EXPECTED_ROOT_ID}"{}}}"#,
+                desktop_owner_json(true)
+            ),
+            "401 Unauthorized",
+        )
+        .await;
+
+        assert!(matches!(probe, BackendProbe::Ready { .. }));
+    }
+
+    #[tokio::test]
+    async fn backend_without_any_manageability_field_is_old() {
+        let probe = probe_test_backend(
+            format!(
+                r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.3","desktop_protocol_version":1,"supports_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_root_id":"{EXPECTED_ROOT_ID}"{}}}"#,
+                desktop_owner_json(true)
+            ),
+            "401 Unauthorized",
+        )
+        .await;
+
+        assert!(matches!(
+            probe,
+            BackendProbe::Old { reason, .. } if reason == "desktop_manageability_unsupported"
+        ));
+    }
+
     #[tokio::test]
     async fn compatible_same_root_without_desktop_owner_is_ready() {
         let probe = probe_test_backend(
@@ -805,7 +841,7 @@ exit 1
     async fn stale_same_root_without_desktop_owner_is_external_conflict() {
         let probe = probe_test_backend(
             format!(
-                r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.1","desktop_protocol_version":1,"desktop_manageability_version":1,"supports_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_root_id":"{EXPECTED_ROOT_ID}"}}"#,
+                r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.1","desktop_protocol_version":1,"desktop_manageability_version":2,"supports_desktop_auth":true,"supports_desktop_backend_ownership":true,"studio_root_id":"{EXPECTED_ROOT_ID}"}}"#,
             ),
             "401 Unauthorized",
         )
@@ -885,7 +921,7 @@ exit 1
     async fn backend_capability_false_is_old_even_when_route_401() {
         let probe = probe_test_backend(
             format!(
-                r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.3","desktop_protocol_version":1,"desktop_manageability_version":1,"supports_desktop_auth":false,"supports_desktop_backend_ownership":true,"desktop_auth_stale_reason":"cap_false","studio_root_id":"{EXPECTED_ROOT_ID}"{}}}"#,
+                r#"{{"status":"healthy","service":"Unsloth UI Backend","version":"2026.5.3","desktop_protocol_version":1,"desktop_manageability_version":2,"supports_desktop_auth":false,"supports_desktop_backend_ownership":true,"desktop_auth_stale_reason":"cap_false","studio_root_id":"{EXPECTED_ROOT_ID}"{}}}"#,
                 desktop_owner_json(true)
             ),
             "401 Unauthorized",
diff --git a/studio/src-tauri/src/preflight/backend.rs b/studio/src-tauri/src/preflight/backend.rs
index 5a58142667..9813b76c9a 100644
--- a/studio/src-tauri/src/preflight/backend.rs
+++ b/studio/src-tauri/src/preflight/backend.rs
@@ -1,6 +1,6 @@
 use super::types::BackendProbe;
 use super::version::{
-    backend_version_stale_reason, DESKTOP_MANAGEABILITY_VERSION, DESKTOP_PROTOCOL_VERSION,
+    backend_version_stale_reason, DESKTOP_BACKEND_MANAGEABILITY_VERSION, DESKTOP_PROTOCOL_VERSION,
 };
 use serde::{Deserialize, Serialize};
 
@@ -149,7 +149,7 @@ fn backend_capability_stale_reason(health: &BackendHealth) -> Option<String> {
             .clone()
             .or_else(|| Some("desktop_auth_unsupported".to_string()));
     }
-    if health.desktop_manageability_version.unwrap_or(0) < DESKTOP_MANAGEABILITY_VERSION {
+    if health.desktop_manageability_version.unwrap_or(0) < DESKTOP_BACKEND_MANAGEABILITY_VERSION {
         return Some("desktop_manageability_unsupported".to_string());
     }
     if health.supports_desktop_backend_ownership != Some(true) {
diff --git a/studio/src-tauri/src/preflight/managed.rs b/studio/src-tauri/src/preflight/managed.rs
index 0d20f271c5..0d67a1c3e6 100644
--- a/studio/src-tauri/src/preflight/managed.rs
+++ b/studio/src-tauri/src/preflight/managed.rs
@@ -11,13 +11,18 @@ use std::time::{Duration, Instant, UNIX_EPOCH};
 use tokio::io::AsyncReadExt;
 use tokio::process::Command;
 
-const MANAGED_CAPABILITY_CACHE_SCHEMA: u16 = 2;
+// 3: the cached capability gained studio_install_ok / studio_install_reason.
+const MANAGED_CAPABILITY_CACHE_SCHEMA: u16 = 3;
 
 const FNV64_OFFSET_BASIS: u64 = 0xcbf29ce484222325;
 const FNV64_PRIME: u64 = 0x100000001b3;
 const HASHED_MARKER_MAX_BYTES: u64 = 64 * 1024;
 
 const FALLBACK_MARKER_NAMES: &[&str] = &[
+    // In the fingerprint, not just the cached answer: a repair touching only
+    // studio.txt leaves every other marker alone, so a cache entry written
+    // while healthy would outlive the dropped manifest. Mirrors MANIFEST_NAME.
+    "unsloth_install_manifest.json",
     "pyvenv.cfg",
     "uv.lock",
     "requirements.txt",
@@ -33,6 +38,10 @@ struct DesktopCapability {
     supports_provision_desktop_auth: Option<bool>,
     supports_desktop_backend_ownership: Option<bool>,
     desktop_auth_stale_reason: Option<String>,
+    // A part-way install leaves a CLI that answers `-h` and a backend that dies
+    // on `import structlog`, so a running CLI does not mean ready.
+    studio_install_ok: Option<bool>,
+    studio_install_reason: Option<String>,
     version: Option<String>,
 }
 
@@ -94,6 +103,41 @@ fn marker_content_hash(path: &Path, metadata: &fs::Metadata) -> Option<u64> {
         .map(|bytes| hash_bytes(FNV64_OFFSET_BASIS, &bytes))
 }
 
+fn site_packages_dirs(venv_dir: &Path) -> Vec<PathBuf> {
+    let mut out = Vec::new();
+    #[cfg(unix)]
+    {
+        if let Ok(lib_dir) = fs::read_dir(venv_dir.join("lib")) {
+            for entry in lib_dir.flatten() {
+                out.push(entry.path().join("site-packages"));
+            }
+        }
+    }
+    out.push(venv_dir.join("Lib").join("site-packages"));
+    // read_dir order is unspecified and the hashes below fold in order.
+    out.sort();
+    out
+}
+
+/// Hash of the .dist-info / .egg-info names present, version included.
+///
+/// pip uninstall rewrites nothing else that is fingerprinted, so a venv that
+/// lost a studio.txt dependency would keep serving the healthy verdict.
+fn installed_distributions_hash(site_packages: &Path) -> Option<u64> {
+    let mut names: Vec<String> = fs::read_dir(site_packages)
+        .ok()?
+        .flatten()
+        .filter_map(|entry| {
+            let name = entry.file_name().to_string_lossy().into_owned();
+            (name.ends_with(".dist-info") || name.ends_with(".egg-info")).then_some(name)
+        })
+        .collect();
+    names.sort();
+    Some(names.iter().fold(FNV64_OFFSET_BASIS, |hash, name| {
+        hash_bytes(hash, name.as_bytes())
+    }))
+}
+
 fn marker_candidates_for_bin(bin: &Path) -> Vec<PathBuf> {
     let Some(scripts_dir) = bin.parent() else {
         return Vec::new();
@@ -103,34 +147,18 @@ fn marker_candidates_for_bin(bin: &Path) -> Vec<PathBuf> {
     };
     let mut out = Vec::new();
 
-    #[cfg(unix)]
-    {
-        if let Ok(lib_dir) = fs::read_dir(venv_dir.join("lib")) {
-            for entry in lib_dir.flatten() {
-                out.push(
-                    entry
-                        .path()
-                        .join("site-packages")
-                        .join("unsloth_cli")
-                        .join("commands")
-                        .join("studio.py"),
-                );
-            }
-        }
+    for site_packages in site_packages_dirs(venv_dir) {
+        out.push(
+            site_packages
+                .join("unsloth_cli")
+                .join("commands")
+                .join("studio.py"),
+        );
     }
     for marker_name in FALLBACK_MARKER_NAMES {
         out.push(venv_dir.join(marker_name));
         out.push(scripts_dir.join(marker_name));
     }
-
-    out.push(
-        venv_dir
-            .join("Lib")
-            .join("site-packages")
-            .join("unsloth_cli")
-            .join("commands")
-            .join("studio.py"),
-    );
     out
 }
 
@@ -160,7 +188,7 @@ fn managed_bin_fingerprint(bin: &Path) -> Option<ManagedBinFingerprint> {
         })
         .collect();
     marker_entries.sort_by(|left, right| left.path.cmp(&right.path));
-    let marker_hash = marker_entries
+    let mut marker_hash = marker_entries
         .iter()
         .fold(FNV64_OFFSET_BASIS, |hash, marker| {
             let next = hash_bytes(hash, marker.path.as_bytes());
@@ -172,9 +200,20 @@ fn managed_bin_fingerprint(bin: &Path) -> Option<ManagedBinFingerprint> {
                 next
             }
         });
-    let marker_path = (!marker_entries.is_empty()).then(|| "markers".to_string());
-    let marker_size = (!marker_entries.is_empty()).then(|| marker_entries.len() as u64);
-    let marker_mtime_ms = (!marker_entries.is_empty()).then_some(marker_hash);
+    let mut tracked = marker_entries.len();
+    if let Some(venv_dir) = bin.parent().and_then(Path::parent) {
+        for site_packages in site_packages_dirs(venv_dir) {
+            let Some(dist_hash) = installed_distributions_hash(&site_packages) else {
+                continue;
+            };
+            marker_hash = hash_bytes(marker_hash, site_packages.to_string_lossy().as_bytes());
+            marker_hash = hash_bytes(marker_hash, &dist_hash.to_le_bytes());
+            tracked += 1;
+        }
+    }
+    let marker_path = (tracked > 0).then(|| "markers".to_string());
+    let marker_size = (tracked > 0).then_some(tracked as u64);
+    let marker_mtime_ms = (tracked > 0).then_some(marker_hash);
 
     Some(ManagedBinFingerprint {
         bin_path,
@@ -401,6 +440,16 @@ fn desktop_capability_stale_reason(capability: &DesktopCapability) -> Option<Str
     if capability.supports_desktop_backend_ownership != Some(true) {
         return Some("desktop_backend_ownership_unsupported".to_string());
     }
+    // Half-installed is Stale, not Ready: starting the backend just crashes it.
+    // A CLI too old to answer is already rejected above on manageability.
+    if capability.studio_install_ok != Some(true) {
+        return Some(
+            capability
+                .studio_install_reason
+                .clone()
+                .unwrap_or_else(|| "studio_install_incomplete".to_string()),
+        );
+    }
     backend_version_stale_reason(capability.version.as_deref())
 }
 
@@ -492,3 +541,198 @@ pub(super) async fn probe_managed_install() -> ManagedProbe {
 pub async fn managed_install_ready() -> bool {
     matches!(probe_managed_install().await, ManagedProbe::Ready { .. })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn healthy_capability() -> DesktopCapability {
+        DesktopCapability {
+            desktop_protocol_version: Some(DESKTOP_PROTOCOL_VERSION),
+            desktop_manageability_version: Some(DESKTOP_MANAGEABILITY_VERSION),
+            supports_api_only: Some(true),
+            supports_provision_desktop_auth: Some(true),
+            supports_desktop_backend_ownership: Some(true),
+            desktop_auth_stale_reason: None,
+            studio_install_ok: Some(true),
+            studio_install_reason: None,
+            version: Some("2026.7.5".to_string()),
+        }
+    }
+
+    #[test]
+    fn complete_install_is_ready() {
+        assert_eq!(desktop_capability_stale_reason(&healthy_capability()), None);
+        assert!(desktop_capability_ready(&healthy_capability()));
+    }
+
+    #[test]
+    fn incomplete_install_is_stale_with_the_cli_reason() {
+        // The venv has the CLI but not structlog, so preflight must repair
+        // rather than spawn a backend that cannot import.
+        let mut capability = healthy_capability();
+        capability.studio_install_ok = Some(false);
+        capability.studio_install_reason = Some("studio_install_incomplete".to_string());
+        assert_eq!(
+            desktop_capability_stale_reason(&capability).as_deref(),
+            Some("studio_install_incomplete")
+        );
+        assert!(!desktop_capability_ready(&capability));
+    }
+
+    #[test]
+    fn deps_removed_after_install_is_stale() {
+        let mut capability = healthy_capability();
+        capability.studio_install_ok = Some(false);
+        capability.studio_install_reason = Some("studio_deps_missing".to_string());
+        assert_eq!(
+            desktop_capability_stale_reason(&capability).as_deref(),
+            Some("studio_deps_missing")
+        );
+    }
+
+    #[test]
+    fn missing_install_field_falls_back_to_a_generic_reason() {
+        let mut capability = healthy_capability();
+        capability.studio_install_ok = None;
+        capability.studio_install_reason = None;
+        assert_eq!(
+            desktop_capability_stale_reason(&capability).as_deref(),
+            Some("studio_install_incomplete")
+        );
+    }
+
+    #[test]
+    fn older_cli_is_rejected_on_manageability_before_the_install_check() {
+        // A CLI predating this feature cannot answer studio_install_ok, so the
+        // more specific manageability reason must win in the diagnostics.
+        let mut capability = healthy_capability();
+        capability.desktop_manageability_version = Some(1);
+        capability.studio_install_ok = None;
+        assert_eq!(
+            desktop_capability_stale_reason(&capability).as_deref(),
+            Some("desktop_manageability_unsupported")
+        );
+    }
+
+    #[test]
+    fn a_stale_capability_is_never_served_from_cache() {
+        // write_cached_capability runs before the ready check, so an incomplete
+        // install does get cached; reusing it would outlive the repair.
+        let mut capability = healthy_capability();
+        capability.studio_install_ok = Some(false);
+        let cache = ManagedCapabilityCache {
+            schema: MANAGED_CAPABILITY_CACHE_SCHEMA,
+            bin_path: "/managed/unsloth".to_string(),
+            bin_size: 1,
+            bin_mtime_ms: 1,
+            studio_root_id: None,
+            marker_path: None,
+            marker_size: None,
+            marker_mtime_ms: None,
+            desktop_protocol_version: DESKTOP_PROTOCOL_VERSION,
+            desktop_manageability_version: DESKTOP_MANAGEABILITY_VERSION,
+            capability,
+        };
+        let fingerprint = ManagedBinFingerprint {
+            bin_path: "/managed/unsloth".to_string(),
+            bin_size: 1,
+            bin_mtime_ms: 1,
+            studio_root_id: None,
+            marker_path: None,
+            marker_size: None,
+            marker_mtime_ms: None,
+        };
+        assert!(!cache_matches(&cache, &fingerprint));
+    }
+
+    #[test]
+    fn dropping_the_manifest_changes_the_fingerprint() {
+        // Otherwise a cache entry written while healthy outlives the manifest,
+        // and the probe returns Ready on the very venv this is meant to catch.
+        let venv = std::env::temp_dir().join(format!(
+            "unsloth-fingerprint-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let scripts = venv.join("bin");
+        fs::create_dir_all(&scripts).unwrap();
+        let bin = scripts.join("unsloth");
+        fs::write(&bin, "#!/bin/sh\nexit 0\n").unwrap();
+        let manifest = venv.join("unsloth_install_manifest.json");
+        fs::write(&manifest, "{}").unwrap();
+
+        let with_manifest = managed_bin_fingerprint(&bin).unwrap();
+        fs::remove_file(&manifest).unwrap();
+        let without_manifest = managed_bin_fingerprint(&bin).unwrap();
+
+        assert_ne!(with_manifest, without_manifest);
+        let _ = fs::remove_dir_all(&venv);
+    }
+
+    fn cache_for(fingerprint: &ManagedBinFingerprint) -> ManagedCapabilityCache {
+        ManagedCapabilityCache {
+            schema: MANAGED_CAPABILITY_CACHE_SCHEMA,
+            bin_path: fingerprint.bin_path.clone(),
+            bin_size: fingerprint.bin_size,
+            bin_mtime_ms: fingerprint.bin_mtime_ms,
+            studio_root_id: fingerprint.studio_root_id.clone(),
+            marker_path: fingerprint.marker_path.clone(),
+            marker_size: fingerprint.marker_size,
+            marker_mtime_ms: fingerprint.marker_mtime_ms,
+            desktop_protocol_version: DESKTOP_PROTOCOL_VERSION,
+            desktop_manageability_version: DESKTOP_MANAGEABILITY_VERSION,
+            capability: healthy_capability(),
+        }
+    }
+
+    #[test]
+    fn losing_a_studio_package_changes_the_fingerprint() {
+        // pip uninstall rewrites no fingerprinted file: the manifest, pyvenv.cfg
+        // and the launcher survive and `unsloth -h` still exits 0. Without the
+        // installed distributions in the fingerprint the healthy answer sticks.
+        let venv = std::env::temp_dir().join(format!(
+            "unsloth-fingerprint-deps-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let _ = fs::remove_dir_all(&venv);
+        let scripts = venv.join("bin");
+        fs::create_dir_all(&scripts).unwrap();
+        let bin = scripts.join("unsloth");
+        fs::write(&bin, "#!/bin/sh\nexit 0\n").unwrap();
+        fs::write(venv.join("pyvenv.cfg"), "home = /usr/bin\n").unwrap();
+        fs::write(venv.join("unsloth_install_manifest.json"), "{}").unwrap();
+
+        let site_packages = venv.join("lib").join("python3.11").join("site-packages");
+        fs::create_dir_all(site_packages.join("unsloth_cli").join("commands")).unwrap();
+        fs::write(
+            site_packages
+                .join("unsloth_cli")
+                .join("commands")
+                .join("studio.py"),
+            "# cli\n",
+        )
+        .unwrap();
+        let dist_info = site_packages.join("fastmcp-3.0.2.dist-info");
+        fs::create_dir_all(&dist_info).unwrap();
+        fs::write(dist_info.join("METADATA"), "Name: fastmcp\n").unwrap();
+
+        let with_dep = managed_bin_fingerprint(&bin).unwrap();
+        let healthy_cache = cache_for(&with_dep);
+        // read_dir order is unspecified, so an unsorted walk would miss its own
+        // cache every launch and the entry would never be worth writing.
+        assert_eq!(with_dep, managed_bin_fingerprint(&bin).unwrap());
+        assert!(cache_matches(&healthy_cache, &with_dep));
+
+        fs::remove_dir_all(&dist_info).unwrap();
+        let without_dep = managed_bin_fingerprint(&bin).unwrap();
+
+        assert_ne!(with_dep, without_dep);
+        assert!(
+            !cache_matches(&healthy_cache, &without_dep),
+            "a removed studio package must not keep serving the cached Ready answer"
+        );
+        let _ = fs::remove_dir_all(&venv);
+    }
+}
diff --git a/studio/src-tauri/src/preflight/version.rs b/studio/src-tauri/src/preflight/version.rs
index b920c8744b..a39681416a 100644
--- a/studio/src-tauri/src/preflight/version.rs
+++ b/studio/src-tauri/src/preflight/version.rs
@@ -1,7 +1,15 @@
 use std::cmp::Ordering;
 
 pub(crate) const DESKTOP_PROTOCOL_VERSION: u16 = 1;
-pub(crate) const DESKTOP_MANAGEABILITY_VERSION: u16 = 1;
+// 2: the CLI must report studio_install_ok from `studio desktop-capabilities`,
+// so an interrupted install is caught before the backend is spawned. A CLI
+// reporting 1 is Stale and gets repaired, which reinstalls what it missed.
+pub(crate) const DESKTOP_MANAGEABILITY_VERSION: u16 = 2;
+// What a RUNNING backend must report to be adopted and stopped. Not the
+// constant above: studio_install_ok is CLI-side, so gating on 2 would only
+// reject (and so never adopt, or stop) a backend the previous app version
+// spawned. Bump only for a real backend contract change, keep it <= main.py's.
+pub(crate) const DESKTOP_BACKEND_MANAGEABILITY_VERSION: u16 = 1;
 // Explicit backend package minimum, not the desktop app Cargo version: backend
 // and app releases can diverge. When bumping, verify this package exists on PyPI.
 pub(super) const MIN_DESKTOP_BACKEND_VERSION: &str = "2026.5.3";
diff --git a/studio/src-tauri/tauri.conf.json b/studio/src-tauri/tauri.conf.json
index e691ee565a..11383cf62c 100644
--- a/studio/src-tauri/tauri.conf.json
+++ b/studio/src-tauri/tauri.conf.json
@@ -36,7 +36,7 @@
   },
   "plugins": {
     "updater": {
-      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDE0NjlBNkEwQTc0QjY0Q0UKUldUT1pFdW5vS1pwRkl3TXRrOGlYdDNMeTh1bEhSbURrM3IyT2lTK1BiekpTc0Z2SXZFeVNibDIK",
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDFBQzA4RjczODM0RjE1QjcKUldTM0ZVK0RjNC9BR2t4R0RVaFR5cTkyUlRVQ1FwaGV0Nk04eWNwWXBhZnlzalJydllmZm1QTS8K",
       "endpoints": [
         "https://github.com/unslothai/unsloth/releases/download/desktop-latest/latest.json"
       ],
diff --git a/tests/python/test_tokenizers_and_torch_constraint.py b/tests/python/test_tokenizers_and_torch_constraint.py
index c58808689b..d42a274478 100644
--- a/tests/python/test_tokenizers_and_torch_constraint.py
+++ b/tests/python/test_tokenizers_and_torch_constraint.py
@@ -88,11 +88,21 @@ class TestStructuralTorchConstraint:
         """$TORCH_CONSTRAINT must appear in a uv pip install line."""
         assert '"$TORCH_CONSTRAINT"' in self._sh
 
-    def test_hardcoded_torch_constraint_only_once(self):
-        """The hard-coded torch>=2.4,<2.11.0 string should appear exactly once
-        in install.sh (the default assignment), not in pip install lines."""
-        count = self._sh.count('"torch>=2.4,<2.11.0"')
-        assert count == 1, f"Expected 1, found {count}"
+    def test_hardcoded_torch_constraint_only_on_assignments(self):
+        """The hard-coded torch>=2.4,<2.11.0 string must only appear on
+        TORCH_CONSTRAINT= assignment lines, never on a pip/uv install line
+        (those must reference $TORCH_CONSTRAINT). Two assignments are expected:
+        the default, and the gfx906 (MI50) reroute that restores the default
+        <2.11 window after the rocm7.2 floor bump raised it to 2.11."""
+        hits = [ln for ln in self._sh.splitlines() if '"torch>=2.4,<2.11.0"' in ln]
+        assert hits, "default constraint literal missing from install.sh"
+        for ln in hits:
+            assert (
+                "TORCH_CONSTRAINT=" in ln
+            ), f"torch>=2.4,<2.11.0 hardcoded off a TORCH_CONSTRAINT= assignment: {ln.strip()!r}"
+            assert (
+                "pip install" not in ln
+            ), f"torch>=2.4,<2.11.0 hardcoded on a pip install line: {ln.strip()!r}"
 
     def test_tightening_guarded_by_skip_torch(self):
         """The block must check SKIP_TORCH=false."""
diff --git a/tests/saving/run_offline_gguf_integration.py b/tests/saving/run_offline_gguf_integration.py
new file mode 100644
index 0000000000..eabc5f96e6
--- /dev/null
+++ b/tests/saving/run_offline_gguf_integration.py
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Download real Gemma weights and run offline integration tests for #7481.
+
+Sets ``UNSLOTH_INTEGRATION_IMPORT=1`` for the pytest subprocess so the
+real-cache suite is not silently skipped. Requires a host that can import
+unsloth (typically GPU).
+
+Example:
+  python tests/saving/run_offline_gguf_integration.py
+  python tests/saving/run_offline_gguf_integration.py --download-only
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+REPO = "unsloth/gemma-3-270m-it-bnb-4bit"
+CACHE_ROOT = Path(
+    os.environ.get("HF_HOME") or os.path.join(tempfile.gettempdir(), "hf_offline_test_cache")
+)
+
+
+def download():
+    from huggingface_hub import snapshot_download
+
+    os.environ.setdefault("HF_HOME", str(CACHE_ROOT))
+    path = snapshot_download(REPO, cache_dir = str(CACHE_ROOT / "hub"))
+    print("cached at", path)
+
+
+def run_tests():
+    os.environ.setdefault("HF_HOME", str(CACHE_ROOT))
+    # Real-cache suite is gated on this; without it every integration test skips
+    # and the runner reports success after only the fake-cache unit file ran.
+    env = os.environ.copy()
+    env["UNSLOTH_INTEGRATION_IMPORT"] = "1"
+    cmd = [
+        sys.executable,
+        "-m",
+        "pytest",
+        "tests/saving/test_offline_gguf_vlm_tokenizer_7481.py",
+        "tests/saving/test_offline_gguf_real_cache_integration.py",
+        "-q",
+    ]
+    raise SystemExit(subprocess.call(cmd, cwd = str(Path(__file__).resolve().parents[2]), env = env))
+
+
+def main():
+    import argparse
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--download-only", action = "store_true")
+    args = parser.parse_args()
+    download()
+    if not args.download_only:
+        run_tests()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/saving/test_offline_gguf_real_cache_integration.py b/tests/saving/test_offline_gguf_real_cache_integration.py
new file mode 100644
index 0000000000..fb71ed6603
--- /dev/null
+++ b/tests/saving/test_offline_gguf_real_cache_integration.py
@@ -0,0 +1,122 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Integration tests for #7481 using real cached Gemma weights.
+
+Requires a one-time online download into ``$HF_HOME`` (defaults to a
+``hf_offline_test_cache`` directory under the platform temp dir):
+
+  HF_HOME=<cache> python -c \\
+    "from huggingface_hub import snapshot_download; snapshot_download('unsloth/gemma-3-270m-it-bnb-4bit', cache_dir='<cache>/hub')"
+
+Every test here drives unsloth's own resolver. Resolving through
+``hf_hub_download`` directly would pass with the fix reverted, since that is
+plain huggingface_hub behaviour rather than anything this change touches.
+
+Importing unsloth pulls the whole package graph, which CPU-only hosts cannot
+do, so the suite is gated behind ``UNSLOTH_INTEGRATION_IMPORT=1``.
+"""
+
+from __future__ import annotations
+
+import os
+import socket
+import tempfile
+from pathlib import Path
+
+import pytest
+
+REPO = "unsloth/gemma-3-270m-it-bnb-4bit"
+CACHE_ROOT = Path(
+    os.environ.get("HF_HOME") or os.path.join(tempfile.gettempdir(), "hf_offline_test_cache")
+)
+
+pytestmark = [
+    pytest.mark.integration,
+    pytest.mark.skipif(
+        os.environ.get("UNSLOTH_INTEGRATION_IMPORT") != "1",
+        reason = "full unsloth import needs a GPU host; set UNSLOTH_INTEGRATION_IMPORT=1 to enable",
+    ),
+]
+
+
+def _require_cached_repo():
+    from huggingface_hub import scan_cache_dir
+
+    cache_dir = CACHE_ROOT / "hub"
+    if not cache_dir.exists():
+        pytest.skip(f"cache missing at {cache_dir}; run snapshot_download for {REPO}")
+    repos = [r.repo_id for r in scan_cache_dir(str(cache_dir)).repos]
+    if REPO not in repos:
+        pytest.skip(f"{REPO} not in {cache_dir}")
+
+
+def _block_network(monkeypatch):
+    def _guard(*args, **kwargs):
+        raise OSError("network blocked for offline integration test")
+
+    # Patch the method, not the class: replacing socket.socket itself breaks any
+    # isinstance(x, socket.socket) in the stack under test.
+    monkeypatch.setattr(socket.socket, "connect", _guard)
+    monkeypatch.setattr(socket, "create_connection", _guard)
+    monkeypatch.setattr(socket, "getaddrinfo", _guard)
+
+
+def _offline_env(monkeypatch):
+    monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+    monkeypatch.setenv("TRANSFORMERS_OFFLINE", "1")
+    monkeypatch.setenv("HF_HOME", str(CACHE_ROOT))
+
+
+def test_real_cached_snapshot_resolves_offline(monkeypatch):
+    _require_cached_repo()
+    _offline_env(monkeypatch)
+    _block_network(monkeypatch)
+
+    from unsloth.models.loader_utils import _resolve_hub_repo_local_dir
+
+    snap = Path(
+        _resolve_hub_repo_local_dir(
+            REPO,
+            cache_dir = str(CACHE_ROOT / "hub"),
+            local_files_only = True,
+        )
+    )
+    assert (snap / "tokenizer.json").is_file()
+    assert (snap / "tokenizer.model").is_file()
+
+
+def test_real_cached_tokenizer_loads_from_snapshot_not_repo_id(monkeypatch):
+    """The #7481 fix: the loader hands transformers a snapshot dir, not a repo id."""
+    _require_cached_repo()
+    _offline_env(monkeypatch)
+    _block_network(monkeypatch)
+
+    from unsloth.models.loader_utils import _load_pretrained_tokenizer_fast
+
+    tok = _load_pretrained_tokenizer_fast(
+        REPO,
+        local_files_only = True,
+        cache_dir = str(CACHE_ROOT / "hub"),
+    )
+    assert tok.vocab_size > 0
+    # A repo id here means the Hub metadata probe was reached, which is the bug.
+    assert tok.name_or_path != REPO
+    assert Path(tok.name_or_path).is_dir()
+
+
+def test_real_cached_unsloth_helpers_offline(monkeypatch):
+    _require_cached_repo()
+    _offline_env(monkeypatch)
+    _block_network(monkeypatch)
+
+    from unsloth.models.loader_utils import _load_pretrained_tokenizer_fast
+    from unsloth.save import _has_tokenizer_model
+
+    tok = _load_pretrained_tokenizer_fast(
+        REPO,
+        local_files_only = True,
+        cache_dir = str(CACHE_ROOT / "hub"),
+    )
+    assert tok.vocab_size > 0
+    assert _has_tokenizer_model(tok) is True
diff --git a/tests/saving/test_offline_gguf_vlm_tokenizer_7481.py b/tests/saving/test_offline_gguf_vlm_tokenizer_7481.py
new file mode 100644
index 0000000000..9a15e362fc
--- /dev/null
+++ b/tests/saving/test_offline_gguf_vlm_tokenizer_7481.py
@@ -0,0 +1,336 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Offline GGUF export must not probe the Hub for VLM tokenizer metadata (issue #7481).
+
+Regression for ``PreTrainedTokenizerFast.from_pretrained`` on a repo id calling
+``is_base_mistral()`` -> ``model_info()`` even with ``TRANSFORMERS_OFFLINE=1``.
+Pure CPU, no network, no GPU.
+"""
+
+import json
+import os
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from unsloth.models import loader_utils as L
+
+
+_REPO = "llmfan46/gemma-4-E4B-it-ultra-uncensored-heretic"
+_COMMIT = "5964fe4c7339c5974e879baba8982a09616f68ca"
+
+
+def _write_gemma4_cache(
+    root,
+    repo_id = _REPO,
+    commit = _COMMIT,
+):
+    """Minimal cached snapshot matching the reporter's layout."""
+    org, name = repo_id.split("/")
+    repo_root = root / f"models--{org}--{name}"
+    snap = repo_root / "snapshots" / commit
+    snap.mkdir(parents = True)
+    refs = repo_root / "refs"
+    refs.mkdir(parents = True, exist_ok = True)
+    (refs / "main").write_text(commit, encoding = "utf-8")
+    (snap / "tokenizer_config.json").write_text(
+        json.dumps({"tokenizer_class": "GemmaTokenizer", "model_max_length": 8192}),
+        encoding = "utf-8",
+    )
+    (snap / "tokenizer.json").write_text(
+        json.dumps(
+            {
+                "version": "1.0",
+                "truncation": None,
+                "padding": None,
+                "added_tokens": [],
+                "normalizer": None,
+                "pre_tokenizer": None,
+                "post_processor": None,
+                "decoder": None,
+                "model": {"type": "BPE", "vocab": {"<pad>": 0}, "merges": []},
+            }
+        ),
+        encoding = "utf-8",
+    )
+    (snap / "processor_config.json").write_text("{}", encoding = "utf-8")
+    (snap / "config.json").write_text(
+        json.dumps({"model_type": "gemma4"}),
+        encoding = "utf-8",
+    )
+    return snap
+
+
+def _offline_env(monkeypatch, cache_root):
+    monkeypatch.setenv("HF_HUB_OFFLINE", "1")
+    monkeypatch.setenv("TRANSFORMERS_OFFLINE", "1")
+    monkeypatch.setenv("HF_HUB_CACHE", str(cache_root))
+
+
+def test_resolve_hub_repo_cached_file_finds_tokenizer_model(tmp_path, monkeypatch):
+    snap = _write_gemma4_cache(tmp_path)
+    (snap / "tokenizer.model").write_bytes(b"sp-model")
+    _offline_env(monkeypatch, tmp_path)
+
+    got = L._resolve_hub_repo_cached_file(
+        _REPO,
+        "tokenizer.model",
+        local_files_only = True,
+        cache_dir = str(tmp_path),
+    )
+    assert got == str(snap / "tokenizer.model")
+
+
+def test_resolve_hub_repo_local_dir_from_cached_snapshot(tmp_path, monkeypatch):
+    snap = _write_gemma4_cache(tmp_path)
+    _offline_env(monkeypatch, tmp_path)
+
+    got = L._resolve_hub_repo_local_dir(_REPO, local_files_only = True, cache_dir = str(tmp_path))
+    assert got == str(snap)
+
+
+def test_hub_repo_or_local_path_prefers_snapshot_over_repo_id(tmp_path, monkeypatch):
+    snap = _write_gemma4_cache(tmp_path)
+    _offline_env(monkeypatch, tmp_path)
+
+    got = L._hub_repo_or_local_path(_REPO, local_files_only = True, cache_dir = str(tmp_path))
+    assert got == str(snap)
+    assert got != _REPO
+
+
+def test_hub_repo_or_local_path_keeps_repo_id_online(tmp_path, monkeypatch):
+    snap = _write_gemma4_cache(tmp_path)
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    monkeypatch.setenv("HF_HUB_CACHE", str(tmp_path))
+
+    got = L._hub_repo_or_local_path(_REPO, local_files_only = False, cache_dir = str(tmp_path))
+    assert got == _REPO
+    assert got != str(snap)
+
+
+def test_has_tokenizer_model_offline_does_not_cache_negative(tmp_path, monkeypatch):
+    from unsloth.save import _TOKENIZER_MODEL_CACHE, _has_tokenizer_model
+
+    snap = _write_gemma4_cache(tmp_path)
+    _offline_env(monkeypatch, tmp_path)
+    _TOKENIZER_MODEL_CACHE.clear()
+
+    tok = SimpleNamespace(name_or_path = _REPO)
+    assert _has_tokenizer_model(tok, token = None) is False
+    assert _REPO not in _TOKENIZER_MODEL_CACHE
+
+    (snap / "tokenizer.model").write_bytes(b"sp-model")
+    assert _has_tokenizer_model(tok, token = None) is True
+
+
+def test_preserve_sentencepiece_offline_copies_cached_model(tmp_path, monkeypatch):
+    from unsloth.save import _TOKENIZER_MODEL_CACHE, _preserve_sentencepiece_tokenizer_assets
+
+    snap = _write_gemma4_cache(tmp_path)
+    (snap / "tokenizer.model").write_bytes(b"cached-sp-model")
+    _offline_env(monkeypatch, tmp_path)
+    _TOKENIZER_MODEL_CACHE.clear()
+
+    save_dir = tmp_path / "export"
+    save_dir.mkdir()
+    (save_dir / "tokenizer_config.json").write_text("{}", encoding = "utf-8")
+    tok = SimpleNamespace(name_or_path = _REPO)
+
+    _preserve_sentencepiece_tokenizer_assets(tok, str(save_dir))
+
+    assert (save_dir / "tokenizer.model").read_bytes() == b"cached-sp-model"
+
+
+def test_load_pretrained_tokenizer_fast_passes_snapshot_not_repo_id(tmp_path, monkeypatch):
+    snap = _write_gemma4_cache(tmp_path)
+    _offline_env(monkeypatch, tmp_path)
+
+    seen_paths = []
+
+    class _FakeFast:
+        @classmethod
+        def from_pretrained(cls, path, **kwargs):
+            seen_paths.append(path)
+            assert kwargs.get("local_files_only") is True
+            return SimpleNamespace(name_or_path = path)
+
+    monkeypatch.setattr(
+        "transformers.PreTrainedTokenizerFast",
+        _FakeFast,
+        raising = False,
+    )
+
+    with patch("huggingface_hub.HfApi.model_info") as model_info:
+        model_info.side_effect = AssertionError("model_info must not run offline")
+        tok = L._load_pretrained_tokenizer_fast(_REPO, cache_dir = str(tmp_path))
+
+    assert seen_paths == [str(snap)]
+    assert tok.name_or_path == str(snap)
+
+
+def test_has_tokenizer_model_offline_skips_model_info(tmp_path, monkeypatch):
+    from unsloth.save import _TOKENIZER_MODEL_CACHE, _has_tokenizer_model
+
+    _write_gemma4_cache(tmp_path)
+    _offline_env(monkeypatch, tmp_path)
+    _TOKENIZER_MODEL_CACHE.clear()
+
+    tok = SimpleNamespace(name_or_path = _REPO)
+
+    # A raising side_effect proves nothing: _has_tokenizer_model wraps the call
+    # in `except Exception: return False`, so it passes with the fix reverted.
+    with patch("huggingface_hub.HfApi.model_info") as model_info:
+        assert _has_tokenizer_model(tok, token = None) is False
+    assert model_info.call_count == 0
+
+
+def test_has_tokenizer_model_probes_cache_before_model_info(tmp_path, monkeypatch):
+    from unsloth.save import _TOKENIZER_MODEL_CACHE, _has_tokenizer_model
+
+    snap = _write_gemma4_cache(tmp_path)
+    (snap / "tokenizer.model").write_bytes(b"sp-model")
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    monkeypatch.setenv("HF_HUB_CACHE", str(tmp_path))
+    _TOKENIZER_MODEL_CACHE.clear()
+
+    tok = SimpleNamespace(name_or_path = _REPO)
+
+    with patch("huggingface_hub.HfApi.model_info") as model_info:
+        model_info.side_effect = AssertionError("model_info must not run when cache hit")
+        assert _has_tokenizer_model(tok, token = None) is True
+
+
+def test_offline_aware_load_persists_local_only_for_saving(tmp_path, monkeypatch):
+    """An explicit ``local_files_only = True`` load must still be local-only at save time.
+
+    ``transformers`` takes ``local_files_only`` as an explicit ``from_pretrained``
+    parameter, so it never reaches ``tokenizer.init_kwargs``, and
+    ``_offline_aware_load`` restores the offline env vars once the load returns.
+    Without the stamp the request is invisible by the time we save.
+    """
+    from unsloth.save import _TOKENIZER_MODEL_CACHE, _has_tokenizer_model
+
+    # Snapshot has tokenizer metadata but deliberately no tokenizer.model, so the
+    # cache probe misses and only the local-only stamp can stop the Hub request.
+    _write_gemma4_cache(tmp_path)
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    monkeypatch.setenv("HF_HUB_CACHE", str(tmp_path))
+    _TOKENIZER_MODEL_CACHE.clear()
+
+    @L._offline_aware_load
+    def _load(model_name, **kwargs):
+        assert os.environ.get("HF_HUB_OFFLINE") == "1"
+        # A processor keeps the Hub repo id and carries no local_files_only.
+        return object(), SimpleNamespace(
+            tokenizer = SimpleNamespace(name_or_path = model_name, init_kwargs = {}),
+        )
+
+    _model, processor = _load(_REPO, local_files_only = True)
+
+    assert os.environ.get("HF_HUB_OFFLINE") is None
+    assert processor.tokenizer.init_kwargs.get("local_files_only") is None
+    assert L._tokenizer_wants_local_only(processor.tokenizer) is True
+
+    with patch("huggingface_hub.HfApi.model_info") as model_info:
+        model_info.return_value = SimpleNamespace(
+            siblings = [SimpleNamespace(rfilename = "tokenizer.model")],
+        )
+        assert _has_tokenizer_model(processor, token = None) is False
+    assert model_info.call_count == 0
+
+
+def test_preserve_sentencepiece_after_local_only_load_never_downloads(tmp_path, monkeypatch):
+    """The save path inherits the load's local-only mode: no metadata probe, no download."""
+    import huggingface_hub
+
+    from unsloth.save import _TOKENIZER_MODEL_CACHE, _preserve_sentencepiece_tokenizer_assets
+
+    _write_gemma4_cache(tmp_path)
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    monkeypatch.setenv("HF_HUB_CACHE", str(tmp_path))
+    _TOKENIZER_MODEL_CACHE.clear()
+
+    @L._offline_aware_load
+    def _load(model_name, **kwargs):
+        return object(), SimpleNamespace(
+            tokenizer = SimpleNamespace(name_or_path = model_name, init_kwargs = {}),
+        )
+
+    _model, processor = _load(_REPO, local_files_only = True)
+
+    save_dir = tmp_path / "export"
+    save_dir.mkdir()
+    (save_dir / "tokenizer_config.json").write_text("{}", encoding = "utf-8")
+
+    real_download = huggingface_hub.hf_hub_download
+    seen_local_files_only = []
+
+    def _recording_download(*args, **kwargs):
+        seen_local_files_only.append(kwargs.get("local_files_only"))
+        return real_download(*args, **kwargs)
+
+    monkeypatch.setattr("huggingface_hub.hf_hub_download", _recording_download)
+
+    with patch("huggingface_hub.HfApi.model_info") as model_info:
+        model_info.return_value = SimpleNamespace(
+            siblings = [SimpleNamespace(rfilename = "tokenizer.model")],
+        )
+        _preserve_sentencepiece_tokenizer_assets(processor, str(save_dir), token = None)
+
+    assert model_info.call_count == 0
+    # Every hf_hub_download here must be a cache probe, never a Hub fetch.
+    assert seen_local_files_only and all(seen_local_files_only)
+    assert not (save_dir / "tokenizer.model").exists()
+
+
+def test_has_tokenizer_model_local_files_only_skips_model_info(tmp_path, monkeypatch):
+    from unsloth.save import _TOKENIZER_MODEL_CACHE, _has_tokenizer_model
+
+    _write_gemma4_cache(tmp_path)
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    monkeypatch.setenv("HF_HUB_CACHE", str(tmp_path))
+    _TOKENIZER_MODEL_CACHE.clear()
+
+    tok = SimpleNamespace(
+        name_or_path = _REPO,
+        init_kwargs = {"local_files_only": True},
+    )
+
+    with patch("huggingface_hub.HfApi.model_info") as model_info:
+        assert _has_tokenizer_model(tok, token = None) is False
+    assert model_info.call_count == 0
+
+
+def test_custom_cache_dir_survives_to_saving(tmp_path, monkeypatch):
+    """A local-only load with a caller-supplied cache_dir that no env var points
+    at. Saving derives its cache from HF_HUB_CACHE / HF_HOME, so without the
+    stamp it probes the wrong place, and the local-only marker then stops it
+    falling back to the Hub, silently dropping tokenizer.model."""
+    from unsloth.save import _TOKENIZER_MODEL_CACHE, _has_tokenizer_model
+
+    custom_cache = tmp_path / "caller_cache"
+    custom_cache.mkdir()
+    snap = _write_gemma4_cache(custom_cache)
+    (snap / "tokenizer.model").write_bytes(b"sp-model")
+
+    # The environment points somewhere else entirely.
+    monkeypatch.delenv("HF_HUB_OFFLINE", raising = False)
+    monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False)
+    monkeypatch.setenv("HF_HUB_CACHE", str(tmp_path / "unrelated"))
+    _TOKENIZER_MODEL_CACHE.clear()
+
+    @L._offline_aware_load
+    def _load(**kwargs):
+        return SimpleNamespace(name_or_path = _REPO)
+
+    tok = _load(local_files_only = True, cache_dir = str(custom_cache))
+
+    assert L._tokenizer_cache_dir(tok) == str(custom_cache)
+    with patch("huggingface_hub.HfApi.model_info") as model_info:
+        assert _has_tokenizer_model(tok, token = None) is True
+    assert model_info.call_count == 0
diff --git a/tests/sh/test_install_rollback_lifecycle.sh b/tests/sh/test_install_rollback_lifecycle.sh
index d1ccae8e19..b0e6183fb4 100644
--- a/tests/sh/test_install_rollback_lifecycle.sh
+++ b/tests/sh/test_install_rollback_lifecycle.sh
@@ -32,6 +32,7 @@ run_signal_case() {
     {
         printf '%s\n' 'set -e'
         printf '%s\n' 'substep() { :; }'
+        printf '%s\n' 'rollback_substep() { substep "$@"; }'
         printf '%s\n' 'C_WARN=""'
         printf "STUDIO_HOME='%s'\n" "$_case_dir"
         printf "VENV_DIR='%s/unsloth_studio'\n" "$_case_dir"
@@ -77,6 +78,7 @@ START_BOUNDARY_HARNESS="$START_BOUNDARY_DIR/harness.sh"
 {
     printf '%s\n' 'set -e'
     printf '%s\n' 'substep() { :; }'
+    printf '%s\n' 'rollback_substep() { substep "$@"; }'
     printf '%s\n' 'C_WARN=""'
     printf "STUDIO_HOME='%s'\n" "$START_BOUNDARY_DIR"
     printf "VENV_DIR='%s/unsloth_studio'\n" "$START_BOUNDARY_DIR"
@@ -102,6 +104,7 @@ COMMIT_BOUNDARY_HARNESS="$COMMIT_BOUNDARY_DIR/harness.sh"
 {
     printf '%s\n' 'set -e'
     printf '%s\n' 'substep() { :; }'
+    printf '%s\n' 'rollback_substep() { substep "$@"; }'
     printf '%s\n' 'C_WARN=""'
     printf "STUDIO_HOME='%s'\n" "$COMMIT_BOUNDARY_DIR"
     printf "VENV_DIR='%s/unsloth_studio'\n" "$COMMIT_BOUNDARY_DIR"
@@ -131,6 +134,7 @@ PRUNE_HARNESS="$PRUNE_DIR/harness.sh"
 {
     printf '%s\n' 'set -e'
     printf '%s\n' 'substep() { :; }'
+    printf '%s\n' 'rollback_substep() { substep "$@"; }'
     printf '%s\n' 'C_WARN=""'
     printf "STUDIO_HOME='%s'\n" "$PRUNE_DIR"
     printf "VENV_DIR='%s/unsloth_studio'\n" "$PRUNE_DIR"
diff --git a/tests/sh/test_tauri_retry_failure_context.sh b/tests/sh/test_tauri_retry_failure_context.sh
new file mode 100755
index 0000000000..e9034e8e54
--- /dev/null
+++ b/tests/sh/test_tauri_retry_failure_context.sh
@@ -0,0 +1,307 @@
+#!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+INSTALL_SH="$SCRIPT_DIR/../../install.sh"
+INSTALL_PS1="$SCRIPT_DIR/../../install.ps1"
+SETUP_SH="$SCRIPT_DIR/../../studio/setup.sh"
+SETUP_PS1="$SCRIPT_DIR/../../studio/setup.ps1"
+
+_FUNC_FILE=$(mktemp)
+{
+    sed -n '/^run_install_cmd()/,/^}/p' "$INSTALL_SH"
+    sed -n '/^run_install_cmd_retry()/,/^}/p' "$INSTALL_SH"
+    sed -n '/^tauri_log()/,/^}/p' "$INSTALL_SH"
+    sed -n '/^tauri_stream_log()/,/^}/p' "$INSTALL_SH"
+    sed -n '/^tauri_clear_install_error()/,/^}/p' "$INSTALL_SH"
+} > "$_FUNC_FILE"
+# shellcheck disable=SC1090
+. "$_FUNC_FILE"
+rm -f "$_FUNC_FILE"
+
+substep() {
+    :
+}
+
+step() {
+    :
+}
+
+sleep() {
+    :
+}
+
+_is_verbose() {
+    return 1
+}
+
+_redact_install_output() {
+    cat "$@"
+}
+
+echo "=== run_install_cmd_retry Tauri failure context ==="
+
+TAURI_MODE=true
+_test_attempt=0
+_test_command() {
+    _test_attempt=$((_test_attempt + 1))
+    [ "$_test_attempt" -eq 2 ]
+}
+
+UNSLOTH_INSTALL_RETRIES=3
+UNSLOTH_INSTALL_RETRY_DELAY=0
+_stdout_file=$(mktemp)
+_stderr_file=$(mktemp)
+trap 'rm -f "$_stdout_file" "$_stderr_file"' EXIT
+run_install_cmd_retry "install PyTorch" _test_command >"$_stdout_file" 2>"$_stderr_file"
+_stdout_clear_count=$(grep -c '^\[TAURI:ERROR_CLEAR\] install PyTorch recovered$' "$_stdout_file")
+_stderr_clear_count=$(grep -c '^\[TAURI:ERROR_CLEAR\] install PyTorch recovered$' "$_stderr_file")
+if [ "$_stdout_clear_count" -ne 1 ] || [ "$_stderr_clear_count" -ne 1 ]; then
+    echo "  FAIL: recovered retry emitted $_stdout_clear_count stdout and $_stderr_clear_count stderr clear markers"
+    exit 1
+fi
+echo "  PASS: recovered retry clears stale context on both streams"
+
+_test_command() {
+    printf '%s\n' "resolver error: no space left on device"
+    return 9
+}
+
+if run_install_cmd_retry "install PyTorch" _test_command >"$_stdout_file" 2>"$_stderr_file"; then
+    echo "  FAIL: permanent failure returned success"
+    exit 1
+else
+    _exit_code=$?
+fi
+if [ "$_exit_code" -ne 9 ]; then
+    echo "  FAIL: permanent failure returned exit code $_exit_code"
+    exit 1
+fi
+if grep -q '^\[TAURI:ERROR_CLEAR\]' "$_stdout_file" ||
+    grep -q '^\[TAURI:ERROR_CLEAR\]' "$_stderr_file"; then
+    echo "  FAIL: permanent failure cleared its failure context"
+    exit 1
+fi
+if ! grep -qxF '[TAURI:OUTPUT_CLEAR] install PyTorch' "$_stderr_file" ||
+    ! grep -qxF 'resolver error: no space left on device' "$_stderr_file" ||
+    ! tail -n 1 "$_stderr_file" |
+        grep -qxF '[TAURI:ERROR_OUTPUT] install PyTorch failed (exit code 9)'; then
+    echo "  FAIL: quiet failure did not bind its command output to the structured error"
+    exit 1
+fi
+echo "  PASS: permanent failure retains its command output and exit code"
+
+UNSLOTH_INSTALL_RETRIES=1
+if run_install_cmd_retry "preferred PyTorch build" _test_command >"$_stdout_file" 2>"$_stderr_file"; then
+    echo "  FAIL: failed preferred build returned success"
+    exit 1
+fi
+_test_command() {
+    return 0
+}
+run_install_cmd_retry "fallback PyTorch build" _test_command >"$_stdout_file" 2>"$_stderr_file"
+if ! grep -q '^\[TAURI:ERROR_CLEAR\] fallback PyTorch build recovered$' "$_stdout_file" ||
+    ! grep -q '^\[TAURI:ERROR_CLEAR\] fallback PyTorch build recovered$' "$_stderr_file"; then
+    echo "  FAIL: successful fallback retained the preferred build failure"
+    exit 1
+fi
+echo "  PASS: successful fallback clears an exhausted preferred failure"
+
+_test_command() {
+    return 0
+}
+run_install_cmd "successful unstructured fallback" _test_command >"$_stdout_file" 2>"$_stderr_file"
+if ! grep -q '^\[TAURI:ERROR_CLEAR\] successful unstructured fallback recovered$' "$_stdout_file" ||
+    ! grep -q '^\[TAURI:ERROR_CLEAR\] successful unstructured fallback recovered$' "$_stderr_file"; then
+    echo "  FAIL: initial success did not clear unstructured failure context"
+    exit 1
+fi
+echo "  PASS: every successful wrapped command clears unstructured failure context"
+
+_is_verbose() {
+    return 0
+}
+_test_command() {
+    printf '%s\n' "resolver error: proxy authentication required"
+    return 7
+}
+set +e
+(
+    set -e
+    run_install_cmd "verbose failure" _test_command
+) >"$_stdout_file" 2>"$_stderr_file"
+_exit_code=$?
+set -e
+if [ "$_exit_code" -ne 7 ]; then
+    echo "  FAIL: verbose failure returned exit code $_exit_code instead of 7"
+    exit 1
+fi
+if ! grep -qxF '[TAURI:OUTPUT_CLEAR] verbose failure' "$_stdout_file" ||
+    ! grep -qxF 'resolver error: proxy authentication required' "$_stdout_file" ||
+    ! tail -n 1 "$_stdout_file" |
+        grep -qxF '[TAURI:ERROR_OUTPUT] verbose failure failed (exit code 7)'; then
+    echo "  FAIL: verbose failure did not bind its command output and exit code"
+    exit 1
+fi
+echo "  PASS: verbose failure retains its command output and exit code under set -e"
+
+_test_command() {
+    _cmd_rc=9
+    return 0
+}
+run_install_cmd "verbose clobbering success" _test_command >"$_stdout_file" 2>"$_stderr_file"
+if ! grep -q '^\[TAURI:ERROR_CLEAR\] verbose clobbering success recovered$' "$_stdout_file"; then
+    echo "  FAIL: verbose success inherited a status variable written by the wrapped function"
+    exit 1
+fi
+echo "  PASS: verbose success records its status after the wrapped function returns"
+
+_test_command() {
+    return 7
+}
+_missing_status_parent=$(mktemp -d)
+rmdir "$_missing_status_parent"
+_missing_status_path="$_missing_status_parent/status"
+set +e
+(
+    set -e
+    mktemp() {
+        printf '%s\n' "$_missing_status_path"
+    }
+    run_install_cmd "missing status file" _test_command
+) >"$_stdout_file" 2>"$_stderr_file"
+_exit_code=$?
+set -e
+if [ "$_exit_code" -ne 1 ] ||
+    ! grep -q '^\[TAURI:ERROR_OUTPUT\] missing status file failed (exit code 1)$' "$_stdout_file"; then
+    echo "  FAIL: missing verbose status defaulted to an empty or invalid exit code"
+    exit 1
+fi
+echo "  PASS: missing verbose status defaults before reporting the failure"
+
+_SETUP_FUNC_FILE=$(mktemp)
+sed -n '/^setup_fail()/,/^}/p' "$SETUP_SH" > "$_SETUP_FUNC_FILE"
+# shellcheck disable=SC1090
+. "$_SETUP_FUNC_FILE"
+rm -f "$_SETUP_FUNC_FILE"
+
+set +e
+(
+    UNSLOTH_TAURI_MODE=1
+    setup_fail 7 "specific setup failure"
+) >"$_stdout_file" 2>"$_stderr_file"
+_exit_code=$?
+set -e
+if [ "$_exit_code" -ne 7 ] ||
+    ! grep -qxF '[TAURI:ERROR] specific setup failure' "$_stdout_file"; then
+    echo "  FAIL: Tauri setup failure did not emit its explicit error and exit code"
+    exit 1
+fi
+
+set +e
+(
+    UNSLOTH_TAURI_MODE=0
+    setup_fail 7 "specific setup failure"
+) >"$_stdout_file" 2>"$_stderr_file"
+_exit_code=$?
+set -e
+if [ "$_exit_code" -ne 7 ] || [ -s "$_stdout_file" ] || [ -s "$_stderr_file" ]; then
+    echo "  FAIL: non-Tauri setup failure emitted desktop protocol output"
+    exit 1
+fi
+echo "  PASS: setup failures emit explicit context only in Tauri mode"
+
+_setup_mode_count=$(grep -c 'UNSLOTH_TAURI_MODE="$TAURI_MODE"' "$INSTALL_SH")
+if [ "$_setup_mode_count" -ne 2 ]; then
+    echo "  FAIL: Unix installer does not pass Tauri mode to both setup invocations"
+    exit 1
+fi
+
+_setup_exit_count=$(grep -Ec '^[[:space:]]*exit[[:space:]]+' "$SETUP_SH")
+if [ "$_setup_exit_count" -ne 1 ] ||
+    ! grep -q '^[[:space:]]*exit "\$exit_code"$' "$SETUP_SH"; then
+    echo "  FAIL: Unix setup has explicit exits outside setup_fail"
+    exit 1
+fi
+echo "  PASS: Unix setup routes explicit exits through setup_fail"
+
+_rollback_block=$(sed -n \
+    '/^_restore_studio_venv_replacement()/,/^}/p' \
+    "$INSTALL_SH")
+_rollback_progress_count=$(printf '%s\n' "$_rollback_block" |
+    grep -c 'rollback_substep')
+if [ "$_rollback_progress_count" -ne 2 ]; then
+    echo "  FAIL: successful Unix rollback output can replace failure context"
+    exit 1
+fi
+echo "  PASS: successful Unix rollback remains structured progress"
+
+_setup_success_block=$(sed -n \
+    '/^if \[ "$_SETUP_EXIT" -eq 0 \]; then$/,/^mkdir -p "\$_LOCAL_BIN"$/p' \
+    "$INSTALL_SH")
+if ! printf '%s\n' "$_setup_success_block" |
+    grep -q 'tauri_clear_install_error "studio setup completed"'; then
+    echo "  FAIL: successful studio setup does not clear recovered setup errors before post-setup work"
+    exit 1
+fi
+
+_setup_failure_block=$(sed -n \
+    '/^# If setup.sh failed, report and exit now\.$/,/^fi$/p' \
+    "$INSTALL_SH")
+if ! printf '%s\n' "$_setup_failure_block" |
+    grep -q 'tauri_log "ERROR_DEFAULT" "studio setup failed'; then
+    echo "  FAIL: failed studio setup does not preserve output before its generic fallback"
+    exit 1
+fi
+echo "  PASS: studio setup success clears recovered errors and failure preserves specific output"
+
+_ps_setup_block=$(sed -n \
+    '/if (\$setupExit -ne 0) {/,/# ── Expose `unsloth` via a shim dir/p' \
+    "$INSTALL_PS1")
+if ! printf '%s\n' "$_ps_setup_block" | grep -q 'Exit-InstallFailure' ||
+    ! printf '%s\n' "$_ps_setup_block" |
+        grep -q 'Clear-TauriInstallError "studio setup completed"'; then
+    echo "  FAIL: Windows setup does not preserve failed output and clear successful output"
+    exit 1
+fi
+echo "  PASS: Windows setup uses the same failure-context boundaries"
+
+if ! grep -q '\$env:UNSLOTH_TAURI_MODE = if (\$TauriMode)' "$INSTALL_PS1"; then
+    echo "  FAIL: Windows installer does not pass Tauri mode to setup"
+    exit 1
+fi
+
+_ps_setup_exit_count=$(grep -Ec '^[[:space:]]*exit[[:space:]]+' "$SETUP_PS1")
+if [ "$_ps_setup_exit_count" -ne 1 ] ||
+    ! grep -q '^[[:space:]]*exit \$Code$' "$SETUP_PS1"; then
+    echo "  FAIL: Windows setup has explicit exits outside Exit-SetupFailure"
+    exit 1
+fi
+echo "  PASS: Windows setup routes explicit exits through Exit-SetupFailure"
+
+_ps_command_block=$(sed -n \
+    '/function Invoke-InstallCommand {/,/function New-StudioShortcuts {/p' \
+    "$INSTALL_PS1")
+if ! printf '%s\n' "$_ps_command_block" |
+    grep -q 'Write-TauriLog "ERROR_OUTPUT" "$Label failed' ||
+    ! printf '%s\n' "$_ps_command_block" |
+        grep -q 'Write-TauriLog "OUTPUT_CLEAR" \$Label' ||
+    ! printf '%s\n' "$_ps_command_block" |
+        grep -q 'Clear-TauriInstallError "$Label recovered"' ||
+    ! printf '%s\n' "$_ps_command_block" |
+        grep -q 'Invoke-InstallCommand -Command \$Command -Label \$Label'; then
+    echo "  FAIL: Windows command output is not attributed and cleared at the command boundary"
+    exit 1
+fi
+
+_ps_exit_block=$(sed -n \
+    '/function Exit-InstallFailure {/,/# ── Parse flags/p' \
+    "$INSTALL_PS1")
+if ! printf '%s\n' "$_ps_exit_block" |
+    grep -q 'Write-TauriLog "ERROR_DEFAULT" \$Message'; then
+    echo "  FAIL: Windows finalization can overwrite producer-owned failure context"
+    exit 1
+fi
+echo "  PASS: Windows command failures preserve output through retries and finalization"
diff --git a/tests/sh/test_torch_constraint.sh b/tests/sh/test_torch_constraint.sh
index bfafbd161b..ada95c2620 100644
--- a/tests/sh/test_torch_constraint.sh
+++ b/tests/sh/test_torch_constraint.sh
@@ -94,28 +94,34 @@ echo "=== Structural: TORCH_CONSTRAINT in install.sh ==="
 
 _SH_CONTENT=$(cat "$INSTALL_SH")
 
-_count=$(grep -c 'TORCH_CONSTRAINT="torch>=2.4,<2.11.0"' "$INSTALL_SH" || true)
+# Each hardware branch assigns its own triple, so counting every occurrence made
+# adding a branch (gfx906 in #7354) a test edit. The default is the one assigned at
+# top level; a branch's is always indented, so anchor on that instead of counting.
+_count=$(grep -c '^TORCH_CONSTRAINT="torch>=2.4,<2.11.0"$' "$INSTALL_SH" || true)
 assert_eq "default TORCH_CONSTRAINT assignment exists" "1" "$_count"
 
 _count=$(grep -c 'TORCH_CONSTRAINT="torch>=2.6,<2.11.0"' "$INSTALL_SH" || true)
-assert_eq "tightened TORCH_CONSTRAINT assignment exists" "1" "$_count"
+_has=$([ "$_count" -ge 1 ] && echo "yes" || echo "no")
+assert_eq "tightened TORCH_CONSTRAINT assignment exists" "yes" "$_has"
 
 _count=$(grep -c '"\$TORCH_CONSTRAINT"' "$INSTALL_SH" || true)
 _has_var=$([ "$_count" -ge 1 ] && echo "yes" || echo "no")
 assert_eq "\$TORCH_CONSTRAINT used in pip install" "yes" "$_has_var"
 
-# Hardcoded torch>=2.4,<2.11.0 should only appear once (the default assignment)
-_hardcoded=$(grep -c '"torch>=2.4,<2.11.0"' "$INSTALL_SH" || true)
-assert_eq "hardcoded torch>=2.4 appears exactly once" "1" "$_hardcoded"
+# What the old "appears exactly once" count was really guarding: an install line that
+# spells the pin out ignores whatever the branch above it chose.
+_literal=$(grep -cE 'uv pip install .*"torch>=' "$INSTALL_SH" || true)
+assert_eq "no pip install hardcodes a torch pin" "0" "$_literal"
 
-# Companions must be bounded to torch's window everywhere: the <2.11 bound appears
-# twice (default assignments + the pinned custom-leaf block), never bare. torchaudio
-# 2.11 dropped its exact torch pin, so a bare companion next to a <2.11-capped torch
-# resolves a mismatched 2.11 build.
-_count=$(grep -c 'TORCHVISION_CONSTRAINT="torchvision>=0.19,<0.26.0"' "$INSTALL_SH" || true)
-assert_eq "torchvision bounded (<0.26) at default + custom-leaf" "2" "$_count"
-_count=$(grep -c 'TORCHAUDIO_CONSTRAINT="torchaudio>=2.4,<2.11.0"' "$INSTALL_SH" || true)
-assert_eq "torchaudio bounded (<2.11) at default + custom-leaf" "2" "$_count"
+# Companions must be bounded to torch's window everywhere, never bare: torchaudio 2.11
+# dropped its exact torch pin, so a bare companion next to a <2.11-capped torch resolves
+# a mismatched 2.11 build. Every assignment, not a fixed number of them.
+_total=$(grep -cE '^[[:space:]]*TORCHVISION_CONSTRAINT="' "$INSTALL_SH" || true)
+_bounded=$(grep -cE '^[[:space:]]*TORCHVISION_CONSTRAINT="torchvision>=[0-9][0-9.]*,<[0-9][0-9.]*"$' "$INSTALL_SH" || true)
+assert_eq "every torchvision constraint is upper-bounded" "$_total" "$_bounded"
+_total=$(grep -cE '^[[:space:]]*TORCHAUDIO_CONSTRAINT="' "$INSTALL_SH" || true)
+_bounded=$(grep -cE '^[[:space:]]*TORCHAUDIO_CONSTRAINT="torchaudio>=[0-9][0-9.]*,<[0-9][0-9.]*"$' "$INSTALL_SH" || true)
+assert_eq "every torchaudio constraint is upper-bounded" "$_total" "$_bounded"
 _count=$(grep -c 'TORCHVISION_CONSTRAINT="torchvision"$' "$INSTALL_SH" || true)
 assert_eq "no bare torchvision companion remains" "0" "$_count"
 _count=$(grep -c 'TORCHAUDIO_CONSTRAINT="torchaudio"$' "$INSTALL_SH" || true)
diff --git a/tests/sh/test_with_llama_cpp_dir_link_behavior.sh b/tests/sh/test_with_llama_cpp_dir_link_behavior.sh
index fb09e56c51..2d87b7f541 100644
--- a/tests/sh/test_with_llama_cpp_dir_link_behavior.sh
+++ b/tests/sh/test_with_llama_cpp_dir_link_behavior.sh
@@ -37,6 +37,7 @@ case "$block" in *'_has_local_llama_server'*) : ;;
 PREAMBLE='
 set -u
 step() { :; }; substep() { :; }; verbose_substep() { :; }
+setup_fail() { exit "$1"; }
 _assert_studio_owned_or_absent() { :; }
 C_ERR=""
 _STUDIO_HOME_IS_CUSTOM=false
diff --git a/tests/studio/install/test_install_llama_prebuilt_logic.py b/tests/studio/install/test_install_llama_prebuilt_logic.py
index 3eaf56d15c..61b96f7bd6 100644
--- a/tests/studio/install/test_install_llama_prebuilt_logic.py
+++ b/tests/studio/install/test_install_llama_prebuilt_logic.py
@@ -1253,6 +1253,7 @@ def test_install_prebuilt_falls_back_to_older_release_plan(
         initial_fallback_used = False,
         existing_install_dir = None,
         force_cpu = False,
+        llama_backend = None,
     ):
         call_log.append((llama_tag, initial_fallback_used))
         if llama_tag == "b9002":
@@ -2457,6 +2458,7 @@ def test_install_prebuilt_skips_when_older_release_fallback_matches_existing_ins
         initial_fallback_used = False,
         existing_install_dir = None,
         force_cpu = False,
+        llama_backend = None,
     ):
         call_log.append(llama_tag)
         raise PrebuiltFallback("validation failed for latest release")
@@ -2605,6 +2607,7 @@ def test_install_prebuilt_skips_same_release_fallback_attempt_when_installed(
         prebuilt_fallback_used,
         quantized_path,
         force_cpu = False,
+        llama_backend = None,
     ):
         attempted_names.append(choice.name)
         if choice.name == first_choice.name:
@@ -2732,6 +2735,7 @@ def test_install_prebuilt_same_tag_upstream_failure_uses_older_unsloth_release_p
         initial_fallback_used = False,
         existing_install_dir = None,
         force_cpu = False,
+        llama_backend = None,
     ):
         attempted.append((llama_tag, release_tag, attempts[0].source_label))
         if llama_tag == "b9002":
diff --git a/tests/studio/install/test_install_manifest.py b/tests/studio/install/test_install_manifest.py
new file mode 100644
index 0000000000..79b2c1db50
--- /dev/null
+++ b/tests/studio/install/test_install_manifest.py
@@ -0,0 +1,203 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Coverage for studio/install_manifest.py.
+
+The manifest separates "the install finished" from "the installer was killed
+part-way and the venv only looks fine". The CLI, setup.sh's fast path and the
+Tauri preflight all read it, so a wrong answer either crashes the backend on
+launch or forces needless reinstalls for everyone.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+import pathlib
+
+import pytest
+
+REPO_ROOT = pathlib.Path(__file__).resolve().parents[3]
+MODULE_PATH = REPO_ROOT / "studio" / "install_manifest.py"
+
+
+def _load_module():
+    spec = importlib.util.spec_from_file_location("studio_install_manifest_under_test", MODULE_PATH)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+im = _load_module()
+
+
+@pytest.fixture
+def req_root(tmp_path: pathlib.Path) -> pathlib.Path:
+    """A requirements tree whose studio.txt names one installed and one absent dist."""
+    root = tmp_path / "requirements"
+    root.mkdir()
+    (root / "studio.txt").write_text(
+        "# comment line\n\npytest\nunsloth-definitely-not-a-real-package\n",
+        encoding = "utf-8",
+    )
+    return root
+
+
+@pytest.fixture
+def install_root(tmp_path: pathlib.Path) -> pathlib.Path:
+    root = tmp_path / "venv"
+    root.mkdir()
+    return root
+
+
+def test_parse_requirement_line_handles_the_shapes_studio_txt_uses():
+    assert im._parse_requirement_line("structlog>=24.1.0") == ("structlog", "", ">=24.1.0")
+    assert im._parse_requirement_line("matplotlib==3.10.9") == ("matplotlib", "", "==3.10.9")
+    assert im._parse_requirement_line("boto3>=1.34.0  # optional: S3") == (
+        "boto3",
+        "",
+        ">=1.34.0",
+    )
+    assert im._parse_requirement_line("uvicorn[standard]") == ("uvicorn", "", "")
+    assert im._parse_requirement_line("# just a comment") is None
+    assert im._parse_requirement_line("") is None
+    assert im._parse_requirement_line("--index-url https://example.invalid") is None
+    name, marker, specifier = im._parse_requirement_line("pywin32 ; sys_platform == 'win32'")
+    assert name == "pywin32"
+    assert "sys_platform" in marker
+    assert specifier == ""
+
+
+def test_missing_requirements_rejects_an_incompatible_installed_version(tmp_path):
+    req = tmp_path / "studio.txt"
+    req.write_text(
+        "matplotlib==3.10.9\nstructlog>=24.1.0\n",
+        encoding = "utf-8",
+    )
+    installed = {
+        "matplotlib": "3.9.0",
+        "structlog": "24.1.0",
+    }
+    assert im.missing_requirements(req, installed = installed) == ["matplotlib"]
+
+
+def test_platform_gated_lines_are_skipped_when_the_marker_does_not_apply(tmp_path):
+    req = tmp_path / "studio.txt"
+    req.write_text(
+        "unsloth-not-real-a ; sys_platform == 'definitely-not-this-platform'\n"
+        "unsloth-not-real-b\n",
+        encoding = "utf-8",
+    )
+    missing = im.missing_requirements(req)
+    assert missing == ["unsloth-not-real-b"], (
+        "a requirement gated to another OS must not be reported missing, or every "
+        "install would look broken on the platforms that legitimately skip it"
+    )
+
+
+def test_missing_requirements_matches_on_distribution_not_import_name(tmp_path):
+    # studio.txt lists PyJWT / python-docx / pymupdf, whose import names are
+    # jwt / docx / fitz, so matching on imports would look missing.
+    req = tmp_path / "studio.txt"
+    req.write_text("pytest\n", encoding = "utf-8")
+    assert im.missing_requirements(req) == []
+
+
+def test_complete_install_verifies_ok(install_root, req_root):
+    im.write_manifest(root = install_root, req_root = req_root, package_name = "pytest")
+    state = im.verify_install(root = install_root, req_root = req_root, package_name = "pytest")
+    assert state["manifest_ok"] is True
+    assert state["deps_ok"] is False  # the fake dist is intentionally absent
+    assert state["reason"] == "studio_deps_missing"
+    assert "unsloth-definitely-not-a-real-package" in state["missing"]
+
+
+def test_missing_manifest_reports_incomplete(install_root, req_root):
+    state = im.verify_install(root = install_root, req_root = req_root, package_name = "pytest")
+    assert state["ok"] is False
+    assert state["manifest_ok"] is False
+    assert state["reason"] == "studio_install_incomplete"
+
+
+def test_interrupted_install_leaves_no_manifest(install_root, req_root):
+    # remove_manifest() runs before the dependency pass, so a later kill cannot
+    # leave a stale-but-valid manifest behind.
+    im.write_manifest(root = install_root, req_root = req_root, package_name = "pytest")
+    assert im.manifest_path(install_root).is_file()
+    assert im.remove_manifest(install_root) is True
+    assert not im.manifest_path(install_root).is_file()
+    state = im.verify_install(root = install_root, req_root = req_root, package_name = "pytest")
+    assert state["reason"] == "studio_install_incomplete"
+
+
+def test_remove_manifest_reports_whether_the_marker_is_really_gone(
+    install_root, req_root, monkeypatch
+):
+    # Nothing to remove is success: a first install has no manifest yet.
+    assert im.remove_manifest(install_root) is True
+
+    # A surviving marker must be reported, not swallowed: the dependency pass
+    # would then run behind a manifest that still verifies, so a part-way kill
+    # looks complete.
+    im.write_manifest(root = install_root, req_root = req_root, package_name = "pytest")
+    path = im.manifest_path(install_root)
+
+    def _refuse(*_args, **_kwargs):
+        raise PermissionError(13, "Access is denied")
+
+    monkeypatch.setattr(pathlib.Path, "unlink", _refuse)
+    assert im.remove_manifest(install_root) is False
+    monkeypatch.undo()
+
+    # The stale marker still verifies, which is why the installer has to stop.
+    assert path.is_file()
+    state = im.verify_install(root = install_root, req_root = req_root, package_name = "pytest")
+    assert state["manifest_ok"] is True
+
+
+def test_schema_bump_invalidates_an_old_manifest(install_root, req_root):
+    im.write_manifest(root = install_root, req_root = req_root, package_name = "pytest")
+    path = im.manifest_path(install_root)
+    data = json.loads(path.read_text(encoding = "utf-8"))
+    data["schema"] = im.MANIFEST_SCHEMA + 1
+    path.write_text(json.dumps(data), encoding = "utf-8")
+    state = im.verify_install(root = install_root, req_root = req_root, package_name = "pytest")
+    assert state["reason"] == "studio_install_manifest_schema"
+
+
+def test_package_upgrade_invalidates_the_manifest(install_root, req_root):
+    im.write_manifest(root = install_root, req_root = req_root, package_name = "pytest")
+    path = im.manifest_path(install_root)
+    data = json.loads(path.read_text(encoding = "utf-8"))
+    data["package_version"] = "0.0.0-not-the-installed-version"
+    path.write_text(json.dumps(data), encoding = "utf-8")
+    state = im.verify_install(root = install_root, req_root = req_root, package_name = "pytest")
+    assert state["reason"] == "studio_install_version_changed"
+
+
+def test_verify_follows_the_package_the_manifest_names(install_root, req_root):
+    # `studio update --package X` records X. Checking unsloth's version instead
+    # would report a change on every probe and repair for ever.
+    im.write_manifest(root = install_root, req_root = req_root, package_name = "pytest")
+    state = im.verify_install(
+        root = install_root,
+        req_root = req_root,
+        package_name = "unsloth-definitely-not-a-real-package",
+    )
+    assert state["manifest_ok"] is True
+
+
+def test_edited_requirements_invalidate_the_manifest(install_root, req_root):
+    # The --local dev path: an edited studio.txt must re-run the dependency
+    # pass, not sit behind setup.sh's "up to date" fast path.
+    im.write_manifest(root = install_root, req_root = req_root, package_name = "pytest")
+    (req_root / "studio.txt").write_text("pytest\nrich\n", encoding = "utf-8")
+    state = im.verify_install(root = install_root, req_root = req_root, package_name = "pytest")
+    assert state["reason"] == "studio_install_requirements_changed"
+
+
+def test_unwritable_root_degrades_to_incomplete(tmp_path, req_root):
+    missing_root = tmp_path / "does" / "not" / "exist"
+    assert im.write_manifest(root = missing_root, req_root = req_root) is None
+    state = im.verify_install(root = missing_root, req_root = req_root, package_name = "pytest")
+    assert state["ok"] is False
diff --git a/tests/studio/install/test_rocm_support.py b/tests/studio/install/test_rocm_support.py
index 4f65857a3e..b003382859 100644
--- a/tests/studio/install/test_rocm_support.py
+++ b/tests/studio/install/test_rocm_support.py
@@ -826,8 +826,10 @@ class TestEnsureRocmTorch:
         self, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try
     ):
         """An explicit gfx wheel-index pin is authoritative: install from it verbatim
-        with torch 2.11, and never re-probe gfx codes to second-guess it (host ROCm 6.4
-        would otherwise pick the rocm6.4 wheel / trigger the Strix re-route)."""
+        with torch 2.11, and the pin must not be second-guessed (host ROCm 6.4 would
+        otherwise pick the rocm6.4 wheel / trigger the Strix re-route). The gfx probe
+        may run for the bnb-skip flag, but returning a Strix arch must not reroute the
+        pinned torch index."""
         mock_probe = MagicMock()
         mock_probe.returncode = 0
         mock_probe.stdout = b"\n"  # cpu torch -> reinstall
@@ -836,10 +838,7 @@ class TestEnsureRocmTorch:
             stack_mod.os.environ.pop("UNSLOTH_TORCH_INDEX_FAMILY", None)
             with patch("os.path.isdir", return_value = True):
                 with patch("subprocess.run", return_value = mock_probe):
-                    # Would raise if the Strix block ran (it is skipped on an explicit pin).
-                    with patch.object(
-                        stack_mod, "_detect_amd_gfx_codes", side_effect = AssertionError
-                    ):
+                    with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx1151"]):
                         _ensure_rocm_torch()
         assert mock_pip.call_count == 1
         torch_call = str(mock_pip.call_args_list[0])
@@ -931,7 +930,8 @@ class TestEnsureRocmTorch:
     def test_gfx_pin_over_installed_pre211_rocm_reinstalls(
         self, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try
     ):
-        """A gfx* pin (2.11 line) over an installed pre-2.11 +rocm6.4 build reinstalls."""
+        """A gfx* pin (2.11 line) over an installed pre-2.11 +rocm6.4 build reinstalls.
+        The gfx probe may run for the bnb-skip flag but must not alter the pinned index."""
         mock_probe = MagicMock()
         mock_probe.returncode = 0
         mock_probe.stdout = b"6.4.12345|2.10.0+rocm6.4\n"
@@ -940,9 +940,7 @@ class TestEnsureRocmTorch:
             stack_mod.os.environ.pop("UNSLOTH_TORCH_INDEX_FAMILY", None)
             with patch("os.path.isdir", return_value = True):
                 with patch("subprocess.run", return_value = mock_probe):
-                    with patch.object(
-                        stack_mod, "_detect_amd_gfx_codes", side_effect = AssertionError
-                    ):
+                    with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx1151"]):
                         _ensure_rocm_torch()
         torch_call = str(mock_pip.call_args_list[0])
         assert "gfx1151" in torch_call
@@ -1027,9 +1025,9 @@ class TestEnsureRocmTorch:
             stack_mod.os.environ.pop("UNSLOTH_TORCH_INDEX_FAMILY", None)
             with patch("os.path.isdir", return_value = True):
                 with patch("subprocess.run", return_value = mock_probe):
-                    with patch.object(
-                        stack_mod, "_detect_amd_gfx_codes", side_effect = AssertionError
-                    ):
+                    # The gfx probe may run for the bnb-skip flag; returning a Strix
+                    # arch must not reroute the pinned torch index.
+                    with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx1151"]):
                         _ensure_rocm_torch()
         torch_call = str(mock_pip.call_args_list[0])
         assert "gfx1151" in torch_call
@@ -1158,6 +1156,336 @@ class TestEnsureRocmTorch:
         mock_pip.assert_not_called()
 
 
+# TEST: gfx906 (MI50 / Radeon VII) legacy reroute -- generic wheels after rocm6.3
+# lack gfx906 code objects, so torch must come from the rocm6.3 index.
+
+
+class TestGfx906LegacyReroute:
+    """gfx906 hosts on ROCm >= 6.4 must be rerouted to the rocm6.3 torch index;
+    hosts already on gfx906-capable wheels are left alone."""
+
+    @staticmethod
+    def _gfx906_reroute_block(source: str) -> str:
+        """The MI50/gfx906 reroute block, bounded on the ';;' that closes its
+        rocm[0-9]* case arm -- robust to comment growth (no magic char offset)."""
+        start = source.find("MI50 / Radeon VII (gfx906")
+        assert start >= 0, "gfx906 reroute block not found in install.sh"
+        end = source.find("\n        ;;", start)
+        assert end >= 0, "end of gfx906 case arm not found"
+        return source[start:end]
+
+    def test_gfx906_needs_legacy_index_floor(self):
+        f = stack_mod._gfx906_needs_legacy_index
+        # rocm6.0-6.3 tags still ship gfx906 kernels: no reroute.
+        assert f((6, 3)) is False
+        assert f((6, 0)) is False
+        assert f((5, 0)) is False  # below any known tag
+        # Anything that picks a tag newer than rocm6.3 must reroute.
+        assert f((6, 4)) is True
+        assert f((7, 2)) is True
+        assert f((7, 14)) is True
+
+    def test_runtime_target_is_gfx906_selection(self, monkeypatch):
+        """Env override wins; else gfx906 only when it is the SOLE distinct arch."""
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        # Sole gfx906 (one or several identical MI50s de-dup to {'gfx906'}).
+        with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx906"]):
+            assert stack_mod._runtime_target_is_gfx906() is True
+        # Mixed host: gfx906 is NOT the sole arch -> not auto-selected (Codex #3:
+        # de-dup loses ordinals, so never downgrade a non-gfx906 selection).
+        with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx906", "gfx1100"]):
+            assert stack_mod._runtime_target_is_gfx906() is False
+        with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = []):
+            assert stack_mod._runtime_target_is_gfx906() is False
+        # Explicit override wins even when probes see nothing (Codex #2).
+        monkeypatch.setenv("UNSLOTH_ROCM_GFX_ARCH", "gfx906")
+        with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = []):
+            assert stack_mod._runtime_target_is_gfx906() is True
+        # ...and a non-gfx906 override is honored on a gfx906-present host.
+        monkeypatch.setenv("UNSLOTH_ROCM_GFX_ARCH", "gfx1100")
+        with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx906"]):
+            assert stack_mod._runtime_target_is_gfx906() is False
+        # A copied HIP gcnArchName (gfx906:sramecc-:xnack-) normalizes to gfx906
+        # (Codex #4: the feature-flag suffix must not defeat the exact comparison).
+        monkeypatch.setenv("UNSLOTH_ROCM_GFX_ARCH", "gfx906:sramecc-:xnack-")
+        with patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = []):
+            assert stack_mod._runtime_target_is_gfx906() is True
+
+    @patch.object(stack_mod, "IS_WINDOWS", False)
+    @patch.object(stack_mod, "pip_install_try", return_value = True)
+    @patch.object(stack_mod, "pip_install")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = False)
+    @patch.object(stack_mod, "_has_rocm_gpu", return_value = True)
+    @patch.object(stack_mod, "_detect_rocm_version", return_value = (7, 2))
+    @patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx906"])
+    def test_gfx906_on_rocm72_routes_to_rocm63(
+        self, mock_gfx, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try, monkeypatch
+    ):
+        """CPU torch on a ROCm 7.2 MI50 host installs from rocm6.3, not rocm7.2."""
+        monkeypatch.delenv("HIP_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("ROCR_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        mock_probe = MagicMock()
+        mock_probe.returncode = 0
+        mock_probe.stdout = b"\n"  # cpu torch -> reinstall
+        with patch("os.path.isdir", return_value = True):
+            with patch("subprocess.run", return_value = mock_probe):
+                _ensure_rocm_torch()
+        torch_call = str(mock_pip.call_args_list[0])
+        assert "rocm6.3" in torch_call
+        assert "rocm7.2" not in torch_call
+        # The _default (<2.11) window: the rocm7.2 2.11 floor cannot be satisfied
+        # on the rocm6.3 index (torch <= 2.9.x there).
+        assert "torch>=2.4,<2.11.0" in torch_call
+        # gfx906 has no prebuilt bnb -- the generic wheel must not be installed.
+        assert not any("bitsandbytes" in str(c).lower() for c in mock_pip_try.call_args_list)
+
+    @patch.object(stack_mod, "IS_WINDOWS", False)
+    @patch.object(stack_mod, "pip_install_try", return_value = True)
+    @patch.object(stack_mod, "pip_install")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = False)
+    @patch.object(stack_mod, "_has_rocm_gpu", return_value = True)
+    @patch.object(stack_mod, "_detect_rocm_version", return_value = (7, 2))
+    @patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx906"])
+    def test_gfx906_repairs_existing_rocm72_torch(
+        self, mock_gfx, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try, monkeypatch
+    ):
+        """An installed +rocm7.2 torch IS the broken combo: reinstall from rocm6.3
+        even though has_hip_torch is True."""
+        monkeypatch.delenv("HIP_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("ROCR_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        mock_probe = MagicMock()
+        mock_probe.returncode = 0
+        mock_probe.stdout = b"7.2.12345|2.11.0+rocm7.2\n"
+        with patch("os.path.isdir", return_value = True):
+            with patch("subprocess.run", return_value = mock_probe):
+                _ensure_rocm_torch()
+        torch_call = str(mock_pip.call_args_list[0])
+        assert "rocm6.3" in torch_call
+        assert "torch>=2.4,<2.11.0" in torch_call
+
+    @patch.object(stack_mod, "IS_WINDOWS", False)
+    @patch.object(stack_mod, "pip_install_try", return_value = True)
+    @patch.object(stack_mod, "pip_install")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = False)
+    @patch.object(stack_mod, "_has_rocm_gpu", return_value = True)
+    @patch.object(stack_mod, "_detect_rocm_version", return_value = (7, 2))
+    @patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx906"])
+    def test_gfx906_already_on_rocm63_left_alone(
+        self, mock_gfx, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try, monkeypatch
+    ):
+        """torch already on rocm6.3 wheels must not be reinstalled (no update loop),
+        and the generic bnb wheel must not clobber a source build."""
+        monkeypatch.delenv("HIP_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("ROCR_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        mock_probe = MagicMock()
+        mock_probe.returncode = 0
+        mock_probe.stdout = b"6.3.42131|2.7.0+rocm6.3\n"
+        with patch("os.path.isdir", return_value = True):
+            with patch("subprocess.run", return_value = mock_probe):
+                _ensure_rocm_torch()
+        mock_pip.assert_not_called()
+        # gfx906: prebuilt bnb is skipped entirely (no torch reinstall, no bnb).
+        mock_pip_try.assert_not_called()
+
+    @patch.object(stack_mod, "IS_WINDOWS", False)
+    @patch.object(stack_mod, "pip_install_try", return_value = True)
+    @patch.object(stack_mod, "pip_install")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = False)
+    @patch.object(stack_mod, "_has_rocm_gpu", return_value = True)
+    @patch.object(stack_mod, "_detect_rocm_version", return_value = (7, 2))
+    @patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx1100", "gfx906"])
+    def test_mixed_host_gfx906_not_sole_arch_skips_reroute(
+        self, mock_gfx, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try, monkeypatch
+    ):
+        """Mixed host (gfx906 + dGPU) with no explicit override: gfx906 is not the
+        sole arch, so the generic index is kept (Codex #3: never downgrade a
+        de-dup-ambiguous mixed host)."""
+        monkeypatch.delenv("HIP_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("ROCR_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        mock_probe = MagicMock()
+        mock_probe.returncode = 0
+        mock_probe.stdout = b"\n"  # cpu torch -> reinstall
+        with patch("os.path.isdir", return_value = True):
+            with patch("subprocess.run", return_value = mock_probe):
+                _ensure_rocm_torch()
+        torch_call = str(mock_pip.call_args_list[0])
+        assert "rocm7.2" in torch_call
+        assert "rocm6.3" not in torch_call
+
+    @patch.object(stack_mod, "IS_WINDOWS", False)
+    @patch.object(stack_mod, "pip_install_try", return_value = True)
+    @patch.object(stack_mod, "pip_install")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = False)
+    @patch.object(stack_mod, "_has_rocm_gpu", return_value = True)
+    @patch.object(stack_mod, "_detect_rocm_version", return_value = (7, 2))
+    @patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = [])
+    def test_gfx906_env_override_forces_reroute(
+        self, mock_gfx, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try, monkeypatch
+    ):
+        """UNSLOTH_ROCM_GFX_ARCH=gfx906 reroutes even when probes emit no gfx token
+        (Codex #2: runtime-only ROCm hosts where rocminfo/amd-smi are absent)."""
+        monkeypatch.delenv("HIP_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("ROCR_VISIBLE_DEVICES", raising = False)
+        monkeypatch.setenv("UNSLOTH_ROCM_GFX_ARCH", "gfx906")
+        mock_probe = MagicMock()
+        mock_probe.returncode = 0
+        mock_probe.stdout = b"\n"  # cpu torch -> reinstall
+        with patch("os.path.isdir", return_value = True):
+            with patch("subprocess.run", return_value = mock_probe):
+                _ensure_rocm_torch()
+        torch_call = str(mock_pip.call_args_list[0])
+        assert "rocm6.3" in torch_call
+        assert "rocm7.2" not in torch_call
+
+    @patch.object(stack_mod, "IS_WINDOWS", False)
+    @patch.object(stack_mod, "pip_install_try", return_value = True)
+    @patch.object(stack_mod, "pip_install")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = False)
+    @patch.object(stack_mod, "_has_rocm_gpu", return_value = True)
+    @patch.object(stack_mod, "_detect_rocm_version", return_value = (7, 2))
+    @patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx906"])
+    def test_gfx906_bnb_skipped_even_when_index_pinned(
+        self, mock_gfx, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try, monkeypatch
+    ):
+        """A gfx906 user who pins the ROCm index AND sets the arch override still
+        skips the generic bnb wheel: the pin suppresses the torch reroute, not the
+        gfx906 runtime flag used for the bnb skip."""
+        monkeypatch.delenv("HIP_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("ROCR_VISIBLE_DEVICES", raising = False)
+        monkeypatch.setenv("UNSLOTH_ROCM_GFX_ARCH", "gfx906")
+        monkeypatch.setenv("UNSLOTH_TORCH_INDEX_URL", "https://download.pytorch.org/whl/rocm6.3")
+        mock_probe = MagicMock()
+        mock_probe.returncode = 0
+        mock_probe.stdout = b"\n"  # cpu torch -> reinstall from the pinned index
+        with patch("os.path.isdir", return_value = True):
+            with patch("subprocess.run", return_value = mock_probe):
+                _ensure_rocm_torch()
+        # torch is (re)installed from the pinned rocm6.3 index...
+        assert any("rocm6.3" in str(c) for c in mock_pip.call_args_list)
+        # ...but the prebuilt bnb wheel is never installed.
+        assert not any("bitsandbytes" in str(c).lower() for c in mock_pip_try.call_args_list)
+
+    @patch.object(stack_mod, "IS_WINDOWS", False)
+    @patch.object(stack_mod, "pip_install_try", return_value = True)
+    @patch.object(stack_mod, "pip_install")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = False)
+    @patch.object(stack_mod, "_has_rocm_gpu", return_value = True)
+    @patch.object(stack_mod, "_detect_rocm_version", return_value = (7, 2))
+    @patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx1151", "gfx906"])
+    def test_gfx906_override_wins_over_strix_probe(
+        self, mock_gfx, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try, monkeypatch
+    ):
+        """Mixed Strix + MI50 host: UNSLOTH_ROCM_GFX_ARCH=gfx906 suppresses the Strix
+        override (which probe order would otherwise pick) and routes to rocm6.3."""
+        monkeypatch.delenv("HIP_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("ROCR_VISIBLE_DEVICES", raising = False)
+        monkeypatch.setenv("UNSLOTH_ROCM_GFX_ARCH", "gfx906")
+        mock_probe = MagicMock()
+        mock_probe.returncode = 0
+        mock_probe.stdout = b"\n"  # cpu torch -> reinstall
+        with patch("os.path.isdir", return_value = True):
+            with patch("subprocess.run", return_value = mock_probe):
+                _ensure_rocm_torch()
+        torch_call = str(mock_pip.call_args_list[0])
+        assert "rocm6.3" in torch_call
+        assert "gfx1151" not in torch_call
+        # gfx906 target -> generic bnb wheel skipped.
+        assert not any("bitsandbytes" in str(c).lower() for c in mock_pip_try.call_args_list)
+
+    @patch.object(stack_mod, "IS_WINDOWS", False)
+    @patch.object(stack_mod, "pip_install_try", return_value = True)
+    @patch.object(stack_mod, "pip_install")
+    @patch.object(stack_mod, "_has_usable_nvidia_gpu", return_value = False)
+    @patch.object(stack_mod, "_has_rocm_gpu", return_value = True)
+    @patch.object(stack_mod, "_detect_rocm_version", return_value = (7, 2))
+    @patch.object(stack_mod, "_detect_amd_gfx_codes", return_value = ["gfx906"])
+    def test_gfx906_bnb_skipped_on_pinned_index_without_env_override(
+        self, mock_gfx, mock_ver, mock_gpu, mock_nvidia, mock_pip, mock_pip_try, monkeypatch
+    ):
+        """Codex #2: a real gfx906 host that pins the ROCm index but does NOT set
+        UNSLOTH_ROCM_GFX_ARCH must still skip the prebuilt bnb wheel -- the pin
+        suppresses only the torch reroute, not the probe-driven gfx906 detection
+        used for the bnb skip (otherwise `studio update` clobbers source-built bnb)."""
+        monkeypatch.delenv("HIP_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("ROCR_VISIBLE_DEVICES", raising = False)
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        monkeypatch.setenv("UNSLOTH_TORCH_INDEX_URL", "https://download.pytorch.org/whl/rocm6.3")
+        mock_probe = MagicMock()
+        mock_probe.returncode = 0
+        mock_probe.stdout = b"\n"  # cpu torch -> reinstall from the pinned index
+        with patch("os.path.isdir", return_value = True):
+            with patch("subprocess.run", return_value = mock_probe):
+                _ensure_rocm_torch()
+        # torch is (re)installed from the pinned rocm6.3 index...
+        assert any("rocm6.3" in str(c) for c in mock_pip.call_args_list)
+        # ...but the prebuilt bnb wheel is never installed (probe saw sole gfx906).
+        assert not any("bitsandbytes" in str(c).lower() for c in mock_pip_try.call_args_list)
+
+    def test_install_sh_gfx906_env_suppresses_strix(self):
+        """install.sh must skip the Strix reroute when UNSLOTH_ROCM_GFX_ARCH=gfx906."""
+        source = (PACKAGE_ROOT / "install.sh").read_text(encoding = "utf-8")
+        assert 'if [ "$_gfx906_env" != "gfx906" ]; then' in source
+
+    def test_install_sh_gfx906_normalizes_override_and_clears_radeon(self):
+        """install.sh must (Codex #4) strip a gfx906:… feature suffix before the exact
+        comparison, and (Codex #3) clear the Radeon marketing flag for every gfx906
+        target -- not only when the >=6.4 reroute fires -- so a Radeon VII already on
+        rocm6.3 does not divert to the repo.radeon.com branch."""
+        source = (PACKAGE_ROOT / "install.sh").read_text(encoding = "utf-8")
+        # Override normalization (both the reroute block and the bnb-skip helper):
+        # strip the gfx906:… feature suffix and trim whitespace (mirror py .strip()).
+        assert "_gfx906_env=${_gfx906_env%%:*}" in source
+        assert "_bnb_gfx_env=${_bnb_gfx_env%%:*}" in source
+        assert source.count("tr -d '[:space:]'") >= 2
+        # Radeon flag cleared as soon as gfx906 is the target, before the leaf gate.
+        block = self._gfx906_reroute_block(source)
+        clear_pos = block.find("_amd_gpu_radeon=false")
+        leaf_gate_pos = block.find("_rocm_leaf_below")
+        assert clear_pos >= 0 and leaf_gate_pos >= 0
+        # the unconditional clear must precede the >=6.4 leaf-gated reroute.
+        assert clear_pos < leaf_gate_pos
+
+    def test_install_sh_bnb_skip_probes_under_pin(self):
+        """install.sh _is_gfx906_bnb_skip must probe gfx906 when the index is pinned
+        (Codex #1): a pin skips the reroute block that sets _gfx906_target, so the
+        helper falls back to _probe_amd_gfx_arch to catch a real gfx906 host."""
+        source = (PACKAGE_ROOT / "install.sh").read_text(encoding = "utf-8")
+        start = source.find("_is_gfx906_bnb_skip() {")
+        assert start >= 0
+        body = source[start : start + 900]
+        assert "_torch_index_pinned" in body
+        assert "_probe_amd_gfx_arch" in body
+
+    def test_install_sh_has_gfx906_reroute(self):
+        """install.sh must mirror the Python reroute: honor UNSLOTH_ROCM_GFX_ARCH,
+        gate on a gfx906 target, route to rocm6.3, with the same _default (<2.11)
+        trio, and skip the prebuilt bnb wheel."""
+        source = (PACKAGE_ROOT / "install.sh").read_text(encoding = "utf-8")
+        block = self._gfx906_reroute_block(source)
+        assert "_gfx906_target=" in block
+        assert "UNSLOTH_ROCM_GFX_ARCH" in block
+        assert "/rocm6.3" in block
+        for spec in stack_mod._ROCM_TORCH_PKG_SPECS["_default"]:
+            assert spec in block
+        # The bnb skip helper must exist and be wired at the install sites.
+        assert "_is_gfx906_bnb_skip" in source
+
+    def test_device_type_defaults_compile_off_on_gfx906(self):
+        """unsloth/device_type.py must default Dynamo/compile off on gfx906
+        (user-overridable via setdefault)."""
+        source = (PACKAGE_ROOT / "unsloth" / "device_type.py").read_text(encoding = "utf-8")
+        gate_start = source.find("gfx906")
+        assert gate_start >= 0
+        gate_body = source[gate_start : gate_start + 800]
+        assert 'setdefault("TORCHDYNAMO_DISABLE", "1")' in gate_body
+        assert 'setdefault("TORCH_COMPILE_DISABLE", "1")' in gate_body
+        assert 'setdefault("UNSLOTH_COMPILE_DISABLE", "1")' in gate_body
+
+
 # TEST: install_python_stack.py -- torch-index MARKER mechanism (PR #6692)
 
 
@@ -4495,11 +4823,93 @@ class TestApplyHostOverrides:
         assert out.has_rocm is True
         assert out.rocm_gfx_target == "gfx1200"
 
-    def test_forwarded_gfx_is_authoritative(self):
-        # setup already applied visible-device selection; its value wins.
-        host = rocm_host(rocm_gfx_target = "gfx1100")
+    def test_forwarded_gfx_does_not_clobber_probed_arch(self, monkeypatch):
+        # setup.ps1's pick is not fully visible-device aware (ignores CUDA_VISIBLE_DEVICES,
+        # amd-smi branch drops comma masks), so when it resolved the host's OTHER physical
+        # GPU it must not replace the arch detect_host() picked for the visible one.
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        host = rocm_host(rocm_gfx_target = "gfx1010", rocm_gfx_targets = ["gfx1100", "gfx1010"])
+        out = _apply_host_overrides(host, override_rocm_gfx = "gfx1100")
+        assert out.rocm_gfx_target == "gfx1010"
+        assert out.rocm_gfx_targets == ["gfx1100", "gfx1010"]
+        assert out.has_rocm is True
+
+    def test_forwarded_gfx_absent_from_host_stays_authoritative(self, monkeypatch):
+        # An arch no probe here ever reported is not a setup mispick: it is an explicit
+        # --rocm-gfx for a host whose probe is wrong or stale, so it must still win.
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        host = rocm_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
         out = _apply_host_overrides(host, override_rocm_gfx = "gfx1151")
         assert out.rocm_gfx_target == "gfx1151"
+        # ... but it says which arch HIP targets, not which cards exist, so the probed
+        # gfx1100 is still in the box and stays in the per-GPU list.
+        assert out.rocm_gfx_targets == ["gfx1100", "gfx1151"]
+        assert out.has_rocm is True
+
+    def test_forwarded_family_label_never_overrides_a_probed_arch(self, monkeypatch):
+        # The update path re-derives --rocm-gfx from the marker's family-named asset, so a
+        # family label is a bundle name, not a real arch, and must stay advisory: gfx1033 is
+        # in-generation but unbuilt, so gfx103X winning would serve a bundle it cannot run.
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        host = rocm_host(rocm_gfx_target = "gfx1033", rocm_gfx_targets = ["gfx1033"])
+        out = _apply_host_overrides(host, override_rocm_gfx = "gfx103X")
+        assert out.rocm_gfx_target == "gfx1033"
+        assert out.has_rocm is True
+
+    def test_forwarded_family_label_still_fills_an_unprobed_arch(self, monkeypatch):
+        # Negative control: with no probed arch the forward is the only source, so it
+        # applies.
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        out = _apply_host_overrides(cpu_host(), override_rocm_gfx = "gfx110X")
+        assert out.rocm_gfx_target == "gfx110x"
+        assert out.has_rocm is True
+
+    def test_forwarded_gfx_matching_active_keeps_physical_gfx_list(self, monkeypatch):
+        # When the forward agrees with the probe the per-GPU list must survive: collapsing
+        # it would hide the host's other AMD cards from the Windows auto-Vulkan floor
+        # check.
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        host = rocm_host(rocm_gfx_target = "gfx1010", rocm_gfx_targets = ["gfx1100", "gfx1010"])
+        out = _apply_host_overrides(host, override_rocm_gfx = "gfx1010")
+        assert out.rocm_gfx_target == "gfx1010"
+        assert out.rocm_gfx_targets == ["gfx1100", "gfx1010"]
+
+    def test_forwarded_gfx_never_drops_a_probed_physical_gpu(self, monkeypatch):
+        # The per-GPU list is the PHYSICAL inventory the Windows auto-Vulkan floor check
+        # reads, so a forwarded arch the probe never saw must be ADDED, not replace it:
+        # dropping the probe-confirmed gfx1100 would tell that check no AMD GPU on the box
+        # reaches the HIP floor when one plainly does.
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        host = rocm_host(rocm_gfx_target = "gfx803", rocm_gfx_targets = ["gfx1100", "gfx803"])
+        out = _apply_host_overrides(host, override_rocm_gfx = "gfx900")
+        assert out.rocm_gfx_target == "gfx900"
+        assert out.rocm_gfx_targets == ["gfx1100", "gfx803", "gfx900"]
+
+    def test_forwarded_gfx_not_duplicated_when_already_probed(self, monkeypatch):
+        # UNSLOTH_ROCM_GFX_ARCH makes the forward win over the probe's visible-device
+        # pick, so this reaches the same branch; the list must stay deduplicated.
+        monkeypatch.setenv("UNSLOTH_ROCM_GFX_ARCH", "gfx803")
+        host = rocm_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100", "gfx803"])
+        out = _apply_host_overrides(host, override_rocm_gfx = "gfx803")
+        assert out.rocm_gfx_target == "gfx803"
+        assert out.rocm_gfx_targets == ["gfx1100", "gfx803"]
+
+    def test_forwarded_gfx_on_an_unprobed_host_lists_only_itself(self, monkeypatch):
+        # Negative control for the two above: nothing probed means no inventory to
+        # preserve, so the driver-only host keeps a single-entry list and auto-Vulkan.
+        monkeypatch.delenv("UNSLOTH_ROCM_GFX_ARCH", raising = False)
+        out = _apply_host_overrides(cpu_host(), override_rocm_gfx = "gfx803")
+        assert out.rocm_gfx_target == "gfx803"
+        assert out.rocm_gfx_targets == ["gfx803"]
+
+    def test_manual_env_override_still_wins_over_probe(self, monkeypatch):
+        # UNSLOTH_ROCM_GFX_ARCH is the manual escape hatch for hosts whose arch the probes
+        # get wrong, so it stays authoritative.
+        monkeypatch.setenv("UNSLOTH_ROCM_GFX_ARCH", "gfx1151")
+        host = rocm_host(rocm_gfx_target = "gfx1100", rocm_gfx_targets = ["gfx1100"])
+        out = _apply_host_overrides(host, override_rocm_gfx = "gfx1151")
+        assert out.rocm_gfx_target == "gfx1151"
+        assert out.rocm_gfx_targets == ["gfx1100", "gfx1151"]
 
     def test_has_rocm_only_keeps_probe_gfx(self):
         out = _apply_host_overrides(cpu_host(), override_has_rocm = True)
diff --git a/tests/studio/install/test_setup_fast_path_guard.py b/tests/studio/install/test_setup_fast_path_guard.py
new file mode 100644
index 0000000000..da6f9aa7d8
--- /dev/null
+++ b/tests/studio/install/test_setup_fast_path_guard.py
@@ -0,0 +1,99 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""setup.sh / setup.ps1 must not skip the dependency pass on a half-built venv.
+
+Both short-circuit all dependency work when the installed unsloth version equals
+PyPI's latest, which is true on an interrupted install: unsloth goes in early and
+studio.txt never finishes. So update, and the desktop Repair button behind it,
+said "up to date" while the server kept dying on `import structlog`.
+
+That branch only runs for a non-local update, which reinstalls from PyPI and
+clobbers the tree under test, so assert the guard structurally instead.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import re
+
+import pytest
+
+REPO_ROOT = pathlib.Path(__file__).resolve().parents[3]
+SETUP_SH = REPO_ROOT / "studio" / "setup.sh"
+SETUP_PS1 = REPO_ROOT / "studio" / "setup.ps1"
+
+
+@pytest.mark.parametrize("script", [SETUP_SH, SETUP_PS1], ids = ["setup.sh", "setup.ps1"])
+def test_fast_path_consults_the_install_manifest(script: pathlib.Path):
+    text = script.read_text(encoding = "utf-8")
+    assert "install_manifest" in text, (
+        f"{script.name} no longer consults studio/install_manifest.py. Without it "
+        "the 'up to date' fast path skips the dependency pass on an interrupted "
+        "install, and `unsloth studio update` becomes a silent no-op."
+    )
+    assert "verify_install" in text, (
+        f"{script.name} must call install_manifest.verify_install() so the check "
+        "matches what `unsloth studio verify-install` and the desktop preflight use."
+    )
+
+
+@pytest.mark.parametrize("script", [SETUP_SH, SETUP_PS1], ids = ["setup.sh", "setup.ps1"])
+def test_guard_can_still_force_the_dependency_pass(script: pathlib.Path):
+    """The guard has to clear the skip flag, not merely log a warning."""
+    text = script.read_text(encoding = "utf-8")
+    if script.name.endswith(".ps1"):
+        pattern = r"studio install incomplete[\s\S]{0,200}?\$SkipPythonDeps\s*=\s*\$false"
+    else:
+        pattern = r"studio install incomplete[\s\S]{0,200}?_SKIP_PYTHON_DEPS=false"
+    assert re.search(pattern, text), (
+        f"{script.name} detects an incomplete install but does not clear the "
+        "skip flag, so the dependency pass would still be skipped."
+    )
+
+
+def test_ps1_drops_the_manifest_before_its_first_install():
+    """Nothing may mutate the venv while the marker still says "install finished".
+
+    install_python_stack.py drops it before its own dependency pass, which is
+    enough for setup.sh: the stack is the first thing that pass runs. setup.ps1
+    replaces pip, torch and triton first, so a run killed there would leave a
+    manifest that still verifies and a venv with half a PyTorch.
+    """
+    text = SETUP_PS1.read_text(encoding = "utf-8")
+    pass_start = text.index("if (-not $SkipPythonDeps) {")
+    removal = text.find("remove_manifest", pass_start)
+    first_install = text.index("Fast-Install", pass_start)
+    stack = text.index(r'python "$PSScriptRoot\install_python_stack.py"', pass_start)
+
+    assert removal != -1, (
+        "setup.ps1 never drops the install manifest; install_python_stack.py "
+        "only does so after setup.ps1 has already replaced pip and torch"
+    )
+    assert removal < first_install < stack, (
+        "setup.ps1 must invalidate the install manifest before its first "
+        "Fast-Install, not leave it to install_python_stack.py"
+    )
+
+
+def test_sh_dependency_pass_mutates_nothing_before_the_stack():
+    """setup.sh relies on install_python_stack.py dropping the marker, which only
+    holds while the stack is the first thing its dependency pass runs."""
+    text = SETUP_SH.read_text(encoding = "utf-8")
+    pass_start = text.index('if [ "$_SKIP_PYTHON_DEPS" = false ]')
+    body = text[pass_start : text.index("install_python_stack", pass_start)]
+    assert "fast_install" not in body and "pip install" not in body, (
+        "setup.sh installs something before install_python_stack.py drops the "
+        "manifest, so an interrupted run would keep a marker that verifies"
+    )
+
+
+def test_sh_guard_runs_before_the_skip_decision():
+    text = SETUP_SH.read_text(encoding = "utf-8")
+    guard = text.find("studio install incomplete")
+    decision = text.find('if [ "$_SKIP_PYTHON_DEPS" = false ]')
+    assert guard != -1 and decision != -1
+    assert guard < decision, (
+        "the incomplete-install guard must run before setup.sh acts on "
+        "_SKIP_PYTHON_DEPS, otherwise it can never change the outcome"
+    )
diff --git a/tests/studio/install/test_studio_deps_cli.py b/tests/studio/install/test_studio_deps_cli.py
new file mode 100644
index 0000000000..85d1212b61
--- /dev/null
+++ b/tests/studio/install/test_studio_deps_cli.py
@@ -0,0 +1,273 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Coverage for unsloth_cli/_studio_deps.py.
+
+Two things have to be right for the CLI half of the install check.
+
+It must describe the venv it was *asked* about. The wheel ships studio/, so a
+CLI installed outside the managed venv always finds its own copy of the manifest
+helper, and would otherwise report on its own prefix: a healthy managed install
+comes back "incomplete", a broken one comes back with the wrong missing list.
+
+And it must name the *distribution* to install rather than the import that
+failed. `pip install jwt` / `docx` / `fitz` all succeed and install unrelated
+PyPI projects, leaving the backend just as broken as before.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import io
+import json
+import contextlib
+import pathlib
+import shutil
+import sys
+
+import pytest
+import typer
+
+REPO_ROOT = pathlib.Path(__file__).resolve().parents[3]
+DEPS_PATH = REPO_ROOT / "unsloth_cli" / "_studio_deps.py"
+MANIFEST_PATH = REPO_ROOT / "studio" / "install_manifest.py"
+REQUIREMENTS = REPO_ROOT / "studio" / "backend" / "requirements"
+
+
+def _load(path: pathlib.Path, name: str):
+    spec = importlib.util.spec_from_file_location(name, path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+_MANIFEST = _load(MANIFEST_PATH, "install_manifest_for_deps_test")
+
+
+def _studio_distributions() -> list:
+    lines = (REQUIREMENTS / "studio.txt").read_text(encoding = "utf-8").splitlines()
+    parsed = [_MANIFEST._parse_requirement_line(line) for line in lines]
+    return [name for name, _, _ in (p for p in parsed if p is not None)]
+
+
+def _studio_distribution_versions() -> dict:
+    versions = {}
+    lines = (REQUIREMENTS / "studio.txt").read_text(encoding = "utf-8").splitlines()
+    for parsed in (_MANIFEST._parse_requirement_line(line) for line in lines):
+        if parsed is None:
+            continue
+        name, _marker, specifier = parsed
+        version = "1.0.0"
+        for part in specifier.split(","):
+            if part.startswith("=="):
+                version = part[2:]
+                break
+            if part.startswith(">="):
+                version = part[2:]
+        versions[name] = version
+    return versions
+
+
+def _make_venv(
+    root: pathlib.Path,
+    *,
+    unsloth_version: str,
+    distributions,
+    extra_requirement = "",
+):
+    """A venv tree: pyvenv.cfg, the shipped studio/ package and .dist-info dirs."""
+    site_packages = root / "lib" / "python3.11" / "site-packages"
+    (site_packages / "studio" / "backend").mkdir(parents = True)
+    shutil.copy(MANIFEST_PATH, site_packages / "studio" / "install_manifest.py")
+    shutil.copytree(REQUIREMENTS, site_packages / "studio" / "backend" / "requirements")
+    if extra_requirement:
+        studio_txt = site_packages / "studio" / "backend" / "requirements" / "studio.txt"
+        studio_txt.write_text(
+            studio_txt.read_text(encoding = "utf-8") + extra_requirement, encoding = "utf-8"
+        )
+    (root / "pyvenv.cfg").write_text("home = /usr/bin\n", encoding = "utf-8")
+    studio_versions = _studio_distribution_versions()
+    for name in [*distributions, "unsloth"]:
+        version = unsloth_version if name == "unsloth" else studio_versions.get(name, "1.0.0")
+        dist_info = site_packages / f"{name.replace('-', '_')}-{version}.dist-info"
+        dist_info.mkdir()
+        (dist_info / "METADATA").write_text(
+            f"Metadata-Version: 2.1\nName: {name}\nVersion: {version}\n",
+            encoding = "utf-8",
+        )
+    return site_packages
+
+
+def _write_manifest(root: pathlib.Path, site_packages: pathlib.Path, version: str):
+    (root / _MANIFEST.MANIFEST_NAME).write_text(
+        json.dumps(
+            {
+                "schema": _MANIFEST.MANIFEST_SCHEMA,
+                "package": "unsloth",
+                "package_version": version,
+                "requirement_files": _MANIFEST.requirement_digests(
+                    site_packages / "studio" / "backend" / "requirements",
+                ),
+            }
+        ),
+        encoding = "utf-8",
+    )
+
+
+@pytest.fixture
+def cross_venv(tmp_path, monkeypatch):
+    """`unsloth studio verify-install` run from a CLI outside the managed venv.
+
+    Returns a callable: build the managed venv, then ask about it.
+    """
+
+    def build(
+        *,
+        managed_version = "2026.6.1",
+        caller_version = "2026.7.9",
+        managed_distributions = None,
+        extra_requirement = "",
+        with_manifest = True,
+    ):
+        caller = tmp_path / "caller_venv"
+        caller_site = _make_venv(caller, unsloth_version = caller_version, distributions = [])
+        managed = tmp_path / "studio_home" / "unsloth_studio"
+        managed_site = _make_venv(
+            managed,
+            unsloth_version = managed_version,
+            distributions = _studio_distributions()
+            if managed_distributions is None
+            else managed_distributions,
+            extra_requirement = extra_requirement,
+        )
+        if with_manifest:
+            _write_manifest(managed, managed_site, managed_version)
+
+        (caller_site / "unsloth_cli").mkdir(parents = True)
+        shutil.copy(DEPS_PATH, caller_site / "unsloth_cli" / "_studio_deps.py")
+        monkeypatch.setattr(sys, "prefix", str(caller))
+        deps = _load(caller_site / "unsloth_cli" / "_studio_deps.py", "studio_deps_cross_venv")
+        return deps.install_state(extra_roots = (managed,))
+
+    return build
+
+
+def test_a_healthy_managed_venv_is_not_reported_incomplete(cross_venv):
+    """The caller's own prefix has no manifest and none of studio.txt, so
+    describing it instead sends a working install through a needless repair."""
+    state = cross_venv()
+    assert state["ok"] is True, state
+    assert state["reason"] is None
+    assert state["missing"] == []
+
+
+def test_a_newer_caller_does_not_look_like_a_changed_managed_version(cross_venv):
+    """The version and requirement digests must come from the managed venv too:
+    reading them here compares two unrelated installs."""
+    state = cross_venv(managed_version = "2026.1.1", caller_version = "2026.12.31")
+    assert state["ok"] is True, state
+
+
+def test_a_managed_venv_missing_a_boot_dep_names_that_dep(cross_venv):
+    """The other direction: report what is actually absent over there."""
+    state = cross_venv(
+        managed_distributions = [d for d in _studio_distributions() if d != "fastmcp"],
+    )
+    assert state["ok"] is False
+    assert state["reason"] == "studio_deps_missing"
+    assert state["missing"] == ["fastmcp"], state
+
+
+def test_an_unfinished_managed_install_is_still_reported_incomplete(cross_venv):
+    state = cross_venv(with_manifest = False)
+    assert state["ok"] is False
+    assert state["reason"] == "studio_install_incomplete"
+
+
+# ── import name vs distribution name ─────────────────────────────────
+
+
+@pytest.fixture
+def deps():
+    return _load(DEPS_PATH, "studio_deps_under_test")
+
+
+def _remediation(deps, trigger: str, studio_missing) -> str:
+    deps._missing_studio_packages = lambda: list(studio_missing)
+    stderr = io.StringIO()
+    with contextlib.redirect_stderr(stderr), pytest.raises(typer.Exit):
+        with deps.studio_backend_imports("unsloth studio"):
+            raise ModuleNotFoundError(f"No module named '{trigger}'", name = trigger)
+    return stderr.getvalue()
+
+
+@pytest.mark.parametrize(
+    "trigger, distribution",
+    [("jwt", "pyjwt"), ("docx", "python-docx"), ("fitz", "pymupdf")],
+)
+def test_a_missing_studio_package_is_named_by_its_distribution(deps, trigger, distribution):
+    """`pip install jwt` installs a different JWT library and repairs nothing."""
+    output = _remediation(deps, trigger, [distribution])
+    assert f"pip install {trigger}" not in output, output
+    assert distribution in output
+    assert "unsloth studio update" in output
+
+
+def test_a_normalised_name_still_counts_as_a_studio_dependency(deps):
+    """studio.txt writes huggingface-hub; the import is huggingface_hub."""
+    output = _remediation(deps, "huggingface_hub", ["huggingface-hub"])
+    assert "Install it:" not in output, output
+    assert "also missing:" not in output, output
+
+
+def test_a_missing_submodule_is_traced_to_its_installable_package(deps):
+    """exc.name is dotted when the top level survived a partial install, and
+    `pip install fastmcp.server` is not a package name at all."""
+    output = _remediation(deps, "fastmcp.server", ["fastmcp"])
+    assert "fastmcp.server" not in output.split("Install it:")[-1], output
+    assert "Install it:" not in output, output
+    assert "unsloth studio update" in output
+
+
+def test_a_non_studio_dependency_keeps_its_own_install_line(deps):
+    """train reaches torch through the same wrapped import and the studio extra
+    does not carry it."""
+    output = _remediation(deps, "torch", ["pyjwt"])
+    assert "pip install torch" in output
+    assert "also missing: pyjwt" in output
+
+
+def test_studio_only_guard_preserves_non_studio_failures(deps):
+    deps._missing_studio_packages = lambda: ["pyjwt"]
+    with pytest.raises(ModuleNotFoundError):
+        with deps.studio_backend_imports("unsloth inference", studio_only = True):
+            raise ModuleNotFoundError("No module named 'mlx'", name = "mlx")
+
+
+def test_the_import_map_only_names_studio_distributions():
+    """Drift guard: an entry pointing at a dropped requirement is dead advice."""
+    known = {deps_name.lower() for deps_name in _studio_distributions()}
+    module = _load(DEPS_PATH, "studio_deps_map_check")
+    for import_name, distribution in module._IMPORT_TO_DISTRIBUTION.items():
+        assert distribution.lower() in known, (
+            f"_IMPORT_TO_DISTRIBUTION maps {import_name} to {distribution}, "
+            "which studio.txt no longer requires"
+        )
+
+
+def test_a_torn_tree_without_the_manifest_helper_is_incomplete(tmp_path, monkeypatch):
+    """studio/install_manifest.py ships in the same wheel as _studio_deps.py, so
+    only a torn install has one without the other. Answering yes here launches a
+    backend whose own files may be just as absent."""
+    caller = tmp_path / "caller_venv"
+    site_packages = caller / "lib" / "python3.11" / "site-packages"
+    (site_packages / "unsloth_cli").mkdir(parents = True)
+    shutil.copy(DEPS_PATH, site_packages / "unsloth_cli" / "_studio_deps.py")
+    (caller / "pyvenv.cfg").write_text("home = /usr/bin\n", encoding = "utf-8")
+    monkeypatch.setattr(sys, "prefix", str(caller))
+
+    deps = _load(site_packages / "unsloth_cli" / "_studio_deps.py", "studio_deps_torn_tree")
+    state = deps.install_state()
+
+    assert state["ok"] is False, state
+    assert state["reason"] == "studio_install_manifest_missing"
diff --git a/tests/studio/install/test_studio_extra_matches_requirements.py b/tests/studio/install/test_studio_extra_matches_requirements.py
new file mode 100644
index 0000000000..83988ce64e
--- /dev/null
+++ b/tests/studio/install/test_studio_extra_matches_requirements.py
@@ -0,0 +1,85 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""The studio extra must mirror studio/backend/requirements/studio.txt.
+
+Nothing else keeps them in sync, and drift reintroduces #4701 / #5260 / #7147.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import sys
+
+import pytest
+
+REPO_ROOT = pathlib.Path(__file__).resolve().parents[3]
+PYPROJECT = REPO_ROOT / "pyproject.toml"
+STUDIO_TXT = REPO_ROOT / "studio" / "backend" / "requirements" / "studio.txt"
+
+# Imported at module scope by the chain every CLI command walks: structlog via
+# studio.backend, click via unsloth_cli/commands/start.py.
+CORE_RUNTIME_PACKAGES = ("structlog", "click")
+
+
+def _load_pyproject() -> dict:
+    if sys.version_info >= (3, 11):
+        import tomllib
+    else:
+        tomllib = pytest.importorskip("tomli")
+    return tomllib.loads(PYPROJECT.read_text(encoding = "utf-8"))
+
+
+def _requirement_lines(path: pathlib.Path) -> list[str]:
+    out = []
+    for line in path.read_text(encoding = "utf-8").splitlines():
+        text = line.split("#", 1)[0].strip()
+        if text and not text.startswith("-"):
+            out.append(text)
+    return out
+
+
+def _normalise(name: str) -> str:
+    """PEP 503 normalisation, so PyJWT/pyjwt and nest_asyncio/nest-asyncio match."""
+    head = name
+    for sep in ("===", "==", ">=", "<=", "~=", "!=", ">", "<", "[", ";", " "):
+        idx = head.find(sep)
+        if idx > 0:
+            head = head[:idx]
+    return head.strip().lower().replace("_", "-").replace(".", "-")
+
+
+def test_studio_extra_exists():
+    extras = _load_pyproject()["project"]["optional-dependencies"]
+    assert "studio" in extras, (
+        "pyproject.toml has no `studio` extra. The wheel ships studio/ and "
+        "studio.backend*, so their dependencies need a pip-installable home."
+    )
+
+
+def test_studio_extra_matches_requirements_file():
+    extras = _load_pyproject()["project"]["optional-dependencies"]
+    extra = sorted(_normalise(entry) for entry in extras["studio"])
+    required = sorted(_normalise(entry) for entry in _requirement_lines(STUDIO_TXT))
+
+    missing = sorted(set(required) - set(extra))
+    surplus = sorted(set(extra) - set(required))
+    assert not missing, (
+        f"studio.txt lists {missing} but the `studio` extra does not. "
+        '`pip install "unsloth[studio]"` would build a venv the Studio server '
+        "cannot boot in. Add them to [project.optional-dependencies] studio."
+    )
+    assert not surplus, (
+        f"The `studio` extra lists {surplus} but studio.txt does not. "
+        "Remove them, or add them to studio.txt if install.sh needs them too."
+    )
+
+
+@pytest.mark.parametrize("package", CORE_RUNTIME_PACKAGES)
+def test_cli_runtime_packages_are_core_dependencies(package):
+    core = [_normalise(entry) for entry in _load_pyproject()["project"]["dependencies"]]
+    assert _normalise(package) in core, (
+        f"{package} is imported at module scope by the studio.backend chain "
+        f"`unsloth train` / `unsloth export` walk, so a plain `pip install "
+        f"unsloth` must provide it or they die with ModuleNotFoundError."
+    )
diff --git a/tests/studio/test_cancel_atomicity.py b/tests/studio/test_cancel_atomicity.py
index 391ef043d7..23f340f762 100644
--- a/tests/studio/test_cancel_atomicity.py
+++ b/tests/studio/test_cancel_atomicity.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import ast
+import importlib.util
 import random
 import threading
 from pathlib import Path
@@ -107,6 +108,20 @@ _WANTED = {
 }
 
 
+def _load_active_generations():
+    """The real registry `_TrackedCancel` records runs in.
+
+    Loaded straight off disk rather than imported, so the extracted class runs
+    against the genuine module without pulling in the whole route package (and
+    without putting studio/backend on sys.path for the rest of the session).
+    """
+    path = SOURCE_PATH.parents[1] / "state" / "active_generations.py"
+    spec = importlib.util.spec_from_file_location("studio_active_generations", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
 def _load_registry_module():
     chunks = []
     for n in _TREE.body:
@@ -125,7 +140,7 @@ def _load_registry_module():
             and n.target.id in _WANTED
         ):
             chunks.append(seg)
-    mod = {}
+    mod = {"active_generations": _load_active_generations()}
     exec(
         "import threading, time\nfrom typing import Optional\n" + "\n\n".join(chunks),
         mod,
diff --git a/tests/studio/test_deep_research_frontend_contract.py b/tests/studio/test_deep_research_frontend_contract.py
index b22d4691a1..c8636518cc 100644
--- a/tests/studio/test_deep_research_frontend_contract.py
+++ b/tests/studio/test_deep_research_frontend_contract.py
@@ -60,7 +60,9 @@ def test_research_mode_is_single_chat_and_detaches_without_cancel() -> None:
     assert 'update.event?.event === "reasoning.updated"' in adapter
     assert "The activity store coalesces these high-frequency events" in adapter
     assert '{ type: "text" as const, text: report }' in adapter
-    assert "if (abortSignal.aborted) return" in adapter
+    # runSignal, not abortSignal: each run gets its own controller, forwarded from the thread
+    # signal, so one chat's Stop cannot abort a sibling streaming in the background.
+    assert "if (runSignal.aborted) return" in adapter
     assert "await autoLoadSmallestModel()" in adapter
     assert "signal: researchFollowController.signal" in adapter
     assert "beginExternalResearchFollow(" in adapter
diff --git a/tests/studio/test_desktop_reliability_frontend_contract.py b/tests/studio/test_desktop_reliability_frontend_contract.py
index 2552b6c1d8..b004218658 100644
--- a/tests/studio/test_desktop_reliability_frontend_contract.py
+++ b/tests/studio/test_desktop_reliability_frontend_contract.py
@@ -98,6 +98,18 @@ def test_chat_exports_await_native_saves_and_markdown_uses_shared_helper():
     assert "downloadFile(" in thread
 
 
+def test_desktop_startup_waits_for_auth_without_intermediate_handoff():
+    source = APP_PROVIDER.read_text(encoding = "utf-8")
+
+    assert 'const showApp = status === "running" && desktopAuthReady;' in source
+    assert "Preparing Unsloth" not in source
+    assert "Signing in to desktop session" not in source
+    assert "desktopBooting" not in source
+    assert "showInteractiveApp" not in source
+    assert "<NativeIntentDrain />" in source
+    assert "{children}" in source
+
+
 def test_full_app_layout_uses_its_own_initialized_marker():
     source = APP_PROVIDER.read_text(encoding = "utf-8")
 
diff --git a/tests/studio/test_first_turn_thread_identity.py b/tests/studio/test_first_turn_thread_identity.py
new file mode 100644
index 0000000000..49dbc83ef9
--- /dev/null
+++ b/tests/studio/test_first_turn_thread_identity.py
@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""A first turn must reach the model adapter with its real thread id.
+
+assistant-ui binds `unstable_threadId` before the thread is persisted, so a first
+turn used to file every run handle under the shared "__default" key. Two of them
+overlapping there is unresolvable after the fact: nothing links a run under that
+key to the id its thread later receives, so the sidebar showed no spinner and Stop
+could not reach either generation.
+
+The link exists earlier. `append()` tracks `threadListItem.initialize()` by the
+user message id, and `createPersistedRunAdapter` already awaits that promise before
+invoking the adapter, so the id is known by the time the run starts. These tests pin
+that the resolved id is carried through rather than discarded.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+
+WORKSPACE = Path(__file__).resolve().parents[2]
+PROVIDER = (WORKSPACE / "studio/frontend/src/features/chat/runtime-provider.tsx").read_text(
+    encoding = "utf-8"
+)
+
+
+def test_the_tracked_promise_carries_the_assigned_thread_id():
+    # Resolving to void threw the id away, which is what forced the "__default" detour.
+    assert "Promise<string | undefined>\n>();" in PROVIDER
+    assert re.search(
+        r"trackRunStartReady\(\s*message\.id,\s*initializeThread\.then\(\(\{ remoteId \}\) => remoteId\),",
+        PROVIDER,
+    ), "append() must track the promise that resolves to the persisted thread id"
+
+
+def test_wait_for_run_start_returns_the_id():
+    assert re.search(
+        r"async function waitForRunStartHistoryAppend\([^)]*\): Promise<string \| undefined>",
+        PROVIDER,
+        re.S,
+    ), "the awaiter must hand back the id it waited for"
+    assert "return adoptedThreadId;" in PROVIDER
+
+
+def test_the_run_is_given_its_real_thread_id():
+    # The whole point: the adapter must not start under the unresolved key when the id is
+    # already known by the time the await above resolves.
+    block = re.search(
+        r"async \*run\(options\) \{.*?const result = adapter\.run\(.*?\);",
+        PROVIDER,
+        re.S,
+    )
+    assert block, "createPersistedRunAdapter's run wrapper not found"
+    body = block.group(0)
+    assert "const adoptedThreadId = await waitForRunStartHistoryAppend(" in body
+    assert (
+        "!options.unstable_threadId && adoptedThreadId" in body
+    ), "only fill in the id when assistant-ui had none"
+    assert "unstable_threadId: adoptedThreadId" in body
+
+
+def test_an_existing_thread_id_is_never_overwritten():
+    # A resolved thread already streams under its own id; replacing it would move a running
+    # chat's handles out from under the sidebar row watching them.
+    block = re.search(
+        r"const result = adapter\.run\((.*?)\);",
+        PROVIDER,
+        re.S,
+    )
+    assert block
+    arg = block.group(1)
+    assert "? { ...options, unstable_threadId: adoptedThreadId }" in arg
+    assert ": options" in arg
diff --git a/tests/studio/test_model_picker_contracts.py b/tests/studio/test_model_picker_contracts.py
index 299bf09025..e7d1785ca1 100644
--- a/tests/studio/test_model_picker_contracts.py
+++ b/tests/studio/test_model_picker_contracts.py
@@ -73,6 +73,57 @@ def test_autoload_records_backend_loaded_model_identity():
     assert "m.id === loadedModelId" in autoload
 
 
+def test_chat_autoload_toast_is_persistent_and_dismissible():
+    """Send-triggered autoload stays visible until it settles but remains
+    dismissible, matching the explicit model-loading toast's lifetime."""
+    src = _read("features/chat/api/chat-adapter.ts")
+    auto_load = src.split("async function autoLoadSmallestModel", 1)[1]
+    auto_load = auto_load.split("export function createOpenAIStreamAdapter", 1)[0]
+    assert "toast.loading(" not in auto_load
+    assert "const updateAutoLoadToast =" in auto_load
+    assert "if (autoLoadToastDismissed) return;" in auto_load
+    assert auto_load.count("toast.message(") == 2
+    assert auto_load.count("updateAutoLoadToast(") >= 4
+    assert "duration: Number.POSITIVE_INFINITY" in auto_load
+    assert "closeButton: true" in auto_load
+    assert "icon: createLoadingToastIcon()" in auto_load
+    assert "onDismiss:" in auto_load
+    # Terminal success uses a fresh finite toast after manual progress dismissal.
+    assert "showAutoLoadSuccess" in auto_load
+    assert "description: undefined" in auto_load
+    assert "icon: undefined" in auto_load
+    assert "duration: 5000" in auto_load
+    assert "duration: 30000" not in auto_load
+    assert auto_load.count("toast.dismiss(toastId)") >= 4
+
+    explicit_load = _read("features/chat/hooks/use-chat-model-runtime.ts")
+    assert "duration: Infinity" in explicit_load
+
+
+def test_recipe_model_load_toast_is_persistent_and_dismissible():
+    """Recipe model loading uses the same dismissible persistent lifecycle as
+    chat loading because both call the non-abortable loadModel API."""
+    src = _read("features/recipe-studio/hooks/use-recipe-executions.ts")
+    model_load = src.split("async function loadLocalModelSelection", 1)[1]
+    model_load = model_load.split("function getLocalModelLoadPlanForPayload", 1)[0]
+    assert "toast.loading(" not in model_load
+    assert "toast.message(" in model_load
+    assert "duration: Number.POSITIVE_INFINITY" in model_load
+    assert "closeButton: true" in model_load
+    assert "icon: createLoadingToastIcon()" in model_load
+    assert "onDismiss:" in model_load
+    assert "description: undefined" in model_load
+    assert "icon: undefined" in model_load
+    assert "duration: 2000" in model_load
+
+    toast_lib = _read("lib/toast.ts")
+    assert "createElement(Spinner" in toast_lib
+    assert 'className: "size-4 text-muted-foreground"' in toast_lib
+
+    sonner = _read("components/ui/sonner.tsx")
+    assert "loading: createLoadingToastIcon()" in sonner
+
+
 def test_rollback_restores_native_lease_expiry_with_token():
     """A failed model switch that rolls back to a previously loaded picked GGUF
     must restore the lease expiry paired with the token, never the token alone
@@ -627,3 +678,24 @@ def test_parallel_slots_setting_wired_end_to_end():
     sidebar = _read("features/model-picker/components/sidebar-model-config.tsx")
     # The sidebar form remounts when an external change lands.
     assert 'config.nParallel ?? "",' in sidebar
+
+
+def test_vulkan_inference_devices_are_the_pickable_set():
+    """GGUF loads run through llama-server, so on a Vulkan build the picker must
+    offer the inference inventory (ggml ordinals, the space `--device Vulkan<i>`
+    pins) rather than the torch view, which can miss cards llama-server drives.
+    The XPU ban must not apply there: it is about torch-xpu ordinals no
+    applicator speaks, and a Vulkan pick does not use them.
+    """
+    src = " ".join(_read("hooks/use-gpu-info.ts").split())
+    # The Vulkan inventory is consulted first, and only when it has devices.
+    assert (
+        "const inference = data?.inference_gpu; "
+        'if (inference?.backend === "vulkan" && (inference.devices ?? []).length) {' in src
+    )
+    # Pinnable on the ggml ordinal space, gated on the backend's own support flag.
+    assert "const picksAccepted = inference.gguf_gpu_ids_supported !== false;" in src
+    assert 'physicalIndex: picksAccepted && d.index_kind === "vulkan",' in src
+    # The torch fallback keeps its physical-only gate and the XPU ban.
+    assert 'data?.device_backend !== "xpu" &&' in src
+    assert 'physicalIndex: pinnableBackend && d.index_kind === "physical",' in src
diff --git a/tests/studio/test_stop_running_chats_prompt_contract.py b/tests/studio/test_stop_running_chats_prompt_contract.py
new file mode 100644
index 0000000000..d3995ec228
--- /dev/null
+++ b/tests/studio/test_stop_running_chats_prompt_contract.py
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Source contracts for the "stop running chats" confirmation.
+
+The dialog is what a user reads before losing in-flight work, so two things have
+to hold: it counts conversations rather than generation handles, and it describes
+what confirming actually does. There is no frontend test runner in this repo, so
+these read the source the way the other frontend contracts here do.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+WORKDIR = Path(__file__).resolve().parents[2]
+FRONTEND = WORKDIR / "studio" / "frontend" / "src"
+
+
+def _read(rel: str) -> str:
+    path = FRONTEND / rel
+    assert path.exists(), f"missing source file: {path}"
+    return path.read_text(encoding = "utf-8")
+
+
+def test_the_prompt_counts_conversations_not_generation_handles():
+    # One chat holds several handles while a tool continuation registers its next leg
+    # before the previous unwinds (active_generations.ActiveGeneration mints one per
+    # __enter__), so active.count exceeds the deduplicated thread_ids and the dialog
+    # offered to stop two chats while listing one title.
+    src = _read("features/chat/utils/confirm-stop-running-chats.ts")
+    assert "entry.thread_id" in src, "the unnamed entries have to be counted separately"
+    # The raw handle count survives only for a backend too old to send the entries.
+    primary = src.index("running.length + unnamed")
+    fallback = src.index("Math.max(active.count")
+    assert primary < fallback, "the handle count must be the fallback, not the primary"
+
+
+def test_an_unload_is_not_described_as_a_reload():
+    # ejectModel confirms through the same dialog, but confirming calls /unload and
+    # leaves no model loaded: "Unloading the model reloads the model" and "Stop and
+    # reload" promised the opposite for the destructive one.
+    dialog = _read("features/chat/components/stop-running-chats-dialog.tsx")
+    assert "Stop and unload" in dialog and "Stop and reload" in dialog
+    assert "leaves no model loaded" in dialog
+
+    runtime = _read("features/chat/hooks/use-chat-model-runtime.ts")
+    eject = runtime.index('"Unloading the model"')
+    assert (
+        '"unload"' in runtime[eject : eject + 120]
+    ), "the eject path must ask for the unload wording"
+
+
+def test_the_tts_request_names_its_thread():
+    # The audio branch registers its run locally under the thread key, and the backend
+    # tracker reads payload.thread_id. Omitting it filed the backend entry under no
+    # thread, so the prompt counted the named local run and the unnamed backend one as
+    # two requests for a single TTS chat.
+    src = _read("features/chat/api/chat-adapter.ts")
+    call = src.index("const result = await generateAudio(")
+    assert (
+        "thread_id: resolvedThreadId" in src[call : call + 600]
+    ), "the TTS payload must carry the resolved thread id"
diff --git a/tests/studio/test_stream_cancel_registration_timing.py b/tests/studio/test_stream_cancel_registration_timing.py
index a833006873..5a28432aed 100644
--- a/tests/studio/test_stream_cancel_registration_timing.py
+++ b/tests/studio/test_stream_cancel_registration_timing.py
@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import ast
 import asyncio
+import importlib.util
 import json
 import threading
 import time
@@ -256,6 +257,20 @@ _WANTED = {
 }
 
 
+def _load_active_generations():
+    """The real registry `_TrackedCancel` records runs in.
+
+    Loaded straight off disk rather than imported, so the extracted class runs
+    against the genuine module without pulling in the whole route package (and
+    without putting studio/backend on sys.path for the rest of the session).
+    """
+    path = SOURCE_PATH.parents[1] / "state" / "active_generations.py"
+    spec = importlib.util.spec_from_file_location("studio_active_generations", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
 def _load_registry_module():
     chunks = []
     for n in _TREE.body:
@@ -274,7 +289,7 @@ def _load_registry_module():
             and n.target.id in _WANTED
         ):
             chunks.append(seg)
-    mod = {}
+    mod = {"active_generations": _load_active_generations()}
     exec("import threading, time\n" + "\n\n".join(chunks), mod)
     return mod
 
@@ -674,16 +689,18 @@ def test_generate_stream_cancels_backend_on_stream_cancelled_error():
             body_src = "\n".join(ast.unparse(stmt) for stmt in sub.body)
             found_cancel_handler = (
                 "cancel_event.set()" in body_src
-                and "backend.reset_generation_state()" in body_src
+                and "backend.reset_generation_state(cancel_event)" in body_src
                 and any(isinstance(stmt, ast.Raise) and stmt.exc is None for stmt in sub.body)
             )
         if isinstance(sub, ast.Try) and sub.finalbody:
             final_src = "\n".join(ast.unparse(stmt) for stmt in sub.finalbody)
-            found_finally_cleanup = (
+            # Accumulate: an existence claim, and the cleanup sits in a nested try whose
+            # own finally only unregisters the swap-gate entry.
+            found_finally_cleanup = found_finally_cleanup or (
                 "not completed" in final_src
                 and "not cancel_event.is_set()" in final_src
                 and "cancel_event.set()" in final_src
-                and "backend.reset_generation_state()" in final_src
+                and "backend.reset_generation_state(cancel_event)" in final_src
                 and _awaits_to_thread_gen_close(sub)
             )
 
@@ -731,11 +748,11 @@ def test_stream_chunks_cancel_branch_resets_backend_state():
         ):
             continue
         body_src = "\n".join(ast.unparse(s) for s in sub.body)
-        if "backend.reset_generation_state()" in body_src:
+        if "backend.reset_generation_state(cancel_event)" in body_src:
             return
     raise AssertionError(
         "stream_chunks `if cancel_event.is_set():` branch must call "
-        "backend.reset_generation_state() -- matches the existing "
+        "backend.reset_generation_state(cancel_event) -- matches the existing "
         "request.is_disconnected() / CancelledError cleanup paths and "
         "prevents KV-cache drift after cancel-via-POST"
     )
diff --git a/tests/studio/test_ui_font_scale_contract.py b/tests/studio/test_ui_font_scale_contract.py
index 65d3215374..bd9ad9acdd 100644
--- a/tests/studio/test_ui_font_scale_contract.py
+++ b/tests/studio/test_ui_font_scale_contract.py
@@ -39,6 +39,17 @@ def _frontend_sources():
             yield path
 
 
+def _rel(path):
+    """Source-relative path with forward slashes on every OS.
+
+    The allowlists above are written with "/", so a plain str(relative_to(SRC))
+    silently stops matching on Windows and every allowlisted file reports as an
+    offender. Keeping the separator normalised here also keeps failure messages
+    identical across platforms.
+    """
+    return path.relative_to(SRC).as_posix()
+
+
 def test_preference_writes_a_scale_not_the_root_font_size():
     assert 'setVar("--ui-font-scale"' in STORE
     assert 'el.setAttribute("data-ui-font-size"' in STORE
@@ -136,7 +147,7 @@ def test_no_raw_pixel_text_utilities():
     for path in _frontend_sources():
         text = path.read_text(encoding = "utf-8")
         for m in re.finditer(r"(?<![\w-])(?:text|leading)-\[[0-9.]+px\]", text):
-            offenders.append(f"{path.relative_to(SRC)}: {m.group(0)}")
+            offenders.append(f"{_rel(path)}: {m.group(0)}")
     assert offenders == [], (
         "Raw px text utilities ignore the UI font size preference; use the "
         f"text-ui-* / leading-ui-* tokens in index.css instead: {offenders[:10]}"
@@ -157,7 +168,7 @@ def test_css_font_sizes_reference_the_scale():
                 continue
             if "1px" in decl:
                 continue  # library layout tricks (KaTeX-style), not text
-            offenders.append(f"{path.relative_to(SRC)}: {decl.strip()[:80]}")
+            offenders.append(f"{_rel(path)}: {decl.strip()[:80]}")
     assert offenders == [], (
         "CSS typography must multiply by var(--ui-font-scale, 1) or be "
         f"allowlisted here with a reason: {offenders[:10]}"
@@ -167,7 +178,7 @@ def test_css_font_sizes_reference_the_scale():
 def test_inline_font_size_styles_reference_the_scale():
     offenders = []
     for path in _frontend_sources():
-        rel = str(path.relative_to(SRC))
+        rel = _rel(path)
         if rel in FONTSIZE_STYLE_ALLOWLIST:
             continue
         text = path.read_text(encoding = "utf-8")
diff --git a/tests/studio/test_usage_examples_model_source_contract.py b/tests/studio/test_usage_examples_model_source_contract.py
new file mode 100644
index 0000000000..a0c0d04020
--- /dev/null
+++ b/tests/studio/test_usage_examples_model_source_contract.py
@@ -0,0 +1,200 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Static contract for which model the API usage examples name, and for the
+model-auto-switch control living in exactly one place on the API keys tab."""
+
+import re
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[2]
+SETTINGS = REPO / "studio/frontend/src/features/settings"
+USAGE_EXAMPLES_TSX = SETTINGS / "components/usage-examples.tsx"
+OPENAI_MODELS_TS = SETTINGS / "api/openai-models.ts"
+API_KEYS_TAB_TSX = SETTINGS / "tabs/api-keys-tab.tsx"
+
+
+def test_examples_name_a_model_the_server_can_serve():
+    # A hardcoded repo id made copied curls 404; read the servable ids from /v1/models.
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    assert 'from "../api/openai-models"' in src
+    assert "function useExampleModelName(): string" in src
+    hook = src[src.find("function useExampleModelName") : src.find("// Backend PATH detection")]
+    assert "listOpenAIModels()" in hook
+    # Precedence: live checkpoint, then a loaded entry, then any entry if switching is on.
+    assert "catalog?.find((m) => m.loaded) ?? (autoSwitch ? catalog?.[0] : undefined)" in hook
+    # The snippet pins the quant so the request names the file on disk.
+    assert "`${pick.id}:${pick.quant}`" in hook
+
+    api = OPENAI_MODELS_TS.read_text(encoding = "utf-8")
+    assert 'authFetch("/v1/models")' in api
+
+
+def test_examples_never_print_a_hardcoded_model_id():
+    # The bug this exists for: a `[]` catalog printed a snippet before /v1/models answered.
+    # It is tri-state now, and the panel asks for a model instead.
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    assert "MODEL_FALLBACK" not in src
+    # No repo-shaped literal anywhere: a snippet may only name what /v1 returns.
+    assert re.search(r'"unsloth/[^"]+"', src) is None
+    assert "function useExampleModelName(): string | null" in src
+    assert "useState<OpenAIModel[] | null>(null)" in src
+    # Nothing servable means nothing is built, so there is nothing to copy.
+    assert "(model ? buildSnippets(base, key, model, os) : null)" in src
+    assert "if (!snippets) return;" in src
+    assert "{snippets ? (" in src
+    assert 't("settings.apiKeys.usageNoModel")' in src
+
+    en = EN_TS.read_text(encoding = "utf-8")
+    assert "usageNoModel:" in en
+
+
+def test_catalog_refresh_follows_the_loaded_model():
+    # A dep list missing these never re-ran, so a finished load left the first fetch's
+    # name. Nor may it be gated on having no checkpoint: the store keeps one across an
+    # idle unload, which changes nothing React can see.
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    hook = src[src.find("function useExampleModelName") : src.find("// Backend PATH detection")]
+    assert "}, [checkpoint, ggufVariant]);" in hook
+    assert "needsCatalog" not in hook
+    # A finishing download moves no store state, so the fetch retries on a timer too,
+    # and residency only slows that timer rather than stopping it.
+    assert "CATALOG_RETRY_MS" in hook and "CATALOG_IDLE_MS" in hook
+    assert "window.clearTimeout(timeoutId)" in hook
+    assert "const CATALOG_RETRY_MS = 15000;" in src
+    assert "const CATALOG_IDLE_MS = 60000;" in src
+
+
+def test_a_stored_checkpoint_needs_catalog_evidence():
+    # The store keeps a checkpoint across an idle unload and across a deletion, so
+    # preferring it on the switch setting alone named a model /v1/models had proved
+    # absent, and the snippets 404d instead of falling back.
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    hook = src[src.find("function useExampleModelName") : src.find("// Backend PATH detection")]
+    assert 'const entry = catalog?.find((m) => sameBaseModelId(m.id, checkpoint ?? ""));' in hook
+    # Resident, or downloaded with something able to reload it. Never the setting alone.
+    assert "(!!entry && (entry.loaded || autoSwitch || idleReload))" in hook
+    assert "autoSwitch ||\n" not in hook
+
+
+def test_standalone_idle_unload_still_names_the_stored_checkpoint():
+    # UNSLOTH_MODEL_IDLE_TTL without auto-switch reloads exactly what it freed, so the
+    # stored checkpoint stays runnable and the panel must keep showing it. The stash
+    # restores only that model, so it can never pick catalog[0].
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    hook = src[src.find("function useExampleModelName") : src.find("// Backend PATH detection")]
+    assert "const [idleReload, setIdleReload] = useState(false);" in hook
+    assert "setIdleReload(settings[1])" in hook
+    assert "s.idleUnloadActive" in hook
+    # fromCatalog stays gated on auto-switch alone.
+    assert "?? (autoSwitch ? catalog?.[0] : undefined)" in hook
+    assert "idleReload ? catalog" not in hook
+
+
+def test_a_failed_refresh_does_not_erase_what_the_server_holds():
+    # Catching into [] and false made a transient error authoritative: the panel dropped
+    # a still-servable model and printed "No model". The catalog is deliberately
+    # tri-state, and a failure must stay the unknown state.
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    hook = src[src.find("function useExampleModelName") : src.find("// Backend PATH detection")]
+    assert "listOpenAIModels().catch(() => null)" in hook
+    assert ".catch(() => null)," in hook
+    assert "if (models !== null) setCatalog(models);" in hook
+    assert "if (settings !== null) {" in hook
+    # The old negatives must be gone entirely.
+    assert "catch(() => [] as OpenAIModel[])" not in hook
+    assert "catch(() => [false, false] as const)" not in hook
+    assert "catch(() => false)" not in hook
+
+
+def test_the_pinned_quant_comes_from_the_catalog():
+    # Catalog membership proves the repo, not the saved quant: the stored one can name
+    # a file deleted while another quant remains, so pinning it 404d on a missing quant
+    # with a runnable one listed.
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    hook = src[src.find("function useExampleModelName") : src.find("// Backend PATH detection")]
+    assert "const quant = catalog === null ? ggufVariant : entry?.quant;" in hook
+    assert "`${checkpoint}:${ggufVariant}`" not in hook
+
+
+def test_usage_examples_has_no_duplicate_auto_switch_control():
+    # ModelAutoSwitchSection renders this setting just below and shares no state with it.
+    src = USAGE_EXAMPLES_TSX.read_text(encoding = "utf-8")
+    # Reading the setting is fine; writing it here is what would be a second control.
+    assert "updateOpenAIAutoSwitchSettings" not in src
+    assert "SWITCH_NOTE" not in src
+    assert "Switch model by request" not in src
+    assert "pythonSwitchDemo" not in src
+    assert "javascriptSwitchDemo" not in src
+    assert "modelAutoSwitch" not in src
+
+    tab = API_KEYS_TAB_TSX.read_text(encoding = "utf-8")
+    assert "<ModelAutoSwitchSection />" in tab
+
+
+API_MONITOR_TSX = SETTINGS / "components/api-monitor-console.tsx"
+
+
+def test_api_monitor_pages_five_at_a_time():
+    # The backend retains 50 terminal entries; the console used to dump them all at once.
+    src = API_MONITOR_TSX.read_text(encoding = "utf-8")
+    assert "const PAGE_SIZE = 5;" in src
+    assert "ordered.slice(" in src
+    # Paging back must freeze the id order, or live traffic reorders history under it.
+    assert "frozenIds" in src
+    assert "setFrozenIds((prev) => prev ?? entries.map((entry) => entry.id))" in src
+
+
+def test_api_monitor_renders_lifecycle_rows():
+    src = API_MONITOR_TSX.read_text(encoding = "utf-8")
+    assert "function LifecycleEntry(" in src
+    assert 'entry.kind === "lifecycle"' in src
+    for label in ("Loading model", "Model loaded", "Model unloaded"):
+        assert label in src
+    # Lifecycle rows have no prompt/reply to fetch.
+    assert "isLifecycle(entry) || !expandedIds.has(entry.id)" in src
+
+
+def test_auto_switch_section_sits_above_the_monitor():
+    tab = API_KEYS_TAB_TSX.read_text(encoding = "utf-8")
+    assert tab.index("<ModelAutoSwitchSection />") < tab.index("<ApiMonitorConsole />")
+    assert tab.index("<ApiMonitorConsole />") < tab.index("<UsageExamples")
+
+
+AUTO_SWITCH_TSX = SETTINGS / "components/model-auto-switch-section.tsx"
+EN_TS = REPO / "studio/frontend/src/i18n/locales/en.ts"
+
+
+def test_api_monitor_renders_download_rows():
+    src = API_MONITOR_TSX.read_text(encoding = "utf-8")
+    assert 'entry.event === "download"' in src
+    for label in ("Downloading model", "Model downloaded", "Model download failed"):
+        assert label in src
+
+
+def test_monitor_can_unload_the_loaded_model():
+    src = API_MONITOR_TSX.read_text(encoding = "utf-8")
+    assert "unloadActiveModel" in src
+    # Always rendered so the manual release stays discoverable; disabled, not hidden.
+    assert "disabled={unloading || !data?.active_model}" in src
+    assert "{data?.active_model ? (" not in src
+    # /unload matches on the internal id, omitted here (a host path), so read it from status.
+    assert "resolveInferenceCheckpointId(status)" in src
+    assert "unloadModel({ model_path: checkpoint })" in src
+
+
+def test_auto_download_toggle_is_gated_on_auto_switch():
+    # Downloading what auto-switch cannot load fetches gigabytes nothing can serve.
+    src = AUTO_SWITCH_TSX.read_text(encoding = "utf-8")
+    assert "modelAutoSwitch.autoDownload" in src
+    assert "settings?.autoDownloadModel ?? false" in src
+    row = src[src.find("modelAutoSwitch.autoDownload") :]
+    assert "disabled={!settings?.enabled || isSaving}" in row[: row.find("</SettingsRow>")]
+
+
+def test_auto_download_copy_warns_about_api_key_holders():
+    en = EN_TS.read_text(encoding = "utf-8")
+    start = en.find("autoDownloadDescription:")
+    assert start != -1
+    description = en[start : en.find("\n", en.find('",', start))]
+    assert "API key" in description
diff --git a/tests/test_bad_mappings_redirect.py b/tests/test_bad_mappings_redirect.py
index 49dab2d98b..7ae9ddbb4f 100644
--- a/tests/test_bad_mappings_redirect.py
+++ b/tests/test_bad_mappings_redirect.py
@@ -26,7 +26,7 @@ def _load_get_model_name():
     namespace = dict(mapper_ns)
     namespace["SUPPORTS_FOURBIT"] = True
     namespace["_env_says_offline"] = lambda: True
-    namespace["_get_new_mapper"] = lambda: ({}, {}, {})
+    namespace["_get_new_mapper"] = lambda: ({}, {}, {}, {}, {})
 
     wanted = {"__get_model_name", "_resolve_with_mappers", "get_model_name"}
     for node in tree.body:
diff --git a/tests/test_get_model_name.py b/tests/test_get_model_name.py
index 33ad316d88..bbd5bfacb1 100644
--- a/tests/test_get_model_name.py
+++ b/tests/test_get_model_name.py
@@ -6,7 +6,8 @@ from unsloth.models.mapper import FLOAT_TO_INT_MAPPER, MAP_TO_UNSLOTH_16bit
 
 
 def _no_remote_mapper():
-    return {}, {}, {}
+    # int_to_float, float_to_int, map_to_16bit, fp8_block, fp8_row
+    return {}, {}, {}, {}, {}
 
 
 class TestGetModelName(unittest.TestCase):
diff --git a/tests/test_new_mapper_fetched_fp8.py b/tests/test_new_mapper_fetched_fp8.py
new file mode 100644
index 0000000000..2835aadb59
--- /dev/null
+++ b/tests/test_new_mapper_fetched_fp8.py
@@ -0,0 +1,155 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""Regression tests for what ``_get_new_mapper`` hands back to the upgrade probe.
+
+``test_new_mapper_no_global_leak.py`` serves the repo's own ``mapper.py`` as both installed
+and fetched source, so it cannot tell a fetched table from a fresh copy of the installed one.
+Two gaps it misses:
+
+1. The probe must answer for an fp8 repo only the FETCHED mapper knows, so an extra ``"8"``
+   entry is spliced into the fetched source only. Isolating the exec without returning the
+   fetched fp8 tables would silently drop the fp8 half of the upgrade check.
+2. The probe must survive a fetched ``mapper.py`` with no fp8 tables (anything older, or a
+   future rename): reading them with ``[]`` raises ``KeyError`` into the bare ``except``,
+   taking the 4bit half, the probe's whole purpose, down with it.
+
+``loader_utils`` imports torch, so ast-extract the resolvers and run them against a stubbed
+``requests``, as in ``tests/test_bad_mappings_redirect.py``.
+"""
+
+import ast
+import os
+import sys
+import types
+
+_MODELS = os.path.join(os.path.dirname(__file__), os.pardir, "unsloth", "models")
+
+_WANTED = {"__get_model_name", "_resolve_with_mappers", "_get_new_mapper", "get_model_name"}
+
+# An fp8 ("8") model, spliced into the FETCHED mapper only.
+_NEW_KEY = "unsloth/Zeta-9B-Only-On-Main"
+_NEW_OFFICIAL = "zeta-org/Zeta-9B-Only-On-Main-FP8"
+_NEW_BLOCK = "unsloth/Zeta-9B-Only-On-Main-FP8-Block"
+_NEW_ROW = "unsloth/Zeta-9B-Only-On-Main-FP8-Row"
+_ANCHOR = '    "unsloth/Kimi-K2-Instruct-BF16" : ('
+
+
+def _mapper_source():
+    with open(os.path.join(_MODELS, "mapper.py"), encoding = "utf-8") as f:
+        return f.read()
+
+
+def _with_extra_fp8_model(source):
+    assert _ANCHOR in source, "anchor moved; update this test"
+    entry = (
+        f'    "{_NEW_KEY}" : {{\n'
+        f'        "16" : ("{_NEW_KEY}", "zeta-org/Zeta-9B-Only-On-Main"),\n'
+        f'        "8"  : ("{_NEW_OFFICIAL}", "{_NEW_BLOCK}", "{_NEW_ROW}"),\n'
+        f"    }},\n"
+    )
+    return source.replace(_ANCHOR, entry + _ANCHOR, 1)
+
+
+def _without_fp8_tables(source):
+    """A mapper.py from before the fp8 tables existed."""
+    return source.replace("FLOAT_TO_FP8_BLOCK_MAPPER", "SOME_OTHER_BLOCK_TABLE").replace(
+        "FLOAT_TO_FP8_ROW_MAPPER", "SOME_OTHER_ROW_TABLE"
+    )
+
+
+class _FakeResponse:
+    def __init__(self, text):
+        self.text = text
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+def _install_fake_requests(monkeypatch, text):
+    module = types.ModuleType("requests")
+    module.get = lambda url, timeout = None: _FakeResponse(text)
+    monkeypatch.setitem(sys.modules, "requests", module)
+
+
+def _install_fake_vllm_absent(monkeypatch, namespace):
+    """vllm >= 0.12.0 returns early from __get_model_name, leaving the probe unreachable."""
+    monkeypatch.delitem(sys.modules, "vllm", raising = False)
+    fake = types.ModuleType("importlib")
+    fake.util = types.SimpleNamespace(find_spec = lambda name: None)
+    namespace["importlib"] = fake
+
+
+def _load_resolver(installed_source):
+    """Stand-in for loader_utils' module globals, built from `installed_source`."""
+    from unsloth_zoo.utils import Version
+
+    mapper_ns = {}
+    exec(compile(installed_source, "mapper.py", "exec"), mapper_ns)
+
+    namespace = {
+        "INT_TO_FLOAT_MAPPER": mapper_ns["INT_TO_FLOAT_MAPPER"],
+        "FLOAT_TO_INT_MAPPER": mapper_ns["FLOAT_TO_INT_MAPPER"],
+        "MAP_TO_UNSLOTH_16bit": mapper_ns["MAP_TO_UNSLOTH_16bit"],
+        "FLOAT_TO_FP8_BLOCK_MAPPER": mapper_ns["FLOAT_TO_FP8_BLOCK_MAPPER"],
+        "FLOAT_TO_FP8_ROW_MAPPER": mapper_ns["FLOAT_TO_FP8_ROW_MAPPER"],
+        "SUPPORTS_FOURBIT": True,
+        "transformers_version": Version("4.57.6"),
+        "Version": Version,
+        "os": os,
+    }
+    with open(os.path.join(_MODELS, "loader_utils.py"), encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    for node in tree.body:
+        if isinstance(node, ast.Assign) and any(
+            getattr(t, "id", None) in ("BAD_MAPPINGS", "_OFFLINE_ENV_VALUES", "_OFFLINE_ENV_KEYS")
+            for t in node.targets
+        ):
+            exec(compile(ast.Module([node], []), "<assign>", "exec"), namespace)
+        elif isinstance(node, ast.FunctionDef) and (
+            node.name in _WANTED or node.name == "_env_says_offline"
+        ):
+            exec(compile(ast.Module([node], []), node.name, "exec"), namespace)
+    return namespace
+
+
+def test_probe_answers_for_an_fp8_repo_only_the_fetched_mapper_knows(monkeypatch):
+    installed = _mapper_source()
+    namespace = _load_resolver(installed)
+    installed_block = namespace["FLOAT_TO_FP8_BLOCK_MAPPER"]
+    installed_row = namespace["FLOAT_TO_FP8_ROW_MAPPER"]
+    assert _NEW_OFFICIAL.lower() not in installed_block, "the installed table must not know it"
+
+    _install_fake_requests(monkeypatch, _with_extra_fp8_model(installed))
+    _install_fake_vllm_absent(monkeypatch, namespace)
+
+    try:
+        resolved = namespace["get_model_name"](
+            _NEW_OFFICIAL, load_in_4bit = False, load_in_fp8 = "block"
+        )
+    except NotImplementedError as error:
+        assert "not supported in your current Unsloth version" in str(error)
+    else:
+        raise AssertionError(
+            f"a fetched-only fp8 repo must raise the upgrade error, got {resolved!r}"
+        )
+
+    # Answering must not have adopted the fetched tables.
+    assert namespace["FLOAT_TO_FP8_BLOCK_MAPPER"] is installed_block
+    assert namespace["FLOAT_TO_FP8_ROW_MAPPER"] is installed_row
+    assert _NEW_OFFICIAL.lower() not in namespace["FLOAT_TO_FP8_BLOCK_MAPPER"]
+
+
+def test_probe_survives_a_fetched_mapper_without_the_fp8_tables(monkeypatch):
+    installed = _mapper_source()
+    namespace = _load_resolver(installed)
+    _install_fake_requests(monkeypatch, _without_fp8_tables(installed))
+
+    int_to_float, float_to_int, map_to_16bit = namespace["_get_new_mapper"]()[:3]
+
+    assert (
+        int_to_float and float_to_int and map_to_16bit
+    ), "a fetched mapper.py without the fp8 tables must not take the 4bit upgrade check down"
diff --git a/tests/test_new_mapper_no_global_leak.py b/tests/test_new_mapper_no_global_leak.py
new file mode 100644
index 0000000000..5ec00fba5a
--- /dev/null
+++ b/tests/test_new_mapper_no_global_leak.py
@@ -0,0 +1,99 @@
+"""Regression test for ``_get_new_mapper`` leaking into ``loader_utils`` globals.
+
+``get_model_name`` calls ``_get_new_mapper()`` whenever a name misses the local
+tables, purely to answer "would a newer Unsloth support this?". It fetches
+``mapper.py`` from GitHub main, prefixes the three mappers it wants with
+``NEW_``, and ``exec``s the result into ``globals()``.
+
+The slice starts at ``__INT_TO_FLOAT_MAPPER``, so it also carries
+``FLOAT_TO_FP8_BLOCK_MAPPER``/``FLOAT_TO_FP8_ROW_MAPPER`` and the two
+``_add_*`` helpers, and those names are NOT renamed. Exec'ing into
+``globals()`` therefore rebinds the FP8 tables that ``loader_utils`` imported
+from the installed ``mapper``, so every later ``get_model_name(...,
+load_in_fp8 = ...)`` in the process resolves through GitHub main's table
+instead of the installed one. The probe is supposed to read, not to swap the
+installed mappings out from under the caller.
+
+``loader_utils`` imports torch, so ast-extract ``_get_new_mapper`` and run it
+against a stubbed ``requests`` rather than importing unsloth (which needs a GPU).
+"""
+
+import ast
+import os
+import sys
+import types
+
+_MODELS = os.path.join(os.path.dirname(__file__), os.pardir, "unsloth", "models")
+
+
+def _mapper_source():
+    with open(os.path.join(_MODELS, "mapper.py"), encoding = "utf-8") as f:
+        return f.read()
+
+
+def _extract_get_new_mapper(namespace):
+    with open(os.path.join(_MODELS, "loader_utils.py"), encoding = "utf-8") as f:
+        tree = ast.parse(f.read())
+    for node in tree.body:
+        if isinstance(node, ast.FunctionDef) and node.name == "_get_new_mapper":
+            exec(compile(ast.Module([node], []), node.name, "exec"), namespace)
+            return namespace["_get_new_mapper"]
+    raise AssertionError("_get_new_mapper not found in loader_utils.py")
+
+
+class _FakeResponse:
+    def __init__(self, text):
+        self.text = text
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+def _install_fake_requests(monkeypatch, text):
+    module = types.ModuleType("requests")
+    module.get = lambda url, timeout = None: _FakeResponse(text)
+    monkeypatch.setitem(sys.modules, "requests", module)
+
+
+def test_get_new_mapper_does_not_rebind_the_installed_fp8_tables(monkeypatch):
+    _install_fake_requests(monkeypatch, _mapper_source())
+
+    installed = {}
+    exec(compile(_mapper_source(), "mapper.py", "exec"), installed)
+    block = installed["FLOAT_TO_FP8_BLOCK_MAPPER"]
+    row = installed["FLOAT_TO_FP8_ROW_MAPPER"]
+    assert block and row, "the installed FP8 tables should not be empty"
+
+    # Stand in for loader_utils' module globals, which import the FP8 tables.
+    namespace = {"FLOAT_TO_FP8_BLOCK_MAPPER": block, "FLOAT_TO_FP8_ROW_MAPPER": row}
+    get_new_mapper = _extract_get_new_mapper(namespace)
+
+    int_to_float, float_to_int, map_to_16bit, fp8_block, fp8_row = get_new_mapper()
+
+    # _get_new_mapper swallows every exception and returns empty dicts, so assert
+    # it actually ran before trusting anything below.
+    assert int_to_float and float_to_int and map_to_16bit, "the fetch/exec path did not run"
+
+    # the probe has to hand the FETCHED fp8 tables back, or a newly added fp8 repo would
+    # miss both the installed tables and the probe and skip the upgrade message
+    assert fp8_block and fp8_row
+    assert fp8_block is not block and fp8_row is not row
+
+    assert namespace["FLOAT_TO_FP8_BLOCK_MAPPER"] is block
+    assert namespace["FLOAT_TO_FP8_ROW_MAPPER"] is row
+
+
+def test_get_new_mapper_leaves_no_helpers_behind(monkeypatch):
+    _install_fake_requests(monkeypatch, _mapper_source())
+
+    namespace = {}
+    get_new_mapper = _extract_get_new_mapper(namespace)
+    before = set(namespace)
+
+    assert all(get_new_mapper()), "the fetch/exec path did not run"
+
+    leaked = set(namespace) - before
+    assert not leaked, f"_get_new_mapper leaked {sorted(leaked)} into its module globals"
diff --git a/unsloth/device_type.py b/unsloth/device_type.py
index 0e425e2001..1417f4f53c 100644
--- a/unsloth/device_type.py
+++ b/unsloth/device_type.py
@@ -117,6 +117,23 @@ DEVICE_COUNT: int = get_device_count()
 ALLOW_PREQUANTIZED_MODELS: bool = True
 # HSA_STATUS_ERROR_EXCEPTION checks - sometimes AMD fails for BnB
 ALLOW_BITSANDBYTES: bool = True
+# gfx906 (MI50 / Radeon VII / Vega 20): Dynamo/Inductor codegen is broken on this
+# legacy GCN arch (ROCm dropped it after 6.3) - compiled graphs crash or miscompile
+# while the eager path trains fine. Default compile off; setdefault so a user
+# override wins.
+if DEVICE_TYPE == "hip":
+    try:
+        _gcn_arch = torch.cuda.get_device_properties(0).gcnArchName.split(":")[0].strip().lower()
+    except Exception:
+        _gcn_arch = ""
+    if _gcn_arch == "gfx906":
+        os.environ.setdefault("TORCHDYNAMO_DISABLE", "1")
+        os.environ.setdefault("TORCH_COMPILE_DISABLE", "1")
+        os.environ.setdefault("UNSLOTH_COMPILE_DISABLE", "1")
+        print(
+            "Unsloth: gfx906 (MI50 / Radeon VII) detected - torch.compile disabled "
+            "(community-maintained legacy GCN path)."
+        )
 if DEVICE_TYPE == "hip":
     try:
         import bitsandbytes
diff --git a/unsloth/import_fixes.py b/unsloth/import_fixes.py
index 9cd5e7243a..8580c09c39 100644
--- a/unsloth/import_fixes.py
+++ b/unsloth/import_fixes.py
@@ -418,7 +418,13 @@ def fix_vllm_aimv2_issue():
     spec = importlib.util.find_spec("vllm")
     if spec is None:
         return
-    vllm_version = importlib_version("vllm")
+    # A findable spec with unreadable dist metadata (broken/partial vllm install)
+    # must not crash unsloth import; every other vllm probe here guards this too.
+    try:
+        vllm_version = importlib_version("vllm")
+    except Exception as e:
+        logger.info(f"Unsloth: Skipping vLLM aimv2 fix -- vLLM version unreadable ({e})")
+        return
     if Version(vllm_version) < Version("0.10.1"):
         vllm_location = spec.origin
         if vllm_location is None:
diff --git a/unsloth/models/loader_utils.py b/unsloth/models/loader_utils.py
index 7fd8cd66b4..e8d0fa657c 100644
--- a/unsloth/models/loader_utils.py
+++ b/unsloth/models/loader_utils.py
@@ -191,19 +191,43 @@ def _get_new_mapper():
             .replace("MAP_TO_UNSLOTH_16bit", "NEW_MAP_TO_UNSLOTH_16bit")
         )
 
-        exec(new_mapper, globals())
+        # Exec into a throwaway namespace, never globals(). The slice also carries
+        # FLOAT_TO_FP8_BLOCK_MAPPER / FLOAT_TO_FP8_ROW_MAPPER, the _add_* helpers
+        # and the builder's loop variables, so exec'ing into globals() would swap
+        # the FP8 tables this module imported from the installed mapper for the
+        # ones on GitHub main. This is only a probe for "would a newer Unsloth
+        # support this name?", so it must not change what the installed version
+        # resolves; the fetched FP8 tables are returned for the probe to use
+        # instead of being written over the installed ones.
+        namespace = {}
+        exec(new_mapper, namespace)
         return (
-            NEW_INT_TO_FLOAT_MAPPER,
-            NEW_FLOAT_TO_INT_MAPPER,
-            NEW_MAP_TO_UNSLOTH_16bit,
+            namespace["NEW_INT_TO_FLOAT_MAPPER"],
+            namespace["NEW_FLOAT_TO_INT_MAPPER"],
+            namespace["NEW_MAP_TO_UNSLOTH_16bit"],
+            # .get, not []: these two come from the fetched file under its own names (unlike
+            # the NEW_ names above, renamed here), so an older or renamed mapper.py would
+            # KeyError into the bare except and take the 4bit half of the probe down too.
+            # {} is safe: the probe runs only after the installed tables already missed.
+            namespace.get("FLOAT_TO_FP8_BLOCK_MAPPER", {}),
+            namespace.get("FLOAT_TO_FP8_ROW_MAPPER", {}),
         )
     except:
-        return {}, {}, {}
+        return {}, {}, {}, {}, {}
 
 
 def _resolve_with_mappers(
-    model_name, load_in_4bit, load_in_fp8, int_to_float, float_to_int, map_to_unsloth_16bit
+    model_name,
+    load_in_4bit,
+    load_in_fp8,
+    int_to_float,
+    float_to_int,
+    map_to_unsloth_16bit,
+    fp8_block = None,
+    fp8_row = None,
 ):
+    # fp8_block/fp8_row default to the installed tables; the newer-mapper probe passes the
+    # fetched ones so it can answer for new FP8 repos without rebinding the installed ones.
     return __get_model_name(
         model_name = model_name,
         load_in_4bit = load_in_4bit,
@@ -211,8 +235,8 @@ def _resolve_with_mappers(
         FLOAT_TO_INT_MAPPER = float_to_int,
         MAP_TO_UNSLOTH_16bit = map_to_unsloth_16bit,
         load_in_fp8 = load_in_fp8,
-        FLOAT_TO_FP8_BLOCK_MAPPER = FLOAT_TO_FP8_BLOCK_MAPPER,
-        FLOAT_TO_FP8_ROW_MAPPER = FLOAT_TO_FP8_ROW_MAPPER,
+        FLOAT_TO_FP8_BLOCK_MAPPER = FLOAT_TO_FP8_BLOCK_MAPPER if fp8_block is None else fp8_block,
+        FLOAT_TO_FP8_ROW_MAPPER = FLOAT_TO_FP8_ROW_MAPPER if fp8_row is None else fp8_row,
     )
 
 
@@ -252,9 +276,13 @@ def get_model_name(
         and not _env_says_offline()  # offline: skip the remote (raw GitHub) mapper refresh
     ):
         # Try checking if a new Unsloth version allows it!
-        NEW_INT_TO_FLOAT_MAPPER, NEW_FLOAT_TO_INT_MAPPER, NEW_MAP_TO_UNSLOTH_16bit = (
-            _get_new_mapper()
-        )
+        (
+            NEW_INT_TO_FLOAT_MAPPER,
+            NEW_FLOAT_TO_INT_MAPPER,
+            NEW_MAP_TO_UNSLOTH_16bit,
+            NEW_FP8_BLOCK_MAPPER,
+            NEW_FP8_ROW_MAPPER,
+        ) = _get_new_mapper()
         upgraded_model_name = _resolve_with_mappers(
             model_name = model_name,
             load_in_4bit = load_in_4bit,
@@ -262,6 +290,10 @@ def get_model_name(
             int_to_float = NEW_INT_TO_FLOAT_MAPPER,
             float_to_int = NEW_FLOAT_TO_INT_MAPPER,
             map_to_unsloth_16bit = NEW_MAP_TO_UNSLOTH_16bit,
+            # the fp8 probe has to look at the FETCHED tables too, or a new fp8 repo would
+            # miss both here and in the installed tables and skip the upgrade message
+            fp8_block = NEW_FP8_BLOCK_MAPPER,
+            fp8_row = NEW_FP8_ROW_MAPPER,
         )
         if upgraded_model_name is not None:
             raise NotImplementedError(
@@ -843,6 +875,55 @@ def _get_effective_local_files_only(kwargs):
     return _env_says_offline()
 
 
+# Attribute stamped on a tokenizer/processor that was loaded local-only, so a later
+# save still knows. transformers takes local_files_only as an explicit from_pretrained
+# parameter and never copies it into tokenizer.init_kwargs, and _offline_aware_load
+# restores the offline env vars when the load window closes, so without this stamp an
+# explicit local_files_only = True load is invisible by the time we save (issue #7481).
+_LOCAL_FILES_ONLY_ATTR = "_unsloth_local_files_only"
+# The load's cache_dir travels with it too: saving derives one from HF_HUB_CACHE /
+# HF_HOME, which does not see a caller-supplied cache.
+_LOADED_CACHE_DIR_ATTR = "_unsloth_loaded_cache_dir"
+
+
+def _mark_loaded_local_files_only(result, cache_dir = None):
+    """Stamp a load's local-only mode and cache_dir onto the returned objects."""
+    for obj in result if isinstance(result, (tuple, list)) else (result,):
+        try:
+            # A processor keeps the tokenizer that _has_tokenizer_model unwraps to,
+            # so stamp both (a wrapped model can raise from its own __getattr__).
+            targets = (obj, getattr(obj, "tokenizer", None))
+        except Exception:
+            targets = (obj,)
+        for target in targets:
+            if target is None:
+                continue
+            # Objects that reject new attributes (__slots__) are skipped.
+            try:
+                setattr(target, _LOCAL_FILES_ONLY_ATTR, True)
+                if cache_dir:
+                    setattr(target, _LOADED_CACHE_DIR_ATTR, str(cache_dir))
+            except Exception:
+                pass
+    return result
+
+
+def _tokenizer_cache_dir(tokenizer):
+    """The cache_dir the load used, when it was not the environment's."""
+    tokenizer = tokenizer.tokenizer if hasattr(tokenizer, "tokenizer") else tokenizer
+    return getattr(tokenizer, _LOADED_CACHE_DIR_ATTR, None)
+
+
+def _tokenizer_wants_local_only(tokenizer):
+    """True when Hub metadata probes should be skipped for this tokenizer."""
+    if _env_says_offline():
+        return True
+    if getattr(tokenizer, _LOCAL_FILES_ONLY_ATTR, False):
+        return True
+    init_kwargs = getattr(tokenizer, "init_kwargs", None) or {}
+    return bool(init_kwargs.get("local_files_only"))
+
+
 def _is_offline_related_error(exc):
     """True if exc (or its cause/context chain) is a lost-connection error, not a
     missing file. Plain FileNotFoundError propagates; LocalEntryNotFoundError is offline."""
@@ -1067,7 +1148,9 @@ def _offline_aware_load(fn):
         if _get_effective_local_files_only(kwargs):
             kwargs["local_files_only"] = True
             with _force_hf_offline():
-                return fn(*args, **kwargs)
+                # Stamp inside the window: the env vars are restored on exit, so the
+                # request has to travel on the objects themselves to reach saving.
+                return _mark_loaded_local_files_only(fn(*args, **kwargs), kwargs.get("cache_dir"))
         _pb_were_disabled = _progress_bars_were_disabled()  # restore before any retry
         try:
             return fn(*args, **kwargs)
@@ -1126,6 +1209,144 @@ def _has_local_processor_files(path):
     )
 
 
+def _resolve_hub_repo_local_dir(
+    repo_id,
+    *,
+    token = None,
+    cache_dir = None,
+    # Default closed: a "resolve local dir" helper must not download. False here
+    # means five filenames each retried with backoff before it gives up.
+    local_files_only = True,
+    filenames = (
+        "tokenizer_config.json",
+        "config.json",
+        "tokenizer.json",
+        "preprocessor_config.json",
+        "processor_config.json",
+    ),
+):
+    """Return a local snapshot directory for a Hub repo id when files are cached.
+
+    On transformers 4.57.2 through 5.5.4, ``PreTrainedTokenizerFast.from_pretrained``
+    on a repo id can still call ``model_info()`` when ``local_files_only=True`` and
+    no offline env var is set. Loading from the resolved snapshot dir avoids that
+    Hub probe. Upstream fixed this in transformers 5.6.0 (huggingface/transformers#43603);
+    this helper can be removed once the supported floor is past that version.
+    """
+    if not isinstance(repo_id, str) or not repo_id:
+        return None
+    if os.path.isdir(repo_id):
+        return repo_id
+    if cache_dir is None:
+        cache_dir = os.environ.get("HF_HUB_CACHE")
+    from huggingface_hub import hf_hub_download
+
+    for filename in filenames:
+        try:
+            path = hf_hub_download(
+                repo_id = repo_id,
+                filename = filename,
+                token = token,
+                cache_dir = cache_dir,
+                local_files_only = local_files_only,
+            )
+            if path and os.path.isfile(path):
+                return os.path.dirname(path)
+        except Exception:
+            continue
+    return None
+
+
+def _resolve_hub_repo_cached_file(
+    repo_id,
+    filename,
+    *,
+    token = None,
+    cache_dir = None,
+    local_files_only = True,
+):
+    """Return a cached file path under a Hub snapshot, or None if absent."""
+    local_dir = _resolve_hub_repo_local_dir(
+        repo_id,
+        token = token,
+        cache_dir = cache_dir,
+        local_files_only = local_files_only,
+        filenames = (filename,),
+    )
+    if local_dir is None:
+        return None
+    path = os.path.join(local_dir, filename)
+    return path if os.path.isfile(path) else None
+
+
+def _hub_repo_or_local_path(
+    repo_id,
+    *,
+    token = None,
+    cache_dir = None,
+    local_files_only = False,
+    filenames = None,
+):
+    """Prefer a cached snapshot path over a Hub repo id when offline or ``local_files_only``."""
+    if isinstance(repo_id, str) and os.path.isdir(repo_id):
+        return repo_id
+    lfo = bool(local_files_only) or _env_says_offline()
+    if not lfo:
+        return repo_id
+    local_dir = _resolve_hub_repo_local_dir(
+        repo_id,
+        token = token,
+        cache_dir = cache_dir,
+        local_files_only = True,
+        filenames = filenames
+        or (
+            "tokenizer_config.json",
+            "config.json",
+            "tokenizer.json",
+            "preprocessor_config.json",
+            "processor_config.json",
+        ),
+    )
+    return local_dir if local_dir is not None else repo_id
+
+
+def _load_pretrained_tokenizer_fast(
+    tokenizer_name,
+    *,
+    padding_side = "left",
+    token = None,
+    trust_remote_code = False,
+    cache_dir = None,
+    local_files_only = False,
+):
+    """Load ``PreTrainedTokenizerFast`` without Hub metadata probes when cached/offline.
+
+    Needed on transformers 4.57.2-5.5.4; redundant once the floor is past 5.6.0.
+    """
+    from transformers import PreTrainedTokenizerFast
+
+    lfo = bool(local_files_only) or _env_says_offline()
+    load_path = _hub_repo_or_local_path(
+        tokenizer_name,
+        token = token,
+        cache_dir = cache_dir,
+        local_files_only = lfo,
+        filenames = (
+            "tokenizer_config.json",
+            "tokenizer.json",
+            "tokenizer.model",
+        ),
+    )
+    return PreTrainedTokenizerFast.from_pretrained(
+        load_path,
+        padding_side = padding_side,
+        token = token,
+        trust_remote_code = trust_remote_code,
+        cache_dir = cache_dir,
+        local_files_only = lfo,
+    )
+
+
 def _resolve_checkpoint_tokenizer_name(
     old_model_name,
     kwargs,
diff --git a/unsloth/models/vision.py b/unsloth/models/vision.py
index dc8032e7ba..0d55f272e3 100644
--- a/unsloth/models/vision.py
+++ b/unsloth/models/vision.py
@@ -631,7 +631,9 @@ def unsloth_base_fast_generate(self, *args, **kwargs):
 # Offline helpers live in loader_utils.py (shared canonical source).
 from .loader_utils import (
     _get_effective_local_files_only,
+    _hub_repo_or_local_path,
     _is_offline_related_error,
+    _load_pretrained_tokenizer_fast,
     _offline_aware_load,
 )
 
@@ -667,20 +669,27 @@ def _construct_vlm_processor_fallback(
     tell an offline failure (retry from cache) from a genuine one."""
     _fb_err = None
     try:
-        from transformers import AutoImageProcessor, PreTrainedTokenizerFast, AutoConfig
+        from transformers import AutoImageProcessor, AutoConfig
         from transformers.models.auto.processing_auto import PROCESSOR_MAPPING_NAMES
         import json
 
+        load_path = _hub_repo_or_local_path(
+            tokenizer_name,
+            token = token,
+            cache_dir = cache_dir,
+            local_files_only = local_files_only,
+        )
         # Load image processor
         image_processor = AutoImageProcessor.from_pretrained(
-            tokenizer_name,
+            load_path,
             token = token,
             trust_remote_code = trust_remote_code,
             cache_dir = cache_dir,
             local_files_only = local_files_only,
         )
-        # Load tokenizer via PreTrainedTokenizerFast (bypasses tokenizer_class check)
-        tok = PreTrainedTokenizerFast.from_pretrained(
+        # Load tokenizer via PreTrainedTokenizerFast (bypasses tokenizer_class check).
+        # Resolve the cached snapshot first so transformers does not call model_info (#7481).
+        tok = _load_pretrained_tokenizer_fast(
             tokenizer_name,
             padding_side = "left",
             token = token,
@@ -740,7 +749,7 @@ def _construct_vlm_processor_fallback(
             # Try the top-level config.model_type which often has the processor mapping.
             try:
                 config = AutoConfig.from_pretrained(
-                    tokenizer_name,
+                    load_path,
                     token = token,
                     trust_remote_code = trust_remote_code,
                     cache_dir = cache_dir,
@@ -1653,9 +1662,15 @@ class FastBaseModel:
             # Last resort: AutoTokenizer, then PreTrainedTokenizerFast (raise on network failure to retry).
             def _last_resort_tokenizer(lfo):
                 from transformers import AutoTokenizer as _AutoTokenizer
+                load_path = _hub_repo_or_local_path(
+                    tokenizer_name,
+                    token = token,
+                    cache_dir = kwargs.get("cache_dir"),
+                    local_files_only = lfo,
+                )
                 try:
                     return _AutoTokenizer.from_pretrained(
-                        tokenizer_name,
+                        load_path,
                         padding_side = "left",
                         token = token,
                         trust_remote_code = trust_remote_code,
@@ -1663,8 +1678,7 @@ class FastBaseModel:
                         local_files_only = lfo,
                     )
                 except Exception:
-                    from transformers import PreTrainedTokenizerFast
-                    return PreTrainedTokenizerFast.from_pretrained(
+                    return _load_pretrained_tokenizer_fast(
                         tokenizer_name,
                         padding_side = "left",
                         token = token,
diff --git a/unsloth/save.py b/unsloth/save.py
index 30ea18b066..9bd13bb4d5 100644
--- a/unsloth/save.py
+++ b/unsloth/save.py
@@ -52,7 +52,12 @@ import traceback
 import psutil
 import re
 from transformers.models.llama.modeling_llama import logger
-from .models.loader_utils import get_model_name
+from .models.loader_utils import (
+    get_model_name,
+    _resolve_hub_repo_cached_file,
+    _tokenizer_cache_dir,
+    _tokenizer_wants_local_only,
+)
 from .models._utils import _convert_torchao_model
 from .ollama_template_mappers import OLLAMA_TEMPLATES, MODEL_TO_OLLAMA_TEMPLATE_MAPPER
 from transformers import ProcessorMixin, PreTrainedTokenizerBase
@@ -446,6 +451,27 @@ def _has_tokenizer_model(tokenizer, token = None):
     if source in _TOKENIZER_MODEL_CACHE:
         return _TOKENIZER_MODEL_CACHE[source]
 
+    # Hub repo id: probe local cache before model_info (issue #7481).
+    cache_dir = _tokenizer_cache_dir(tokenizer) or os.environ.get("HF_HUB_CACHE")
+    if not cache_dir:
+        hf_home = os.environ.get("HF_HOME")
+        if hf_home:
+            cache_dir = os.path.join(hf_home, "hub")
+
+    cached_path = _resolve_hub_repo_cached_file(
+        source,
+        "tokenizer.model",
+        token = token,
+        local_files_only = True,
+        cache_dir = cache_dir,
+    )
+    if cached_path is not None:
+        _TOKENIZER_MODEL_CACHE[source] = True
+        return True
+
+    if _tokenizer_wants_local_only(tokenizer):
+        return False
+
     try:
         repo_info = HfApi(token = token).model_info(source, files_metadata = False)
     except Exception:
@@ -505,15 +531,33 @@ def _preserve_sentencepiece_tokenizer_assets(
                 if os.path.isfile(local_path):
                     downloaded_path = local_path
             else:
-                from huggingface_hub import hf_hub_download
-                try:
-                    downloaded_path = hf_hub_download(
-                        repo_id = source,
-                        filename = "tokenizer.model",
-                        token = token,
-                    )
-                except Exception:
-                    downloaded_path = None
+                cache_dir = _tokenizer_cache_dir(tokenizer) or os.environ.get("HF_HUB_CACHE")
+                if not cache_dir:
+                    hf_home = os.environ.get("HF_HOME")
+                    if hf_home:
+                        cache_dir = os.path.join(hf_home, "hub")
+
+                cached_path = _resolve_hub_repo_cached_file(
+                    source,
+                    "tokenizer.model",
+                    token = token,
+                    local_files_only = True,
+                    cache_dir = cache_dir,
+                )
+                if cached_path is not None:
+                    downloaded_path = cached_path
+                else:
+                    from huggingface_hub import hf_hub_download
+                    try:
+                        downloaded_path = hf_hub_download(
+                            repo_id = source,
+                            filename = "tokenizer.model",
+                            token = token,
+                            local_files_only = _tokenizer_wants_local_only(tokenizer),
+                            cache_dir = cache_dir,
+                        )
+                    except Exception:
+                        downloaded_path = None
 
     if not os.path.isfile(tokenizer_model) and downloaded_path is not None:
         shutil.copy2(downloaded_path, tokenizer_model)
@@ -3793,7 +3837,12 @@ def unsloth_convert_lora_to_ggml_and_save_locally(
     return _unsloth_save_lora_gguf(self, tokenizer, save_directory, outtype = outtype)
 
 
-from .models.loader_utils import get_model_name
+from .models.loader_utils import (
+    get_model_name,
+    _resolve_hub_repo_cached_file,
+    _tokenizer_cache_dir,
+    _tokenizer_wants_local_only,
+)
 from unsloth_zoo.saving_utils import (
     merge_and_overwrite_lora,
     prepare_saving,
diff --git a/unsloth_cli/_inference.py b/unsloth_cli/_inference.py
index 3ad901542c..43268423c6 100644
--- a/unsloth_cli/_inference.py
+++ b/unsloth_cli/_inference.py
@@ -61,15 +61,20 @@ def ensure_studio_backend_path() -> None:
 def configure_quiet_logging() -> None:
     import logging
 
-    import structlog
-
     # The CLI never configures structlog, so without this every backend INFO
     # line prints. LOG_LEVEL is exported so the worker subprocess inherits it.
     level_name = os.environ.setdefault("LOG_LEVEL", "WARNING").upper()
     level = getattr(logging, level_name, logging.WARNING)
-    structlog.configure(wrapper_class = structlog.make_filtering_bound_logger(level))
     os.environ.setdefault("HF_HUB_DISABLE_PROGRESS_BARS", "1")
 
+    # Quieting logs must not fail a command before the import that really needs
+    # structlog gets to report itself.
+    try:
+        import structlog
+    except ModuleNotFoundError:
+        return
+    structlog.configure(wrapper_class = structlog.make_filtering_bound_logger(level))
+
 
 def _parse_nonnegative_int(value: Optional[str]) -> Optional[int]:
     if value is None:
@@ -433,7 +438,9 @@ def load_chat_backend(
     fresh_backend uses a private orchestrator so a second model (compare's
     base column) can run alongside the main one.
     """
-    with quiet_if_nonzero_mlx_rank():
+    from unsloth_cli._studio_deps import studio_backend_imports
+
+    with studio_backend_imports("unsloth inference", studio_only = True), quiet_if_nonzero_mlx_rank():
         is_mlx_distributed, rank, _world_size = mlx_distributed_info()
         if model_config is None:
             model_config = resolve_model_config(model, hf_token = hf_token)
diff --git a/unsloth_cli/_studio_deps.py b/unsloth_cli/_studio_deps.py
new file mode 100644
index 0000000000..fa02aabefc
--- /dev/null
+++ b/unsloth_cli/_studio_deps.py
@@ -0,0 +1,255 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Studio dependency checks shared by the CLI commands.
+
+The wheel ships studio/ and studio.backend*, so train / export / chat /
+inference / studio all work after a plain `pip install unsloth` right up to the
+point they import the backend. studio_backend_imports() turns the resulting
+traceback into one sentence and the two commands that fix it.
+
+Also loads studio/install_manifest.py for `unsloth studio verify-install`.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import importlib.util
+import inspect
+import re
+import sys
+from pathlib import Path
+from typing import Dict, Iterable, List, Optional, Sequence
+
+import typer
+
+# One parent up is the package root: site-packages, or the repo root if editable.
+_PACKAGE_ROOT = Path(__file__).resolve().parent.parent
+
+_MANIFEST_MODULE = None
+_MANIFEST_LOADED = False
+
+
+def _manifest_candidates(extra_roots: Sequence[Path] = ()) -> Iterable[Path]:
+    yield _PACKAGE_ROOT / "studio" / "install_manifest.py"
+    roots: List[Path] = [Path(sys.prefix), *extra_roots]
+    for root in roots:
+        for pattern in (
+            "lib/python*/site-packages/studio/install_manifest.py",
+            "Lib/site-packages/studio/install_manifest.py",
+        ):
+            yield from root.glob(pattern)
+
+
+def load_install_manifest_module(extra_roots: Sequence[Path] = ()):
+    """Load studio/install_manifest.py by file path, or None if unavailable.
+
+    By path for the same reason as studio.backend.run: a partial
+    site-packages/studio/ tree can shadow an editable install, which is exactly
+    what this check exists to detect.
+    """
+    global _MANIFEST_MODULE, _MANIFEST_LOADED
+    if _MANIFEST_LOADED:
+        return _MANIFEST_MODULE
+
+    _MANIFEST_LOADED = True
+    for path in _manifest_candidates(extra_roots):
+        if not path.is_file():
+            continue
+        spec = importlib.util.spec_from_file_location("studio.install_manifest", path)
+        if spec is None or spec.loader is None:
+            continue
+        module = importlib.util.module_from_spec(spec)
+        try:
+            spec.loader.exec_module(module)
+        except Exception:
+            continue
+        _MANIFEST_MODULE = module
+        return _MANIFEST_MODULE
+    return None
+
+
+def _venv_root_for_module(module) -> Optional[Path]:
+    """Prefix owning a manifest module, which may be a venv other than ours."""
+    path = Path(getattr(module, "__file__", "") or "")
+    for parent in path.parents:
+        if (parent / "pyvenv.cfg").is_file():
+            return parent
+    return None
+
+
+def _canonical(name: str) -> str:
+    """PEP 503 normalisation, so PyJWT / pyjwt / py_jwt compare equal."""
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def _resolved(path: Path) -> Path:
+    try:
+        return path.resolve()
+    except OSError:
+        return path
+
+
+def _venv_site_packages(root: Path) -> List[Path]:
+    out: List[Path] = []
+    for pattern in ("lib/python*/site-packages", "Lib/site-packages"):
+        out.extend(sorted(root.glob(pattern)))
+    return out
+
+
+def _managed_root(extra_roots: Sequence[Path]) -> Optional[Path]:
+    """A requested venv that is not the one this CLI runs in.
+
+    The wheel ships studio/, so a CLI installed outside the managed venv always
+    finds its own copy of the helper first; without this it would then verify
+    its own prefix instead of the venv it was asked about.
+    """
+    running = _resolved(Path(sys.prefix))
+    for root in extra_roots:
+        if (root / "pyvenv.cfg").is_file() and _resolved(root) != running:
+            return root
+    return None
+
+
+def _distributions_in(root: Path) -> Optional[Dict[str, str]]:
+    """Canonical distribution name -> version inside another venv.
+
+    importlib.metadata reports the running interpreter only, so a foreign
+    site-packages has to be handed to the finder explicitly.
+    """
+    paths = [str(path) for path in _venv_site_packages(root)]
+    if not paths:
+        return None
+    from importlib.metadata import Distribution, DistributionFinder
+
+    found: Dict[str, str] = {}
+    try:
+        for dist in Distribution.discover(context = DistributionFinder.Context(path = paths)):
+            name = getattr(dist, "name", None) or dist.metadata["Name"]
+            if name:
+                found.setdefault(_canonical(name), dist.version or "")
+    except Exception:
+        return None
+    return found
+
+
+def _requirements_root_in(root: Path) -> Optional[Path]:
+    for path in _venv_site_packages(root):
+        reqs = path / "studio" / "backend" / "requirements"
+        if reqs.is_dir():
+            return reqs
+    return None
+
+
+def _supports_foreign_root(module) -> bool:
+    """A manifest helper predating the installed= parameter cannot describe another venv."""
+    try:
+        return "installed" in inspect.signature(module.verify_install).parameters
+    except (TypeError, ValueError):
+        return False
+
+
+def install_state(extra_roots: Sequence[Path] = ()) -> dict:
+    """verify_install() result, or incomplete when the helper cannot be loaded.
+
+    studio/install_manifest.py ships in the same wheel as this file, so a tree
+    that has one without the other is a torn install, not an old one: a CLI
+    predating both never reaches this code, and the desktop already calls it
+    stale on desktop_manageability_version. Answering yes here would launch a
+    backend whose own files may be just as absent.
+    """
+    module = load_install_manifest_module(extra_roots)
+    if module is None:
+        return {
+            "ok": False,
+            "manifest_ok": False,
+            "deps_ok": False,
+            "missing": [],
+            "reason": "studio_install_manifest_missing",
+        }
+    # The requested managed venv is the subject, even though the helper above
+    # came from this CLI's own tree.
+    root = _managed_root(extra_roots) or _venv_root_for_module(module)
+    foreign = root is not None and _resolved(root) != _resolved(Path(sys.prefix))
+    installed = _distributions_in(root) if foreign else None
+    req_root = _requirements_root_in(root) if foreign else None
+    try:
+        if installed is not None and req_root is not None and _supports_foreign_root(module):
+            # That venv's own metadata: unreadable through this interpreter.
+            return module.verify_install(root = root, req_root = req_root, installed = installed)
+        state = module.verify_install(root = root)
+        if foreign and not state["deps_ok"]:
+            # The manifest came from another venv but the dependency walk ran
+            # here, so it says nothing about that venv.
+            state = dict(state, deps_ok = True, missing = [])
+            state["ok"] = state["manifest_ok"]
+            state["reason"] = None if state["ok"] else state["reason"]
+        return state
+    except Exception as exc:
+        return {
+            "ok": False,
+            "manifest_ok": False,
+            "deps_ok": False,
+            "missing": [],
+            "reason": f"studio_install_check_failed:{type(exc).__name__}",
+        }
+
+
+def _missing_studio_packages() -> List[str]:
+    """Studio packages studio.txt asks for and the venv does not have."""
+    module = load_install_manifest_module()
+    if module is None:
+        return []
+    try:
+        return list(module.missing_requirements())
+    except Exception:
+        return []
+
+
+# studio.txt names distributions, ModuleNotFoundError names the import. Only
+# pairs differing by more than PEP 503 normalisation need an entry, and each
+# import name below is itself a real but unrelated PyPI project.
+_IMPORT_TO_DISTRIBUTION = {
+    "jwt": "pyjwt",
+    "docx": "python-docx",
+    "fitz": "pymupdf",
+}
+
+
+@contextlib.contextmanager
+def studio_backend_imports(feature: str = "This command", *, studio_only: bool = False):
+    """Report a missing dependency as a message instead of a traceback.
+
+    Only ModuleNotFoundError is intercepted; any other ImportError from the
+    backend is a real bug and keeps its traceback.
+    """
+    try:
+        yield
+    except ModuleNotFoundError as exc:
+        studio_missing = _missing_studio_packages()
+        # The failed import may not be a studio dependency at all: `train`
+        # reaches torch through the same wrapper, so only offer the extra when
+        # it helps.
+        trigger = exc.name or ""
+        # Match on the owning distribution, never the import: `pip install jwt`
+        # (or fastmcp.server) installs the wrong thing or nothing at all.
+        top = trigger.split(".", 1)[0]
+        needed = _IMPORT_TO_DISTRIBUTION.get(top, top)
+        wanted = _canonical(needed)
+        from_studio = not trigger or any(_canonical(name) == wanted for name in studio_missing)
+        if studio_only and not from_studio:
+            raise
+        typer.echo(
+            f"Error: {feature} needs {needed or 'a dependency'}, which is not installed.",
+            err = True,
+        )
+        others = [name for name in studio_missing if _canonical(name) != wanted]
+        if others:
+            typer.echo(f"  also missing: {', '.join(others)}", err = True)
+        typer.echo("", err = True)
+        if not from_studio:
+            typer.echo(f"  Install it:      pip install {needed}", err = True)
+        if from_studio or others:
+            typer.echo("  Studio install:  unsloth studio update", err = True)
+            typer.echo('  Plain pip:       pip install "unsloth[studio]"', err = True)
+        raise typer.Exit(code = 1) from None
diff --git a/unsloth_cli/claude_subagent_mcp.py b/unsloth_cli/claude_subagent_mcp.py
index e044d78705..b66d3c7ab9 100644
--- a/unsloth_cli/claude_subagent_mcp.py
+++ b/unsloth_cli/claude_subagent_mcp.py
@@ -29,6 +29,10 @@ from unsloth_cli.commands.start import (
 _MAX_RESULT_CHARACTERS = 100_000
 _CANCEL_POLL_SECONDS = 0.1
 _CANCEL_GRACE_SECONDS = 2.0
+# A local server that accepts the connection and then never answers leaves the
+# child, and the parent waiting on it, blocked forever. Generous enough not to cut
+# a long legitimate run short; 0 restores the unbounded wait.
+_DEFAULT_TIMEOUT_SECONDS = 1800.0
 
 
 def _required_env(name: str) -> str:
@@ -38,6 +42,18 @@ def _required_env(name: str) -> str:
     return value
 
 
+def _timeout_seconds() -> float:
+    """Wall-clock cap on one child run; 0 or unparsable means wait forever."""
+    raw = os.environ.get("UNSLOTH_CLAUDE_SUBAGENT_TIMEOUT")
+    if raw is None or not raw.strip():
+        return _DEFAULT_TIMEOUT_SECONDS
+    try:
+        parsed = float(raw.strip())
+    except ValueError:
+        return _DEFAULT_TIMEOUT_SECONDS
+    return parsed if parsed > 0 else 0.0
+
+
 def _bounded(text: str) -> str:
     if len(text) <= _MAX_RESULT_CHARACTERS:
         return text
@@ -153,6 +169,17 @@ def run_local_agent(
         "--output-format",
         "json",
         "--no-session-persistence",
+        # Strip human-blocking tools so the child runs unattended. Only the read-only
+        # child's writers bite today, since a --print child is never offered the plan
+        # or prompt tools; those are listed anyway so a version that starts offering
+        # them cannot stall the subagent. Bash is denied read-only side because plan
+        # mode gates it through the same local model, which is not a write barrier.
+        "--disallowedTools",
+        (
+            "AskUserQuestion,EnterPlanMode,Edit,Write,NotebookEdit,Bash"
+            if read_only
+            else "AskUserQuestion,EnterPlanMode,ExitPlanMode"
+        ),
         "--append-system-prompt",
         _SUBAGENT_PLAN_INSTRUCTIONS if read_only else _SUBAGENT_INSTRUCTIONS,
         f"Task: {task}",
@@ -185,6 +212,8 @@ def run_local_agent(
         [executable, *command[1:]],
         **popen_kwargs,
     )
+    deadline = _timeout_seconds()
+    started_at = time.monotonic()
     try:
         while True:
             try:
@@ -194,6 +223,13 @@ def run_local_agent(
                 if cancel_event.is_set():
                     _stop_child(process)
                     raise RuntimeError("The local Claude agent was cancelled.")
+                waited = time.monotonic() - started_at
+                if deadline and waited > deadline:
+                    _stop_child(process)
+                    raise RuntimeError(
+                        f"The local Claude agent produced nothing after {waited:.0f}s. "
+                        "The local server is likely wedged; check that a model is loaded."
+                    )
     except BaseException:
         if process.poll() is None:
             _stop_child(process)
diff --git a/unsloth_cli/commands/export.py b/unsloth_cli/commands/export.py
index a72ceb5f27..651657abc6 100644
--- a/unsloth_cli/commands/export.py
+++ b/unsloth_cli/commands/export.py
@@ -6,6 +6,8 @@ from typing import Optional
 
 import typer
 
+from unsloth_cli._studio_deps import studio_backend_imports
+
 
 EXPORT_FORMATS = ["merged-16bit", "merged-4bit", "gguf", "lora"]
 GGUF_QUANTS = ["q4_k_m", "q5_k_m", "q8_0", "f16"]
@@ -17,7 +19,8 @@ def list_checkpoints(
     ),
 ):
     """List checkpoints detected in the outputs directory."""
-    from studio.backend.core.export import ExportBackend
+    with studio_backend_imports("unsloth list-checkpoints"):
+        from studio.backend.core.export import ExportBackend
 
     backend = ExportBackend()
     checkpoints = backend.scan_checkpoints(outputs_dir = str(outputs_dir))
@@ -72,7 +75,8 @@ def export(
         typer.echo("Error: --repo-id required when using --push-to-hub", err = True)
         raise typer.Exit(code = 2)
 
-    from studio.backend.core.export import ExportBackend
+    with studio_backend_imports("unsloth export"):
+        from studio.backend.core.export import ExportBackend
 
     backend = ExportBackend()
 
diff --git a/unsloth_cli/commands/start.py b/unsloth_cli/commands/start.py
index 079c7850e5..c702b90748 100644
--- a/unsloth_cli/commands/start.py
+++ b/unsloth_cli/commands/start.py
@@ -4,7 +4,9 @@
 """`unsloth start` — launch a coding agent against a running Unsloth server."""
 
 import atexit
+import base64
 import contextlib
+import errno
 import json
 import os
 import re
@@ -19,7 +21,7 @@ import time
 import urllib.error
 import urllib.request
 from pathlib import Path
-from typing import NamedTuple, NoReturn, Optional
+from typing import Literal, NamedTuple, NoReturn, Optional
 from urllib.parse import urlencode, urlparse
 
 import click
@@ -101,6 +103,8 @@ _CODEX_SUBAGENT_MCP_SERVER = "unsloth_local_agent"
 _CODEX_SUBAGENT_MCP_TOOL = "spawn_local_agent"
 _CODEX_SUBAGENT_CONFIG_ENV = "UNSLOTH_CODEX_SUBAGENT_CONFIG"
 _CODEX_PARENT_OVERLAY_MANIFEST = ".unsloth-parent-overlay.json"
+_CODEX_EPHEMERAL_STALE_SECONDS = 24 * 60 * 60
+_CODEX_EPHEMERAL_HEARTBEAT_SECONDS = 60
 _CODEX_SUBAGENT_TOOL_DESCRIPTION = (
     f"{_SUBAGENT_DESCRIPTION} Use this tool instead of the built-in spawn_agent tool for those "
     "requests. Other subagent requests may use the built-in tools normally."
@@ -182,6 +186,17 @@ _TENSOR_PARALLEL_OPTION = typer.Option(
     rich_help_panel = _PANEL_MODEL,
     help = "Split a GGUF across GPUs by tensor instead of by layer (multi-GPU only).",
 )
+_GPU_MEMORY_MODE_OPTION = typer.Option(
+    None,
+    "--gpu-memory-mode",
+    rich_help_panel = _PANEL_MODEL,
+    help = (
+        "GPU memory strategy for GGUF models loaded by this command. Auto lets "
+        "Unsloth manage placement. Manual with default layers and context delegates "
+        "placement and sizing to llama.cpp --fit. Omit when attaching to preserve "
+        "the running model's mode."
+    ),
+)
 
 # Server knobs. Only used when `unsloth start` auto-starts the server (--serve);
 # they have no effect when attaching to a server someone else already started.
@@ -213,6 +228,16 @@ _TOOL_CALL_NUDGING_OPTION = typer.Option(
     help = "Retry once with a nudge when a non-streaming passthrough tool call can't be healed. "
     "On by default; when the flag is omitted an inherited UNSLOTH_TOOL_CALL_NUDGE is kept.",
 )
+_REASONING_OPTION = typer.Option(
+    None,
+    "--reasoning",
+    rich_help_panel = _PANEL_SERVER,
+    help = (
+        "llama-server reasoning mode for an auto-started coding-agent server. "
+        "Defaults to off so tool calls stay in the structured tool channel; use "
+        "'auto' or 'on' to opt back into model reasoning."
+    ),
+)
 # Sampling overrides pin a value on the auto-started server (winning over the client and the
 # per-model recommendation). Default unset -> the model's recommended sampling is used.
 _TEMPERATURE_OPTION = typer.Option(
@@ -458,6 +483,7 @@ class LoadOptions(NamedTuple):
     max_seq_length: int = 0
     load_in_4bit: bool = True
     tensor_parallel: bool = False
+    gpu_memory_mode: Optional[Literal["auto", "manual"]] = None
 
 
 class ServerOptions(NamedTuple):
@@ -466,6 +492,7 @@ class ServerOptions(NamedTuple):
     enable_tools: bool = False
     tool_call_healing: Optional[bool] = None
     tool_call_nudging: Optional[bool] = None
+    reasoning: Optional[Literal["on", "off", "auto"]] = None
     temperature: Optional[float] = None
     top_p: Optional[float] = None
     top_k: Optional[int] = None
@@ -992,6 +1019,8 @@ def _start_studio_server(
         command += ["--no-load-in-4bit"]
     if load.tensor_parallel:
         command += ["--tensor-parallel"]
+    if load.gpu_memory_mode is not None:
+        command += ["--gpu-memory-mode", load.gpu_memory_mode]
 
     log_path = Path(tempfile.gettempdir()) / f"unsloth-start-server-{os.getpid()}.log"
     typer.echo("Starting Unsloth server")
@@ -1005,6 +1034,10 @@ def _start_studio_server(
     # Own session/process group so a mid-session Ctrl+C (cancel a turn) doesn't reach the
     # server. It survives a successful agent session; torn down on startup/launch failure.
     child_env = os.environ.copy()
+    # Current llama-server versions read this documented env equivalent of --reasoning.
+    # Older managed versions ignore an unknown env variable instead of failing startup on
+    # an unknown passthrough CLI flag. An omitted start option still defaults to off.
+    child_env["LLAMA_ARG_REASONING"] = server.reasoning or "off"
     # Pass the marker via env so an older launcher ignores it instead of treating an
     # unknown CLI flag as a llama-server arg; new launchers preserve it across re-exec.
     child_env[_START_API_KEY_MARKER_ENV] = "1"
@@ -1144,6 +1177,14 @@ def _require_studio(
                 "and re-run to apply them.",
                 err = True,
             )
+        if server_options.reasoning is not None:
+            typer.echo(
+                f"Warning: an Unsloth server is already running at {base}; "
+                f"--reasoning {server_options.reasoning} applies only when this command starts "
+                "the server, so the running server keeps its current reasoning mode. Stop it "
+                "with `unsloth studio stop` and re-run to apply the override.",
+                err = True,
+            )
         return base, None
     expected = os.environ.get("UNSLOTH_STUDIO_URL", "http://127.0.0.1:8888").rstrip("/")
     # Auto-start a local server only for an interactive launch with a model to serve, and
@@ -1462,7 +1503,11 @@ def _resolve_model(
     # without reloading when the variant AND settings match, so a second session running
     # the same command still attaches without evicting the first.
     load_has_overrides = bool(
-        load.gguf_variant or load.max_seq_length or not load.load_in_4bit or load.tensor_parallel
+        load.gguf_variant
+        or load.max_seq_length
+        or not load.load_in_4bit
+        or load.tensor_parallel
+        or load.gpu_memory_mode is not None
     )
     # /v1/models also lists cached-but-unloaded catalog entries (loaded == False);
     # matching one would skip /api/inference/load and leave the agent pointed at a
@@ -1516,6 +1561,10 @@ def _resolve_model(
             payload["load_in_4bit"] = False
         if load.tensor_parallel:
             payload["tensor_parallel"] = True
+        if load.gpu_memory_mode is not None:
+            payload["gpu_memory_mode"] = load.gpu_memory_mode
+            if load.gpu_memory_mode == "manual":
+                payload["gpu_layers"] = -1
         loaded = _load_model_with_progress(base, key, requested, load, payload)
         if loaded.get("status") == "already_loaded":
             typer.echo(f"Reusing loaded model: {_display_model_spec(requested, load.gguf_variant)}")
@@ -2052,6 +2101,32 @@ def _opencode_subagent_inline_config(path: Path, permission: dict) -> dict:
     return inline
 
 
+def _b64_path(path: Path) -> str:
+    """Path as base64, so it can cross a shell without being expanded."""
+    return base64.b64encode(str(path).encode("utf-8")).decode("ascii")
+
+
+_CLAUDE_PLAN_GATE_SCRIPT = '''\
+"""Deny the editing agent while the parent session is in plan mode."""
+import json, sys
+
+try:
+    mode = (json.load(sys.stdin) or {}).get("permission_mode")
+except Exception:
+    sys.exit(0)  # fail open: a hook error must never block the parent session
+if mode == "plan":
+    print(json.dumps({"hookSpecificOutput": {
+        "hookEventName": "PreToolUse",
+        "permissionDecision": "deny",
+        "permissionDecisionReason": (
+            "Plan mode is active. Call the read-only Unsloth plan agent "
+            "(unsloth_plan_agent) instead of unsloth_agent."
+        ),
+    }}))
+sys.exit(0)
+'''
+
+
 def write_claude_subagent_plugin(path: Path, server_env: dict) -> Path:
     """Write a session plugin that exposes the local Claude child through MCP."""
     plugin = path / "unsloth-local-agent"
@@ -2094,6 +2169,52 @@ def write_claude_subagent_plugin(path: Path, server_env: dict) -> Path:
             }
         },
     )
+    # Claude already refuses the editing tool in plan mode, since it advertises
+    # readOnlyHint false. This PreToolUse hook replaces that dead end with a reason
+    # naming the read-only tool to call instead. Skipped under the WSL bridge, where
+    # the gate is a Linux path but the hook would run beside the Windows claude.
+    gate = plugin / "hooks" / "plan_gate.py"
+    if command == "wsl.exe":
+        # A persisted plugin dir may still hold a gate from an earlier non-WSL run.
+        for stale in (gate, plugin / "hooks" / "hooks.json"):
+            stale.unlink(missing_ok = True)
+    else:
+        _write_private_text(gate, _CLAUDE_PLAN_GATE_SCRIPT)
+        _write_private_json(
+            plugin / "hooks" / "hooks.json",
+            {
+                "hooks": {
+                    "PreToolUse": [
+                        {
+                            "matcher": _CLAUDE_SUBAGENT_TOOL,
+                            "hooks": [
+                                {
+                                    "type": "command",
+                                    # Run through runpy rather than handing the path to
+                                    # the interpreter: a missing gate is then an
+                                    # ordinary traceback (exit 1, fails open) instead
+                                    # of exit 2, which Claude treats as a blocking
+                                    # error and would deny the tool in every mode.
+                                    # The path is base64'd because this string goes
+                                    # through a shell: a temp root holding $(..) or a
+                                    # backtick expands under sh, %VAR% under cmd, and
+                                    # the gate then silently fails open. base64's
+                                    # alphabet has no metacharacter in either.
+                                    "command": (
+                                        f'"{sys.executable}" -c '
+                                        f'"import base64,runpy; runpy.run_path('
+                                        f"base64.b64decode('{_b64_path(gate)}').decode())\""
+                                    ),
+                                    # A hook with no timeout stalls the parent for as
+                                    # long as it hangs; measured unbounded past 400s.
+                                    "timeout": 10,
+                                }
+                            ],
+                        }
+                    ]
+                }
+            },
+        )
     skill = plugin / "skills" / "local-agent" / "SKILL.md"
     skill.parent.mkdir(parents = True, exist_ok = True, mode = 0o700)
     skill.write_text(
@@ -2562,6 +2683,147 @@ def _agents_config_root() -> Path:
     return auth_root() / "agents"
 
 
+def _ephemeral_session_parent(agent: str) -> Optional[Path]:
+    """Return a non-system-temp parent when an agent needs one."""
+    if os.name != "nt" or agent != "codex":
+        return None
+    # Codex creates a deeply nested curated-plugin checkout below CODEX_HOME.
+    # A normal %TEMP%\unsloth-codex-* home can exceed legacy Windows path
+    # limits during startup, and Codex also refuses to create its PATH helpers
+    # below the system temp directory. Keep the throwaway home short but still
+    # private to the current user; _session_config removes it on exit.
+    root = Path.home() / ".unsloth" / ".tmp"
+    root.mkdir(parents = True, exist_ok = True, mode = 0o700)
+    return root
+
+
+def _ephemeral_session_prefix(agent: str, parent: Optional[Path]) -> str:
+    """Return the platform-specific prefix for an ephemeral agent home."""
+    return "u-codex-" if agent == "codex" and parent is not None else f"unsloth-{agent}-"
+
+
+@contextlib.contextmanager
+def _locked_file(path: Path, blocking: bool = True):
+    """Yield whether an advisory lock was acquired for the first byte of path."""
+    handle = path.open("a+b")
+    acquired = False
+    try:
+        if os.name == "nt":
+            import msvcrt
+
+            handle.seek(0, os.SEEK_END)
+            if handle.tell() == 0:
+                handle.write(b"\0")
+                handle.flush()
+            handle.seek(0)
+            while True:
+                try:
+                    msvcrt.locking(handle.fileno(), msvcrt.LK_NBLCK, 1)
+                    acquired = True
+                    break
+                except OSError as exc:
+                    if exc.errno not in (errno.EACCES, errno.EAGAIN, errno.EDEADLK):
+                        raise
+                    if not blocking:
+                        break
+                    # LK_LOCK gives up after roughly ten seconds. Poll LK_NBLCK
+                    # instead so a large stale plugin checkout cannot make a
+                    # concurrent launch fail just because cleanup takes longer.
+                    time.sleep(0.05)
+        else:
+            import fcntl
+            mode = fcntl.LOCK_EX | (0 if blocking else fcntl.LOCK_NB)
+            try:
+                fcntl.flock(handle.fileno(), mode)
+                acquired = True
+            except BlockingIOError:
+                acquired = False
+        yield acquired
+    finally:
+        if acquired:
+            if os.name == "nt":
+                handle.seek(0)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+            else:
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+        handle.close()
+
+
+def _reclaim_stale_ephemeral_sessions(parent: Path) -> None:
+    """Remove abandoned short Codex homes while preserving locked live sessions."""
+    for path in parent.glob("u-codex-*"):
+        if not path.is_dir():
+            continue
+        active_lock = path / ".active.lock"
+        try:
+            modified = active_lock.stat().st_mtime if active_lock.exists() else path.stat().st_mtime
+        except FileNotFoundError:
+            continue
+        # The wrapper owns the advisory lock, not the Codex child. If only the
+        # wrapper is killed, its child may still be using CODEX_HOME; give that
+        # process a full day to finish before treating the unlocked home as stale.
+        if time.time() - modified < _CODEX_EPHEMERAL_STALE_SECONDS:
+            continue
+        try:
+            with _locked_file(active_lock, blocking = False) as stale:
+                pass
+        except FileNotFoundError:
+            # A normally exiting session may have removed itself after the glob.
+            continue
+        if stale:
+            shutil.rmtree(path, ignore_errors = True)
+
+
+def _refresh_ephemeral_session_marker(path: Path, stop: threading.Event) -> None:
+    """Keep the stale grace period relative to wrapper death, not session start."""
+    while not stop.wait(_CODEX_EPHEMERAL_HEARTBEAT_SECONDS):
+        with contextlib.suppress(OSError):
+            os.utime(path, None)
+
+
+@contextlib.contextmanager
+def _short_ephemeral_session(parent: Path):
+    """Create a short Codex home whose lock makes crash cleanup concurrency-safe."""
+    path = None
+    active_lock = contextlib.ExitStack()
+    heartbeat_stop = None
+    heartbeat = None
+    try:
+        with _locked_file(parent / ".cleanup.lock") as cleanup_lock:
+            if not cleanup_lock:  # The blocking acquisition should always succeed.
+                raise RuntimeError(f"Could not lock ephemeral session root: {parent}")
+            _reclaim_stale_ephemeral_sessions(parent)
+            path = Path(tempfile.mkdtemp(prefix = "u-codex-", dir = parent))
+            locked = active_lock.enter_context(_locked_file(path / ".active.lock"))
+            if not locked:
+                raise RuntimeError(f"Could not lock ephemeral session home: {path}")
+            heartbeat_stop = threading.Event()
+            heartbeat = threading.Thread(
+                target = _refresh_ephemeral_session_marker,
+                args = (path / ".active.lock", heartbeat_stop),
+                name = "unsloth-codex-home-heartbeat",
+                daemon = True,
+            )
+            heartbeat.start()
+        yield path
+    finally:
+        if heartbeat_stop is not None:
+            heartbeat_stop.set()
+        if heartbeat is not None:
+            heartbeat.join(timeout = 1)
+        try:
+            with _locked_file(parent / ".cleanup.lock") as cleanup_lock:
+                if not cleanup_lock:  # The blocking acquisition should always succeed.
+                    raise RuntimeError(f"Could not lock ephemeral session root: {parent}")
+                # Release the live marker only after deletion is serialized with
+                # startup scavenging, so no scanner can race this rmtree.
+                active_lock.close()
+                if path is not None:
+                    shutil.rmtree(path, ignore_errors = True)
+        finally:
+            active_lock.close()
+
+
 @contextlib.contextmanager
 def _session_config(
     agent: str,
@@ -2577,11 +2839,16 @@ def _session_config(
     resumed next time. Either way the user's real ~/.<agent> config is left untouched.
     """
     if launch and not persist:
-        path = Path(tempfile.mkdtemp(prefix = f"unsloth-{agent}-"))
-        try:
-            yield path
-        finally:
-            shutil.rmtree(path, ignore_errors = True)
+        parent = _ephemeral_session_parent(agent)
+        if parent is not None:
+            with _short_ephemeral_session(parent) as path:
+                yield path
+        else:
+            path = Path(tempfile.mkdtemp(prefix = _ephemeral_session_prefix(agent, parent)))
+            try:
+                yield path
+            finally:
+                shutil.rmtree(path, ignore_errors = True)
     else:
         # Never wipe this dir: a previously printed recipe may still be running
         # an agent whose sessions/state live here, and every config writer
@@ -2949,9 +3216,11 @@ def claude(
     max_seq_length: int = _CONTEXT_OPTION,
     load_in_4bit: bool = _LOAD_4BIT_OPTION,
     tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    gpu_memory_mode: Optional[Literal["auto", "manual"]] = _GPU_MEMORY_MODE_OPTION,
     enable_tools: bool = _ENABLE_TOOLS_OPTION,
     tool_call_healing: Optional[bool] = _TOOL_CALL_HEALING_OPTION,
     tool_call_nudging: Optional[bool] = _TOOL_CALL_NUDGING_OPTION,
+    reasoning: Optional[Literal["on", "off", "auto"]] = _REASONING_OPTION,
     temperature: Optional[float] = _TEMPERATURE_OPTION,
     top_p: Optional[float] = _TOP_P_OPTION,
     top_k: Optional[int] = _TOP_K_OPTION,
@@ -2969,13 +3238,14 @@ def claude(
     base, key, entry = _connect(
         api_key,
         model,
-        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel, gpu_memory_mode),
         serve = serve,
         launch = launch,
         server_options = ServerOptions(
             enable_tools = enable_tools,
             tool_call_healing = tool_call_healing,
             tool_call_nudging = tool_call_nudging,
+            reasoning = reasoning,
             temperature = temperature,
             top_p = top_p,
             top_k = top_k,
@@ -3066,9 +3336,11 @@ def codex(
     max_seq_length: int = _CONTEXT_OPTION,
     load_in_4bit: bool = _LOAD_4BIT_OPTION,
     tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    gpu_memory_mode: Optional[Literal["auto", "manual"]] = _GPU_MEMORY_MODE_OPTION,
     enable_tools: bool = _ENABLE_TOOLS_OPTION,
     tool_call_healing: Optional[bool] = _TOOL_CALL_HEALING_OPTION,
     tool_call_nudging: Optional[bool] = _TOOL_CALL_NUDGING_OPTION,
+    reasoning: Optional[Literal["on", "off", "auto"]] = _REASONING_OPTION,
     temperature: Optional[float] = _TEMPERATURE_OPTION,
     top_p: Optional[float] = _TOP_P_OPTION,
     top_k: Optional[int] = _TOP_K_OPTION,
@@ -3086,13 +3358,14 @@ def codex(
     base, key, entry = _connect(
         api_key,
         model,
-        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel, gpu_memory_mode),
         serve = serve,
         launch = launch,
         server_options = ServerOptions(
             enable_tools = enable_tools,
             tool_call_healing = tool_call_healing,
             tool_call_nudging = tool_call_nudging,
+            reasoning = reasoning,
             temperature = temperature,
             top_p = top_p,
             top_k = top_k,
@@ -3164,9 +3437,11 @@ def openclaw(
     max_seq_length: int = _CONTEXT_OPTION,
     load_in_4bit: bool = _LOAD_4BIT_OPTION,
     tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    gpu_memory_mode: Optional[Literal["auto", "manual"]] = _GPU_MEMORY_MODE_OPTION,
     enable_tools: bool = _ENABLE_TOOLS_OPTION,
     tool_call_healing: Optional[bool] = _TOOL_CALL_HEALING_OPTION,
     tool_call_nudging: Optional[bool] = _TOOL_CALL_NUDGING_OPTION,
+    reasoning: Optional[Literal["on", "off", "auto"]] = _REASONING_OPTION,
     temperature: Optional[float] = _TEMPERATURE_OPTION,
     top_p: Optional[float] = _TOP_P_OPTION,
     top_k: Optional[int] = _TOP_K_OPTION,
@@ -3184,13 +3459,14 @@ def openclaw(
     base, key, entry = _connect(
         api_key,
         model,
-        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel, gpu_memory_mode),
         serve = serve,
         launch = launch,
         server_options = ServerOptions(
             enable_tools = enable_tools,
             tool_call_healing = tool_call_healing,
             tool_call_nudging = tool_call_nudging,
+            reasoning = reasoning,
             temperature = temperature,
             top_p = top_p,
             top_k = top_k,
@@ -3244,9 +3520,11 @@ def opencode(
     max_seq_length: int = _CONTEXT_OPTION,
     load_in_4bit: bool = _LOAD_4BIT_OPTION,
     tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    gpu_memory_mode: Optional[Literal["auto", "manual"]] = _GPU_MEMORY_MODE_OPTION,
     enable_tools: bool = _ENABLE_TOOLS_OPTION,
     tool_call_healing: Optional[bool] = _TOOL_CALL_HEALING_OPTION,
     tool_call_nudging: Optional[bool] = _TOOL_CALL_NUDGING_OPTION,
+    reasoning: Optional[Literal["on", "off", "auto"]] = _REASONING_OPTION,
     temperature: Optional[float] = _TEMPERATURE_OPTION,
     top_p: Optional[float] = _TOP_P_OPTION,
     top_k: Optional[int] = _TOP_K_OPTION,
@@ -3264,13 +3542,14 @@ def opencode(
     base, key, entry = _connect(
         api_key,
         model,
-        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel, gpu_memory_mode),
         serve = serve,
         launch = launch,
         server_options = ServerOptions(
             enable_tools = enable_tools,
             tool_call_healing = tool_call_healing,
             tool_call_nudging = tool_call_nudging,
+            reasoning = reasoning,
             temperature = temperature,
             top_p = top_p,
             top_k = top_k,
@@ -3404,9 +3683,11 @@ def hermes(
     max_seq_length: int = _CONTEXT_OPTION,
     load_in_4bit: bool = _LOAD_4BIT_OPTION,
     tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    gpu_memory_mode: Optional[Literal["auto", "manual"]] = _GPU_MEMORY_MODE_OPTION,
     enable_tools: bool = _ENABLE_TOOLS_OPTION,
     tool_call_healing: Optional[bool] = _TOOL_CALL_HEALING_OPTION,
     tool_call_nudging: Optional[bool] = _TOOL_CALL_NUDGING_OPTION,
+    reasoning: Optional[Literal["on", "off", "auto"]] = _REASONING_OPTION,
     temperature: Optional[float] = _TEMPERATURE_OPTION,
     top_p: Optional[float] = _TOP_P_OPTION,
     top_k: Optional[int] = _TOP_K_OPTION,
@@ -3426,13 +3707,14 @@ def hermes(
     base, key, entry = _connect(
         api_key,
         model,
-        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel, gpu_memory_mode),
         serve = serve,
         launch = launch,
         server_options = ServerOptions(
             enable_tools = enable_tools,
             tool_call_healing = tool_call_healing,
             tool_call_nudging = tool_call_nudging,
+            reasoning = reasoning,
             temperature = temperature,
             top_p = top_p,
             top_k = top_k,
@@ -3460,9 +3742,11 @@ def pi(
     max_seq_length: int = _CONTEXT_OPTION,
     load_in_4bit: bool = _LOAD_4BIT_OPTION,
     tensor_parallel: bool = _TENSOR_PARALLEL_OPTION,
+    gpu_memory_mode: Optional[Literal["auto", "manual"]] = _GPU_MEMORY_MODE_OPTION,
     enable_tools: bool = _ENABLE_TOOLS_OPTION,
     tool_call_healing: Optional[bool] = _TOOL_CALL_HEALING_OPTION,
     tool_call_nudging: Optional[bool] = _TOOL_CALL_NUDGING_OPTION,
+    reasoning: Optional[Literal["on", "off", "auto"]] = _REASONING_OPTION,
     temperature: Optional[float] = _TEMPERATURE_OPTION,
     top_p: Optional[float] = _TOP_P_OPTION,
     top_k: Optional[int] = _TOP_K_OPTION,
@@ -3480,13 +3764,14 @@ def pi(
     base, key, entry = _connect(
         api_key,
         model,
-        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel),
+        LoadOptions(gguf_variant, max_seq_length, load_in_4bit, tensor_parallel, gpu_memory_mode),
         serve = serve,
         launch = launch,
         server_options = ServerOptions(
             enable_tools = enable_tools,
             tool_call_healing = tool_call_healing,
             tool_call_nudging = tool_call_nudging,
+            reasoning = reasoning,
             temperature = temperature,
             top_p = top_p,
             top_k = top_k,
diff --git a/unsloth_cli/commands/studio.py b/unsloth_cli/commands/studio.py
index 1f56b29325..9fd264ddf5 100644
--- a/unsloth_cli/commands/studio.py
+++ b/unsloth_cli/commands/studio.py
@@ -19,9 +19,10 @@ import urllib.error
 import urllib.request
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import List, Optional
+from typing import List, Literal, Optional
 import typer
 
+from unsloth_cli import _studio_deps
 from unsloth_cli.commands import _password_prompt
 
 studio_app = typer.Typer(help = "Unsloth Studio commands.")
@@ -229,6 +230,15 @@ def _find_run_py() -> Optional[Path]:
     return None
 
 
+def _install_state() -> dict:
+    """verify_install() result for this install root.
+
+    STUDIO_HOME is an extra search root so a CLI installed outside the managed
+    venv still inspects the venv the desktop app launches.
+    """
+    return _studio_deps.install_state(extra_roots = (STUDIO_HOME / "unsloth_studio",))
+
+
 _RUN_MODULE = None
 
 
@@ -295,7 +305,9 @@ def _find_setup_script() -> Optional[Path]:
 _PARALLEL_MIN = 1
 _PARALLEL_MAX = 64
 _PARALLEL_DEFAULT_RUN = 4  # pre-PR hardcoded for `unsloth studio run`
-_PARALLEL_DEFAULT_PLAIN = 1  # pre-PR effective for plain `unsloth studio`
+# New Chat leaves the previous conversation generating and the admission queue caps decodes at
+# the slot count, so at 1 every extra chat queues. _slots_that_fit_on_gpu() may cut it back.
+_PARALLEL_DEFAULT_PLAIN = 4
 
 
 def _resolve_secure(secure: bool, not_secure: bool) -> bool:
@@ -1172,6 +1184,7 @@ def _load_model_via_http(
     gguf_variant: Optional[str],
     max_seq_length: int,
     load_in_4bit: bool,
+    gpu_memory_mode: Literal["auto", "manual"] = "auto",
     tensor_parallel: bool = False,
     llama_extra_args: Optional[List[str]] = None,
     timeout: int = 600,
@@ -1188,6 +1201,9 @@ def _load_model_via_http(
     }
     if gguf_variant:
         payload["gguf_variant"] = gguf_variant
+    if gpu_memory_mode == "manual":
+        payload["gpu_memory_mode"] = "manual"
+        payload["gpu_layers"] = -1
     if tensor_parallel:
         payload["tensor_parallel"] = True
     if llama_extra_args:
@@ -1247,9 +1263,8 @@ def studio_default(
         max = _PARALLEL_MAX,
         help = (
             f"llama-server parallel decode slots ({_PARALLEL_MIN}..{_PARALLEL_MAX}). "
-            f"Default {_PARALLEL_DEFAULT_PLAIN}; `unsloth studio run` "
-            f"defaults to {_PARALLEL_DEFAULT_RUN}. The Studio run settings "
-            "(Parallel Slots) can override it per load."
+            f"Default {_PARALLEL_DEFAULT_PLAIN}. The Studio run settings "
+            "(Parallel Slots) override it per load."
         ),
     ),
     cloudflare: Optional[bool] = typer.Option(
@@ -1552,7 +1567,8 @@ def studio_default(
             typer.echo("Unsloth Studio not set up. Run install.sh first.")
             raise typer.Exit(1)
 
-    run_mod = _load_run_module()
+    with _studio_deps.studio_backend_imports("unsloth studio"):
+        run_mod = _load_run_module()
     run_server = run_mod.run_server
 
     if not silent:
@@ -1729,6 +1745,16 @@ def run(
         rich_help_panel = _RUN_PANEL_MODEL,
         help = "Runtime context length in tokens (0 = model default for GGUF; 2048 for hub models)",
     ),
+    gpu_memory_mode: Literal["auto", "manual"] = typer.Option(
+        "auto",
+        "--gpu-memory-mode",
+        rich_help_panel = _RUN_PANEL_MODEL,
+        help = (
+            "GPU memory strategy for GGUF models. Auto lets Unsloth select GPUs "
+            "and cap context to fit VRAM. Manual with default layers and context "
+            "delegates placement and sizing to llama.cpp --fit."
+        ),
+    ),
     load_in_4bit: bool = typer.Option(
         True, "--load-in-4bit/--no-load-in-4bit", rich_help_panel = _RUN_PANEL_MODEL
     ),
@@ -2129,6 +2155,8 @@ def run(
             "--host",
             host,
         ]
+        if gpu_memory_mode != "auto":
+            args.extend(["--gpu-memory-mode", gpu_memory_mode])
         if gguf_variant:
             args.extend(["--gguf-variant", gguf_variant])
         # Forward the explicit polarity; a future default flip on one
@@ -2187,7 +2215,8 @@ def run(
             os.environ.pop(_START_API_KEY_MARKER_ENV, None)
 
     # ── 2. Start server (always suppress built-in banner) ─────────────
-    run_mod = _load_run_module()
+    with _studio_deps.studio_backend_imports("unsloth studio"):
+        run_mod = _load_run_module()
     run_server = run_mod.run_server
 
     # Match the route handlers' import path: run.py adds studio/backend/ to
@@ -2246,6 +2275,7 @@ def run(
                 gguf_variant = gguf_variant,
                 max_seq_length = max_seq_length,
                 load_in_4bit = load_in_4bit,
+                gpu_memory_mode = gpu_memory_mode,
                 tensor_parallel = tensor_parallel,
                 llama_extra_args = extra_llama_args,
             )
@@ -2789,12 +2819,18 @@ def desktop_capabilities(
         help = "Emit machine-readable JSON.",
     ),
 ):
+    state = _install_state()
     payload = {
         "desktop_protocol_version": 1,
-        "desktop_manageability_version": 1,
+        # 2 adds studio_install_ok; the desktop treats < 2 as stale rather than
+        # guess at an absent field.
+        "desktop_manageability_version": 2,
         "supports_provision_desktop_auth": True,
         "supports_api_only": True,
         "supports_desktop_backend_ownership": True,
+        # Did the install finish and are the backend's boot deps still there.
+        "studio_install_ok": bool(state["ok"]),
+        "studio_install_reason": state["reason"],
         "version": "unknown",
     }
     try:
@@ -2811,6 +2847,36 @@ def desktop_capabilities(
         typer.echo(f"{key}: {value}")
 
 
+@studio_app.command("verify-install")
+def verify_install(
+    json_output: bool = typer.Option(
+        False,
+        "--json",
+        help = "Emit machine-readable JSON.",
+    ),
+):
+    """Check that the Unsloth Studio dependency install completed.
+
+    Exits 0 when complete, 1 otherwise. setup.sh / setup.ps1 use the exit code
+    to decide whether the "already up to date" fast path may be taken.
+    """
+    state = _install_state()
+
+    if json_output:
+        typer.echo(json.dumps(state, sort_keys = True))
+        raise typer.Exit(0 if state["ok"] else 1)
+
+    if state["ok"]:
+        typer.echo("Unsloth Studio install is complete.")
+        raise typer.Exit(0)
+
+    typer.echo(f"Unsloth Studio install is incomplete ({state['reason']}).")
+    if state["missing"]:
+        typer.echo(f"  missing packages: {', '.join(state['missing'])}")
+    typer.echo("  repair with: unsloth studio update")
+    raise typer.Exit(1)
+
+
 @studio_app.command("provision-desktop-auth", hidden = True)
 def provision_desktop_auth():
     """Create/repair desktop auth state for the local machine."""
diff --git a/unsloth_cli/commands/train.py b/unsloth_cli/commands/train.py
index c52c2344b7..4bff2f2876 100644
--- a/unsloth_cli/commands/train.py
+++ b/unsloth_cli/commands/train.py
@@ -8,13 +8,15 @@ from typing import Optional
 import typer
 
 from unsloth_cli._inference import ensure_studio_backend_path
+from unsloth_cli._studio_deps import studio_backend_imports
 from unsloth_cli.config import Config, load_config
 from unsloth_cli.options import add_options_from_config
 
 
 def _should_use_mlx_backend_for_cli() -> bool:
     ensure_studio_backend_path()
-    from studio.backend.core.training.training import should_use_mlx_training_backend
+    with studio_backend_imports("unsloth train"):
+        from studio.backend.core.training.training import should_use_mlx_training_backend
     return should_use_mlx_training_backend()
 
 
@@ -33,12 +35,14 @@ def _create_cli_trainer(model_name: str, hf_token: Optional[str]):
         _activate_mlx_transformers(model_name, hf_token)
         # MLX is torch-free: use the lightweight adapter, not trainer.py (imports torch/unsloth/trl at load).
         ensure_studio_backend_path()
-        from studio.backend.core.training.training import create_mlx_trainer_adapter
+        with studio_backend_imports("unsloth train"):
+            from studio.backend.core.training.training import create_mlx_trainer_adapter
 
         return create_mlx_trainer_adapter()
 
     ensure_studio_backend_path()
-    from studio.backend.core.training.trainer import UnslothTrainer
+    with studio_backend_imports("unsloth train"):
+        from studio.backend.core.training.trainer import UnslothTrainer
 
     return UnslothTrainer()
 
diff --git a/unsloth_cli/tests/test_claude_plan_gate.py b/unsloth_cli/tests/test_claude_plan_gate.py
new file mode 100644
index 0000000000..85336c8dfe
--- /dev/null
+++ b/unsloth_cli/tests/test_claude_plan_gate.py
@@ -0,0 +1,179 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
+
+"""Deterministic plan-mode routing for the local Claude subagent.
+
+SKILL.md asks the parent model to pick the read-only tool in plan mode, which a
+small local model can forget. The generated plugin also ships a PreToolUse hook
+that reads permission_mode directly, so the editing agent is denied by rule.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+
+import pytest
+
+from unsloth_cli.commands import start
+
+
+def _plugin(tmp_path):
+    return start.write_claude_subagent_plugin(tmp_path, {"UNSLOTH_CLAUDE_SUBAGENT_MODEL": "m"})
+
+
+def _run_gate(script, payload):
+    return subprocess.run(
+        [sys.executable, str(script)],
+        input = payload,
+        capture_output = True,
+        text = True,
+        timeout = 30,
+    )
+
+
+def test_plugin_registers_a_pretooluse_hook_on_the_editing_tool(tmp_path):
+    plugin = _plugin(tmp_path)
+
+    hooks = json.loads((plugin / "hooks" / "hooks.json").read_text())["hooks"]["PreToolUse"]
+
+    [entry] = hooks
+    # Only the destructive tool is gated; the read-only agent stays reachable.
+    assert entry["matcher"] == start._CLAUDE_SUBAGENT_TOOL
+    assert start._CLAUDE_SUBAGENT_PLAN_TOOL not in json.dumps(hooks)
+    [hook] = entry["hooks"]
+    assert hook["type"] == "command"
+    assert sys.executable in hook["command"]
+    # The interpreter is quoted: unquoted, any space in the path splits the command.
+    assert f'"{sys.executable}"' in hook["command"]
+    # The gate path rides as base64, never as a literal the shell can expand.
+    encoded = start._b64_path(plugin / "hooks" / "plan_gate.py")
+    assert encoded in hook["command"]
+    assert str(plugin / "hooks" / "plan_gate.py") not in hook["command"]
+    # A hook with no timeout stalls the parent for as long as it hangs.
+    assert 0 < hook["timeout"] <= 30
+
+
+def test_gate_script_is_written_and_compiles(tmp_path):
+    plugin = _plugin(tmp_path)
+    gate = plugin / "hooks" / "plan_gate.py"
+
+    compile(gate.read_text(), str(gate), "exec")  # syntax-valid as shipped
+
+
+def test_gate_denies_the_editing_tool_in_plan_mode(tmp_path):
+    gate = _plugin(tmp_path) / "hooks" / "plan_gate.py"
+
+    result = _run_gate(gate, json.dumps({"permission_mode": "plan"}))
+
+    assert result.returncode == 0
+    output = json.loads(result.stdout)["hookSpecificOutput"]
+    assert output["hookEventName"] == "PreToolUse"
+    assert output["permissionDecision"] == "deny"
+    # The reason is shown to the model, so it must name the tool to call instead.
+    assert "unsloth_plan_agent" in output["permissionDecisionReason"]
+
+
+@pytest.mark.parametrize("mode", ["default", "acceptEdits", "bypassPermissions", "dontAsk", "auto"])
+def test_gate_allows_every_non_plan_mode(tmp_path, mode):
+    gate = _plugin(tmp_path) / "hooks" / "plan_gate.py"
+
+    result = _run_gate(gate, json.dumps({"permission_mode": mode}))
+
+    assert result.returncode == 0
+    assert result.stdout.strip() == ""  # no decision -> normal permission flow
+
+
+@pytest.mark.parametrize("payload", ["", "not json", "[]", "null", "{}"])
+def test_gate_fails_open_on_unusable_input(tmp_path, payload):
+    # A hook crash would block the parent session, so anything unparsable allows.
+    gate = _plugin(tmp_path) / "hooks" / "plan_gate.py"
+
+    result = _run_gate(gate, payload)
+
+    assert result.returncode == 0
+    assert result.stdout.strip() == ""
+
+
+def test_plugin_still_writes_the_mcp_server_and_skill(tmp_path):
+    # The hook is additive; the existing wiring must be untouched.
+    plugin = _plugin(tmp_path)
+
+    assert (plugin / ".mcp.json").exists()
+    assert (plugin / "skills" / "local-agent" / "SKILL.md").exists()
+    assert (plugin / ".claude-plugin" / "plugin.json").exists()
+
+
+def test_wsl_run_clears_a_gate_left_by_an_earlier_windows_run(tmp_path, monkeypatch):
+    # The plugin dir survives across runs when persisted, so a gate written by a
+    # Windows run would otherwise be shipped into the distro with an interpreter
+    # path it cannot execute.
+    plugin = _plugin(tmp_path)
+    gate = plugin / "hooks" / "plan_gate.py"
+    hooks = plugin / "hooks" / "hooks.json"
+    assert gate.exists() and hooks.exists()
+
+    monkeypatch.setattr(start, "_wsl_windows_executable", lambda _argv: True)
+    monkeypatch.setenv("WSL_DISTRO_NAME", "Ubuntu")
+    _plugin(tmp_path)
+
+    assert not gate.exists()
+    assert not hooks.exists()
+
+
+def test_hook_command_survives_a_missing_gate_and_a_path_with_spaces(tmp_path):
+    # Handing the path straight to the interpreter makes a missing gate exit 2,
+    # which Claude treats as a blocking error: the editing tool would then be
+    # denied in every mode, not just plan. Going through runpy makes it exit 1.
+    plugin = _plugin(tmp_path / "dir with space")
+    hook = json.loads((plugin / "hooks" / "hooks.json").read_text())
+    command = hook["hooks"]["PreToolUse"][0]["hooks"][0]["command"]
+
+    # Works normally through the real shell path Claude uses.
+    denied = subprocess.run(
+        command,
+        input = json.dumps({"permission_mode": "plan"}),
+        shell = True,
+        capture_output = True,
+        text = True,
+        timeout = 30,
+    )
+    assert denied.returncode == 0
+    assert json.loads(denied.stdout)["hookSpecificOutput"]["permissionDecision"] == "deny"
+
+    (plugin / "hooks" / "plan_gate.py").unlink()
+    gone = subprocess.run(
+        command,
+        input = json.dumps({"permission_mode": "default"}),
+        shell = True,
+        capture_output = True,
+        text = True,
+        timeout = 30,
+    )
+    assert gone.returncode != 2, "exit 2 blocks the tool in every mode"
+    assert gone.stdout.strip() == ""
+
+
+@pytest.mark.parametrize("hostile", ["sub$(echo X)", "tick`echo X`", "var$HOME", "pct%TEMP%pct"])
+def test_gate_survives_shell_metacharacters_in_its_path(tmp_path, hostile):
+    # The hook command is run by a shell. A temp root holding these expands under
+    # sh (or cmd, for %VAR%) before Python sees the path, so the gate is not found
+    # and exits 1, which fails open and silently drops the routing message.
+    plugin = _plugin(tmp_path / hostile)
+    command = json.loads((plugin / "hooks" / "hooks.json").read_text())["hooks"]["PreToolUse"][0][
+        "hooks"
+    ][0]["command"]
+
+    denied = subprocess.run(
+        command,
+        input = json.dumps({"permission_mode": "plan"}),
+        shell = True,
+        capture_output = True,
+        text = True,
+        timeout = 60,
+    )
+
+    assert denied.returncode == 0, denied.stderr
+    decision = json.loads(denied.stdout)["hookSpecificOutput"]["permissionDecision"]
+    assert decision == "deny"
diff --git a/unsloth_cli/tests/test_claude_subagent_mcp.py b/unsloth_cli/tests/test_claude_subagent_mcp.py
index 568dc76ff5..2155ca050d 100644
--- a/unsloth_cli/tests/test_claude_subagent_mcp.py
+++ b/unsloth_cli/tests/test_claude_subagent_mcp.py
@@ -15,6 +15,16 @@ import pytest
 import unsloth_cli.claude_subagent_mcp as bridge
 
 
+def _stub_env(monkeypatch, tmp_path):
+    """Minimum env + claude lookup for driving run_local_agent under a fake Popen."""
+    monkeypatch.setenv("UNSLOTH_CLAUDE_SUBAGENT_BASE_URL", "http://127.0.0.1:8888")
+    monkeypatch.setenv("UNSLOTH_CLAUDE_SUBAGENT_API_KEY", "sk-unsloth-test")
+    monkeypatch.setenv("UNSLOTH_CLAUDE_SUBAGENT_MODEL", "unsloth/model-GGUF:Q4_K_M")
+    monkeypatch.setenv("CLAUDE_PROJECT_DIR", str(tmp_path))
+    monkeypatch.setattr(bridge.shutil, "which", lambda _: "/usr/local/bin/claude")
+    monkeypatch.setattr(bridge, "_claude_flags", lambda model: ["--settings", "{}"])
+
+
 def test_protocol_lists_and_calls_local_agent():
     initialized = bridge._response(
         {"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}},
@@ -229,6 +239,8 @@ def test_local_child_uses_unsloth_without_overwriting_parent_auth(
     assert command[:3] == ["/usr/local/bin/claude", "--model", "unsloth/model-GGUF:Q4_K_M"]
     assert command[command.index("--permission-mode") + 1] == permission
     assert "--no-session-persistence" in command
+    disallowed = command[command.index("--disallowedTools") + 1]
+    assert disallowed == "AskUserQuestion,EnterPlanMode,ExitPlanMode"
     assert captured["cwd"] == str(tmp_path)
     assert captured["stdin"] is bridge.subprocess.DEVNULL
     assert captured["stdout"] is bridge.subprocess.PIPE
@@ -275,6 +287,10 @@ def test_read_only_local_child_uses_plan_mode(monkeypatch, tmp_path):
     assert bridge.run_local_agent("plan this", read_only = True) == "PLAN_OK"
     command = captured["command"]
     assert command[command.index("--permission-mode") + 1] == "plan"
+    disallowed = command[command.index("--disallowedTools") + 1]
+    assert disallowed == "AskUserQuestion,EnterPlanMode,Edit,Write,NotebookEdit,Bash"
+    # Bash matters: plan mode routes it through a classifier served by this same
+    # local model, so without the deny a "read-only" child can still write files.
     prompt = command[command.index("--append-system-prompt") + 1]
     assert "read-only local coding subagent" in prompt
 
@@ -403,3 +419,37 @@ def test_stop_child_kills_survivors_after_leader_exit(monkeypatch, tmp_path):
 def test_result_parser_accepts_diagnostics_before_json():
     output = "connector warning\n" + json.dumps({"is_error": False, "result": "OK"})
     assert bridge._result_text(output) == "OK"
+
+
+def test_child_is_stopped_when_it_produces_nothing_before_the_deadline(monkeypatch, tmp_path):
+    # A local server that accepts and never answers used to block the child, and
+    # the parent waiting on it, indefinitely. Measured past 400s before this.
+    monkeypatch.setenv("UNSLOTH_CLAUDE_SUBAGENT_TIMEOUT", "0.3")
+    _stub_env(monkeypatch, tmp_path)
+    stopped = []
+
+    class _Hanging:
+        returncode = None
+
+        def communicate(self, timeout = None):
+            raise subprocess.TimeoutExpired("claude", timeout)
+
+        def poll(self):
+            return None
+
+    monkeypatch.setattr(bridge, "_stop_child", lambda proc: stopped.append(proc))
+    monkeypatch.setattr(bridge.subprocess, "Popen", lambda *a, **k: _Hanging())
+
+    with pytest.raises(RuntimeError, match = "produced nothing"):
+        bridge.run_local_agent("hello")
+    assert stopped, "a timed-out child must be killed, not left running"
+
+
+def test_timeout_can_be_disabled(monkeypatch):
+    monkeypatch.setenv("UNSLOTH_CLAUDE_SUBAGENT_TIMEOUT", "0")
+    assert bridge._timeout_seconds() == 0.0
+    for bad in ("", "   ", "abc"):
+        monkeypatch.setenv("UNSLOTH_CLAUDE_SUBAGENT_TIMEOUT", bad)
+        assert bridge._timeout_seconds() == bridge._DEFAULT_TIMEOUT_SECONDS
+    monkeypatch.delenv("UNSLOTH_CLAUDE_SUBAGENT_TIMEOUT")
+    assert bridge._timeout_seconds() == bridge._DEFAULT_TIMEOUT_SECONDS
diff --git a/unsloth_cli/tests/test_start.py b/unsloth_cli/tests/test_start.py
index dd0edfaa15..dd8a1daf2d 100644
--- a/unsloth_cli/tests/test_start.py
+++ b/unsloth_cli/tests/test_start.py
@@ -10,6 +10,7 @@ import os
 import re
 import shlex
 import sys
+import time
 import urllib.error
 from pathlib import Path
 from types import SimpleNamespace
@@ -1550,7 +1551,8 @@ def test_connect_codex_launch_uses_ephemeral_home(fake_studio, monkeypatch):
     assert result.exit_code == 0, result.output
     home = Path(captured["home"])
     assert captured["config_present"]  # config existed while codex ran
-    assert "unsloth-codex-" in home.name  # an ephemeral temp dir, not ~/.codex
+    parent = start._ephemeral_session_parent("codex")
+    assert home.name.startswith(start._ephemeral_session_prefix("codex", parent))
     assert not home.exists()  # cleaned up after the agent exits
 
 
@@ -1993,6 +1995,9 @@ def test_start_studio_server_forwards_tool_flags_via_command_and_env(monkeypatch
     start._start_studio_server("http://127.0.0.1:8888", "unsloth/M-GGUF", start.LoadOptions())
     cmd, env = captured["command"], captured["kwargs"]["env"]
     assert "--disable-tools" in cmd and "--enable-tools" not in cmd
+    assert "--reasoning" not in cmd
+    assert env["LLAMA_ARG_REASONING"] == "off"
+    assert "--gpu-memory-mode" not in cmd
     assert env["UNSLOTH_DISABLE_TOOL_CALL_HEALING"] == "0"
     assert env["UNSLOTH_TOOL_CALL_NUDGE"] == "1"
 
@@ -2001,10 +2006,17 @@ def test_start_studio_server_forwards_tool_flags_via_command_and_env(monkeypatch
         "http://127.0.0.1:8888",
         "unsloth/M-GGUF",
         start.LoadOptions(),
-        start.ServerOptions(enable_tools = True, tool_call_healing = False, tool_call_nudging = False),
+        start.ServerOptions(
+            enable_tools = True,
+            tool_call_healing = False,
+            tool_call_nudging = False,
+            reasoning = "auto",
+        ),
     )
     cmd, env = captured["command"], captured["kwargs"]["env"]
     assert "--enable-tools" in cmd and "--disable-tools" not in cmd
+    assert "--reasoning" not in cmd
+    assert env["LLAMA_ARG_REASONING"] == "auto"
     assert env["UNSLOTH_DISABLE_TOOL_CALL_HEALING"] == "1"
     assert env["UNSLOTH_TOOL_CALL_NUDGE"] == "0"
 
@@ -2117,7 +2129,25 @@ def test_require_studio_no_sampling_warning_without_pins(monkeypatch, capsys):
         server_options = start.ServerOptions(enable_tools = True),
     )
     assert base == BASE and server is None
-    assert "sampling" not in capsys.readouterr().err.lower()
+    assert capsys.readouterr().err == ""
+
+
+@pytest.mark.parametrize("reasoning", ["on", "off", "auto"])
+def test_require_studio_warns_on_explicit_reasoning_when_reusing_server(
+    monkeypatch, capsys, reasoning
+):
+    monkeypatch.setattr(start, "find_studio_server", lambda: BASE)
+    base, server = start._require_studio(
+        "unsloth/M-GGUF",
+        start.LoadOptions(),
+        serve = True,
+        server_options = start.ServerOptions(reasoning = reasoning),
+    )
+    assert base == BASE and server is None
+    err = capsys.readouterr().err
+    assert "already running" in err
+    assert f"--reasoning {reasoning}" in err
+    assert "unsloth studio stop" in err
 
 
 def test_start_claude_parses_sampling_flags(fake_studio, monkeypatch):
@@ -2152,11 +2182,14 @@ def test_start_claude_parses_sampling_flags(fake_studio, monkeypatch):
             "0.3",
             "--top-k",
             "40",
+            "--reasoning",
+            "on",
         ],
     )
     assert result.exit_code == 0, result.output
     so = captured["server_options"]
     assert so.temperature == 0.3 and so.top_k == 40 and so.top_p is None
+    assert so.reasoning == "on"
 
 
 def test_connect_model_bare_id_matches_loaded_without_reload(fake_studio):
@@ -2206,6 +2239,59 @@ def test_connect_load_knobs_reach_server_even_when_id_loaded(fake_studio):
     ]
 
 
+@pytest.mark.parametrize(
+    "command_name", ["claude", "codex", "openclaw", "opencode", "hermes", "pi"]
+)
+def test_start_agents_expose_gpu_memory_mode_option(command_name):
+    import inspect
+
+    command = getattr(start, command_name)
+    opt = inspect.signature(command).parameters["gpu_memory_mode"].default
+    assert set(getattr(opt, "param_decls", None) or []) == {"--gpu-memory-mode"}
+    assert getattr(opt, "default", None) is None
+    assert getattr(opt, "rich_help_panel", None) == start._PANEL_MODEL
+
+
+@pytest.mark.parametrize(
+    "mode,expected",
+    [
+        ("auto", {"model_path": MODEL["id"], "gpu_memory_mode": "auto"}),
+        (
+            "manual",
+            {
+                "model_path": MODEL["id"],
+                "gpu_memory_mode": "manual",
+                "gpu_layers": -1,
+            },
+        ),
+    ],
+)
+def test_start_gpu_memory_mode_reaches_running_server(fake_studio, mode, expected):
+    result = CliRunner().invoke(
+        start.start_app,
+        [
+            "claude",
+            "--no-launch",
+            "--model",
+            MODEL["id"],
+            "--gpu-memory-mode",
+            mode,
+        ],
+    )
+    assert result.exit_code == 0, result.output
+    loads = [call for call in fake_studio if call[1].endswith("/api/inference/load")]
+    assert loads == [("POST", f"{BASE}/api/inference/load", expected)]
+
+
+def test_start_rejects_invalid_gpu_memory_mode(fake_studio):
+    result = CliRunner().invoke(
+        start.start_app,
+        ["claude", "--no-launch", "--gpu-memory-mode", "invalid"],
+    )
+    assert result.exit_code != 0
+    assert "Invalid value for '--gpu-memory-mode'" in result.output
+
+
 def test_connect_model_variant_suffix_loads_split_repo(fake_studio):
     # When the model is not already loaded, the `:QUANT` suffix becomes the gguf_variant
     # and the load uses the bare (valid) repo id, mirroring `unsloth run repo --gguf-variant`.
@@ -2617,16 +2703,23 @@ def test_start_studio_server_builds_command_and_waits(monkeypatch, capsys):
         "http://127.0.0.1:8888",
         "unsloth/Qwen3-1.7B-GGUF:UD-Q4_K_XL",
         start.LoadOptions(
-            gguf_variant = "UD-Q4_K_XL", max_seq_length = 8192, load_in_4bit = True, tensor_parallel = True
+            gguf_variant = "UD-Q4_K_XL",
+            max_seq_length = 8192,
+            load_in_4bit = True,
+            tensor_parallel = True,
+            gpu_memory_mode = "manual",
         ),
     )
     cmd = captured["command"]
     assert cmd[1] == "run"
     assert "--disable-tools" in cmd and "--no-cloudflare" in cmd
+    assert "--reasoning" not in cmd
+    assert captured["kwargs"]["env"]["LLAMA_ARG_REASONING"] == "off"
     assert cmd[cmd.index("--model") + 1] == "unsloth/Qwen3-1.7B-GGUF:UD-Q4_K_XL"
     assert cmd[cmd.index("--gguf-variant") + 1] == "UD-Q4_K_XL"
     assert cmd[cmd.index("--context-length") + 1] == "8192"
     assert "--tensor-parallel" in cmd
+    assert cmd[cmd.index("--gpu-memory-mode") + 1] == "manual"
     assert "--start-api-key-marker" not in cmd
     assert captured["kwargs"]["env"][start._START_API_KEY_MARKER_ENV] == "1"
     assert start.os.environ[start._START_API_KEY_MARKER_ENV] == "parent"
@@ -4643,7 +4736,96 @@ def test_session_config_default_launch_is_ephemeral():
     # Default launch (no --persist) still uses a throwaway temp dir wiped on exit.
     with start._session_config("codex", launch = True) as home:
         assert home.exists()
-        assert "unsloth-codex-" in home.name
+        parent = start._ephemeral_session_parent("codex")
+        assert home.name.startswith(start._ephemeral_session_prefix("codex", parent))
+    assert not home.exists()
+
+
+def test_session_config_codex_uses_short_ephemeral_parent(monkeypatch, tmp_path):
+    # Windows Codex checks out its curated plugins under CODEX_HOME/.tmp/plugins.
+    # Put its throwaway home outside the longer system temp path so that checkout
+    # stays below legacy MAX_PATH and Codex does not reject temp-dir PATH helpers.
+    short_parent = tmp_path / "u"
+    short_parent.mkdir()
+    monkeypatch.setattr(
+        start,
+        "_ephemeral_session_parent",
+        lambda agent: short_parent if agent == "codex" else None,
+    )
+
+    with start._session_config("codex", launch = True) as home:
+        assert home.parent == short_parent
+        assert home.name.startswith("u-codex-")
+        assert home.exists()
+    assert not home.exists()
+
+
+def test_locked_file_windows_blocking_retries_until_acquired(monkeypatch, tmp_path):
+    attempts = []
+    sleeps = []
+
+    def locking(_fd, mode, _length):
+        if mode == 1:
+            attempts.append(mode)
+            if len(attempts) < 3:
+                raise PermissionError(start.errno.EACCES, "busy")
+
+    fake_msvcrt = SimpleNamespace(LK_NBLCK = 1, LK_UNLCK = 2, locking = locking)
+    monkeypatch.setitem(sys.modules, "msvcrt", fake_msvcrt)
+    _simulate_windows(monkeypatch)
+    monkeypatch.setattr(start.time, "sleep", sleeps.append)
+
+    with start._locked_file(tmp_path / "lock") as acquired:
+        assert acquired
+    assert len(attempts) == 3
+    assert sleeps == [0.05, 0.05]
+
+
+def test_session_config_reclaims_old_short_homes_but_keeps_recent_and_live(monkeypatch, tmp_path):
+    short_parent = tmp_path / "u"
+    short_parent.mkdir()
+    stale = short_parent / "u-codex-abandoned"
+    stale.mkdir()
+    (stale / ".active.lock").write_bytes(b"\0")
+    (stale / "plugin-checkout").write_text("left behind")
+    old = time.time() - start._CODEX_EPHEMERAL_STALE_SECONDS - 1
+    os.utime(stale / ".active.lock", (old, old))
+    recent = short_parent / "u-codex-surviving-child"
+    recent.mkdir()
+    (recent / ".active.lock").write_bytes(b"\0")
+    monkeypatch.setattr(
+        start,
+        "_ephemeral_session_parent",
+        lambda agent: short_parent if agent == "codex" else None,
+    )
+
+    with start._session_config("codex", launch = True) as first:
+        assert not stale.exists()
+        assert recent.exists()
+        with start._session_config("codex", launch = True) as second:
+            assert first.exists()
+            assert second.exists()
+            assert first != second
+        assert first.exists()
+        assert not second.exists()
+    assert not first.exists()
+
+
+def test_session_config_serializes_normal_short_home_deletion(monkeypatch, tmp_path):
+    short_parent = tmp_path / "u"
+    short_parent.mkdir()
+    monkeypatch.setattr(start, "_ephemeral_session_parent", lambda _agent: short_parent)
+    original_rmtree = start.shutil.rmtree
+
+    def checked_rmtree(path, *args, **kwargs):
+        if path.parent == short_parent and path.name.startswith("u-codex-"):
+            with start._locked_file(short_parent / ".cleanup.lock", blocking = False) as unlocked:
+                assert not unlocked
+        return original_rmtree(path, *args, **kwargs)
+
+    monkeypatch.setattr(start.shutil, "rmtree", checked_rmtree)
+    with start._session_config("codex", launch = True) as home:
+        assert home.exists()
     assert not home.exists()
 
 
@@ -4691,7 +4873,8 @@ def test_default_launch_home_is_ephemeral(agent, fake_studio, tmp_path, monkeypa
     monkeypatch.setattr(start.shutil, "which", lambda _: f"/usr/local/bin/{agent}")
     captured = _capture_launch(monkeypatch, [agent])
     home = captured["env"][_RESUME_ENV_VAR[agent]]
-    assert f"unsloth-{agent}-" in home
+    parent = start._ephemeral_session_parent(agent)
+    assert start._ephemeral_session_prefix(agent, parent) in home
     assert str(tmp_path / "agents") not in home
 
 
diff --git a/unsloth_cli/tests/test_studio_run_parallel_flag.py b/unsloth_cli/tests/test_studio_run_parallel_flag.py
index 972abb5d4d..f1a4e69b81 100644
--- a/unsloth_cli/tests/test_studio_run_parallel_flag.py
+++ b/unsloth_cli/tests/test_studio_run_parallel_flag.py
@@ -13,7 +13,9 @@ canonicaliser and the legacy `-m` / `-hfr` / `-f` shim.
 
 from __future__ import annotations
 
+import json
 import sys
+from io import BytesIO
 from pathlib import Path
 
 import pytest
@@ -63,6 +65,19 @@ def test_context_length_alias_is_registered():
     assert "--context-length" in flags
 
 
+def test_gpu_memory_mode_option_is_registered_with_auto_default():
+    """The GPU placement policy is a first-class model option."""
+    studio_mod = _load_run_command()
+    import inspect
+
+    sig = inspect.signature(studio_mod.run)
+    opt = sig.parameters["gpu_memory_mode"].default
+    flags = set(getattr(opt, "param_decls", None) or [])
+    assert flags == {"--gpu-memory-mode"}
+    assert getattr(opt, "default", None) == "auto"
+    assert getattr(opt, "rich_help_panel", None) == "Model"
+
+
 def test_parallel_default_is_four():
     """Default must stay at 4 so plain `unsloth studio run` is unchanged."""
     studio_mod = _load_run_command()
@@ -377,6 +392,75 @@ def test_reexec_forwards_context_length_alias(monkeypatch):
     assert "--context-length" not in argv, argv
 
 
+def test_reexec_forwards_manual_gpu_memory_mode(monkeypatch):
+    """An explicit manual policy must survive the Studio venv re-exec."""
+    result, captured = _invoke_run(
+        monkeypatch,
+        _BASE + ["--gpu-memory-mode", "manual"],
+    )
+    assert len(captured) == 1, result.output
+    argv = captured[0]["argv"]
+    assert _value_after(argv, "--gpu-memory-mode") == "manual", argv
+
+
+def test_reexec_omits_default_gpu_memory_mode(monkeypatch):
+    """The default stays compatible with older Studio venv launchers."""
+    result, captured = _invoke_run(monkeypatch, _BASE)
+    assert len(captured) == 1, result.output
+    assert "--gpu-memory-mode" not in captured[0]["argv"]
+
+
+def test_run_rejects_invalid_gpu_memory_mode(monkeypatch):
+    result, captured = _invoke_run(
+        monkeypatch,
+        _BASE + ["--gpu-memory-mode", "invalid"],
+    )
+    assert result.exit_code != 0
+    assert captured == []
+
+
+@pytest.mark.parametrize(
+    "mode,expected",
+    [
+        ("auto", {"model_path": "owner/model-GGUF", "max_seq_length": 0, "load_in_4bit": True}),
+        (
+            "manual",
+            {
+                "model_path": "owner/model-GGUF",
+                "max_seq_length": 0,
+                "load_in_4bit": True,
+                "gpu_memory_mode": "manual",
+                "gpu_layers": -1,
+            },
+        ),
+    ],
+)
+def test_load_model_http_payload_for_gpu_memory_mode(monkeypatch, mode, expected):
+    """Manual plus untouched layer and context settings matches the UI payload."""
+    studio_mod = _load_run_command()
+    captured = {}
+
+    def urlopen(request, timeout):
+        captured["request"] = request
+        captured["timeout"] = timeout
+        return BytesIO(b'{"model": "owner/model-GGUF"}')
+
+    monkeypatch.setattr(studio_mod.urllib.request, "urlopen", urlopen)
+    result = studio_mod._load_model_via_http(
+        port = 8888,
+        api_key = "sk-test",
+        model = "owner/model-GGUF",
+        gguf_variant = None,
+        max_seq_length = 0,
+        load_in_4bit = True,
+        gpu_memory_mode = mode,
+    )
+
+    assert result == {"model": "owner/model-GGUF"}
+    assert json.loads(captured["request"].data) == expected
+    assert captured["request"].get_header("Authorization") == "Bearer sk-test"
+
+
 def test_reexec_mixed_parallel_with_passthrough(monkeypatch):
     """--parallel + llama-server pass-through flags must all reach the child."""
     result, captured = _invoke_run(